Managed Threat Hunting Services: What You Get and How to Evaluate Providers

Managed threat hunting is not a standardized service. The same contract language can cover hypothesis-driven investigation run on a defined cadence by a named senior hunter, or a recurring indicator sweep presented as proactive security.

That gap matters more now than it did five years ago. SANS's 2025 survey found that 76% of organizations reported seeing living-off-the-land techniques in nation-state attacks. Indicator matching is poorly suited to catching attackers who work through built-in system tools, and that behavior is precisely what a hunting service exists to find. Buyers evaluating managed threat hunting will fund both versions of the service unless the contract distinguishes them.

TL;DR:

• Judge a hunting service by its detection output. A hunt that produces new detection logic succeeded; a report listing only checked indicators does not meet the threshold for mature hunting output.
• Hunting inside MDR contracts may be reactive. It may fire only after a major known attack or a fresh intel drop. Treat unpriced "proactive hunting" claims as IOC matching until the provider proves otherwise.
• Telemetry economics constrain hunt quality before methodology does. Volume-priced SIEMs and missing identity or cloud control plane logs cap what any hunter, human or agentic, can find.
• Agentic execution is beginning to reduce the hunter-hours constraint. As execution scales, hypothesis quality and historic context become the differentiators, along with telemetry and organizational context, which favors services that pair senior experts with AI execution.

What a Standalone Threat Hunting Service Actually Delivers

Demand contract terms for a named hunter, a defined cadence, documented hunt output, and a handoff into detection engineering. The contract should state who performs the hunting, how often hunts occur, how findings are delivered, and whether the results are mapped to frameworks such as MITRE ATT&CK. The UK Government's threat hunting guide treats hunt output and detection improvement as program-level measures rather than optional extras.

The work behind those terms should be hypothesis-driven investigation supported by behavioral and anomaly-based analysis, with threat sweep capability for fast IOC validation and ongoing tuning of hunt procedures as each hunt teaches the program something.

Contracts should specify the output artifact as clearly as the activity. A mature hunt should produce hunt documentation containing the hypothesis tested, data sources used, queries run, findings whether positive or negative, and recommendations for detection improvements. The UK Government's threat hunting guide goes further and turns that into a measurable program metric, tracking how often a hunt ends in a new detection analytic or rule. Providers that cannot report that number may not be operating the structured program they describe.

Hunting Inside an MDR Contract vs. a Dedicated Service

Buyers should not assume hunting in an MDR engagement is a standing program. It may happen only in response to a major known attack or fresh intel. Daylight's own MDR guidance is blunt about it: "Do not assume 'MDR' includes ongoing proactive hunting unless the contract states it clearly."

Known threats belong to detection and alerting; hunting exists to find what detection missed. MITRE's TTP-based hunting model organizes hunting around hypothesis creation, investigation via tools and techniques, uncovering new patterns and TTPs, and enriching analytics.

Any MDR contract claiming hunting is worth probing on four dimensions. Frequency establishes whether hunts run continuously or fire only when an alert triggers them. Methodology separates a formal hypothesis-driven process from reactive investigation, and hunter expertise decides how far either one goes, since experienced hunters with incident response and detection engineering backgrounds produce different work than junior staff running canned searches. The fourth dimension is use of threat intelligence, meaning whether hunts are mapped to ATT&CK and current TTPs.

‍

Quality varies in both packaging models. Some MDR-embedded hunting is genuine, continuous, and intelligence-led, while some standalone offerings are templated query packs sold at a premium. The contract terms and the evidence a provider can produce decide which version you are buying.

How to Evaluate a Threat Hunting Provider

A real threat hunting provider proves methodology, telemetry access, seniority, detection handoff, and domain coverage before the contract is signed, and that is the order to test them in. Each area below ends with the question that forces a provider off the marketing page.

1. Hypothesis-Driven Methodology Beats Templated Sweeps

The SANS 2019 survey found only 35% of respondents included hypothesis-driven hunting in their definition of threat hunting at all. Compare provider methodology against published standards such as TaHiTI from the Dutch Payments Association and MITRE's ATT&CK threat hunting modules, which walk through developing hypotheses, determining data requirements, mitigating collection gaps, implementing analytics, and running investigations. Ask the provider to walk through the last three hunt hypotheses they generated for a client in your sector: where each came from, such as threat intel or ATT&CK gap analysis, and the data they queried to test it.

