Threat hunting
The proactive security practice of looking for attackers who are already inside but have slipped past the automated alerts — one hypothesis at a time, by hand, through the telemetry.
Ordinary defence is reactive: a tool raises an alert, someone investigates. Threat hunting flips that around and starts from the assumption that the attacker is already in and simply not visible yet. The hunter forms a hypothesis — "if an account were hijacked, we'd expect logins at odd hours" — and digs through logs and EDR data to confirm or dismiss it.
The work leans on rich telemetry from EDR, XDR and SIEM, plus fresh threat intelligence about attacker methods. CrowdStrike and others sell it as a staffed service, since skilled hunters are scarce — and most of what they find is human error rather than a smoking gun.