What is the primary objective of threat hunting in an enterprise security program?

• A. Proactively searches for unidentified threats, using hypotheses and analytics to uncover hidden adversaries.
• B. Reviews past incidents and closes tickets after containment.
• C. Only alerts on known malware signatures.
• D. Focuses on updating firewall rules after containment.

Answer: (C)

Threat hunting aims to actively uncover threats that haven’t been detected yet by relying on hypotheses about attacker behavior and using analytics to test those ideas across the environment. The goal is to find hidden adversaries and enable earlier intervention, rather than waiting for alerts from known signatures or reacting only after an incident has occurred. This proactive approach dives into data from endpoints, networks, and cloud sources to spot anomalous patterns, unusual user activity, or subtle tactics that conventional detectors might miss.

Relying solely on known malware signatures is limited to what we’ve already seen; it won’t catch novel techniques or living-off-the-land methods that don’t trigger signature-based alerts. Focusing on updating firewall rules after containment or reviewing past incidents and closing tickets describe post-incident or defensive-tuning activities, not the proactive discovery of threats before they cause damage.