2. Telemetry Access and Data Economics

Hunt quality is capped by data before it is capped by skill. Provider telemetry discussions should cover endpoint, network, logs, cloud, and identity sources, since a gap in any one of them narrows what a hunt can see. Effective hunting also depends on how much telemetry is retained and whether cost controls force teams to filter the very logs hunters need. Ask whether the provider's data layer is volume-priced, which sources are excluded or sampled, and specifically whether identity provider logs (Entra ID, Okta) and cloud control plane logs (CloudTrail, GCP Audit Logs) are ingested in full or filtered.

3. Hunter Seniority and Assignment

Provider evaluation should test human expertise alongside automation claims. Hunting still depends on expert judgment, detection-engineering experience, and sector knowledge, and it tends to be less forgiving of low-expertise staffing models than triage is. Hypothesis formation draws on accumulated knowledge of how attackers escalate privileges in a given stack and which toolsets specific threat groups favor. Consistency matters as much as seniority, because the same hypothesis can be explored differently, executed incompletely, or abandoned early depending on who picks it up and how much time they have. Ask for the career backgrounds of the hunters assigned to your account, the hunter-to-client ratio, and whether senior hunters run hunts or primarily review junior output.

4. The Hunt-to-Detection Feedback Loop

Hunting contracts often underspecify the hunt-to-detection feedback loop. A session abstract from SANS's Spring 2026 detection and response track states the systemic version plainly: "Insights on alert triage and threat hunts rarely translate into new detections." It adds that telemetry gaps steadily erode coverage that already exists. Make the loop a contractual requirement. Ask the provider to show the last five detection rules that originated from a hunt, and what percentage of completed hunts produce a new or updated detection.

5. Cloud and Identity as First-Class Hunting Domains

Hunting programs are weakest in cloud environments. SANS 2025 respondents named cloud infrastructure the hardest environment to hunt in (39%). For cloud environments, require hunts that can start from unusual identity, API, or control plane activity. Ask the provider to describe a recent hunt that started from identity telemetry, Entra ID sign-in logs or Okta session data.

Expect few providers to answer all five with specifics, and treat one that answers none of them as selling the label rather than a mature program.

Decision Criteria: Managed, In-House, or Hybrid

The buy-versus-build question has real movement behind it: SANS 2025 found organizations fully outsourcing hunting dropped to 30% from 37%, organizations managing hunting internally rose to 58% from 45%, and 61% still cite skilled staffing shortages as their primary barrier. Teams are pulling hunting closer while remaining unable to staff it. Your situation decides whether managed, in-house, or hybrid hunting fits.

• If your security team has no dedicated hunting headcount and no 24/7 coverage, then buy managed hunting. The staffing shortage is the binding constraint for most organizations, and a hunt program that runs only when someone has spare hours is a hunt program that does not run.
• If you operate a mature SOC with an established detection engineering function, then build in-house or run a hybrid, because institutional knowledge from hunting compounds over time and outsourcing it entirely creates a knowledge-retention risk. The UK Government guide recommends starting with a dedicated threat hunting lead before anything else.
• If you already pay for MDR and the contract is silent on hunting, then assume reactive-only and probe the four dimensions above before paying for an add-on tier. Some incumbents deliver genuine hunting, so the add-on may be worth buying once you know what the base contract already covers.
• If your environment is majority cloud and SaaS, then make identity-telemetry-first hunting a hard requirement and disqualify providers whose hunting remains endpoint-anchored. Ask specifically about the provider's cloud incident response track record.
• If your SIEM pricing is volume-based and you are filtering identity or control plane logs to control cost, then fix the data economics before buying any hunting service, because providers are constrained by telemetry you did not retain.

A hybrid split is also workable: the provider can handle hunting while the in-house team owns investigation and response, which preserves internal knowledge without staffing a full hunt team.

Agentic Execution Moves the Bottleneck to Hypothesis Quality

Hunt execution economics are changing faster than the evaluation criteria. A CSO Online analysis argues that threat hunting is becoming more accessible as analysts spend more time improving systems and less time repeating investigative tasks. That is a practitioner's assessment rather than measured data, so it deserves scrutiny, but the direction is becoming clearer. As execution consumes less of the calendar, the constraint shifts from "do we have hunter time to run this hunt" to "do we have a hypothesis worth testing."

