Why Threat Hunting Should Be Part of Every Security Program

Threat hunting should be part of every mature security program, the article argues, because the more you hunt, the more you learn and the more gaps you fill between what tools detect and what they miss. It emphasises that threat hunting is a mindset rather than a job title, starting from the assumption that something might be wrong and continually asking why until signals make sense.

The piece champions learning by doing, suggesting controlled simulations of attacks—such as credential dumping with a tool like Mimikatz—to understand how malicious activity manifests in your data and what normal logging looks like. It also recommends building a baseline first, examining one log type or data set over time to recognise typical activity and spot deviations.

Finally, it stresses the importance of having the right data—endpoints, network traffic, authentication records, and DNS queries—being collected, enriched, and searchable to enable effective investigation and faster detection, according to Robert Lackey, the author from Cribl, writing on 4 September 2025.