That shift increases the value of senior human judgment. Robert M. Lee and David Bianco made the point in their 2016 SANS paper on hunt hypotheses: hunters should lean heavily on automation, but "the process itself cannot be fully automated," and formulating the hypothesis is the human's key contribution.

SecurityWeek's 2026 threat hunting outlook gathers the same view from practitioners. Ulster University's Kevin Curran expects agentic AI to take on more reconnaissance, enrichment, and even hypothesis suggestion, while human oversight stays critical for context, legal decisions, and complex reasoning. Intel 471's Ashley Jess places humans at hypothesis-driven investigation, adversary emulation, and the reading of ambiguous behavior. The services that win this shift put experts on hypotheses and on the telemetry, organizational, and historic context those hypotheses depend on, and agents on execution.

For buyers, scaled execution changes the provider test. It now has to verify both schedule capacity and the ability to turn expert hypotheses into repeatable, auditable investigations without reducing hunting to generic query packs. Methodology, customer-specific telemetry and context, and the hunt-to-detection loop matter more under that model, not less.

How Daylight Runs Threat Hunting

That division of labor is what the MASS category describes. Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. Threat Hunting is one of three services running on that architecture, alongside MDR and the Agentic Security Data Lake. In hunting, the requirement is that expert-defined hypotheses and customer-specific context drive auditable agentic execution as one system.

Daylight's Threat Hunting service is a separate engagement, not a tier inside an MDR contract. Some tools sold for hunting assist a hunter instead of running the hunt end to end. Daylight built its service for the second job.

In hypothesis-based hunts, a Daylight security expert with over 10 years in incident response, threat hunting, or detection engineering defines the hypothesis and selects the analyses that test it from a maintained catalog. Analyses run in parallel, not one after another. Each starts from a deterministic query across up to 90 days of telemetry, then runs as an iterative loop, with separate agents narrowing the dataset step by step. Each iteration decides its next move from the data in front of it, not from a fixed query sequence. The loop ends when the activity is either fully explained or left standing as a lead for full investigation. A central orchestration layer records the queries, decisions, and outputs of every iteration and enforces execution bounds. That is the Glass Box approach applied to hunting: the customer can replay or adjust a hunt instead of taking it on trust.

IOC-based hunts work differently, running standardized deterministic searches across endpoint, identity, cloud, and SaaS logs to return a binary answer on a given indicator. Findings feed detection tuning in both cases. Before signing with any provider, including this one, require visibility into hypotheses, telemetry, execution records, and detection handoff.

Frequently Asked Questions About Threat Hunting Services

What Does a Standalone Threat Hunting Engagement Cost?

Published list prices for standalone managed threat hunting campaigns are uncommon. Expect vendor-specific quotes in place of public rate cards. MDR contracts whose higher tiers include hunting are usually priced differently from dedicated, named-hunter or campaign-based engagements, so buyers should ask whether hunting is included, sold as an add-on, or scoped as a separate service.

How Much Retained Telemetry Do Hunters Actually Need?

Ninety days is a common practical ceiling for many hunting workflows, and Daylight's IOC hunts operate on that window. It covers many investigations but not all of them, and SaaS sources are where the assumption usually breaks. Confirm default retention, export behavior, and extra licensing by application, because unexported SaaS telemetry may be gone before a hunt begins.

Do IOC Sweeps Count as Threat Hunting?

IOC sweeps validate known indicators, which belong to detection rather than hunting. They remain operationally useful when a new vulnerability or intel report lands and someone needs a fast answer. A provider whose entire hunting program is sweeps is running detection validation, not full threat hunting.

Can AI Generate Hunt Hypotheses and Queries on Its Own?

Partially, and the failure modes are documented. A December 2025 study of language models generating security queries counted 427 syntax errors from one model configuration across five iterations of KQL generation. Hypothesis surfacing is advancing, but evaluation and validation remain human work.

What Should a Sample Hunt Report Contain?

Request a redacted one before signing. Expect the hypothesis and the queries behind the findings. The UK Government guide adds program metrics: data coverage, hypotheses and hunts per ATT&CK tactic, and the percentage of successful hunts that result in a new detection analytic or rule. Pair the report with the provider's ATT&CK coverage heatmap. A report that reads "no threats found" over a list of checked IOCs is templated work, whatever the service was called on the order form.