- 🎯 Most MDR vendors advertise threat hunting but mean very different things: alert triage, indicator sweeps, and hypothesis-driven hunting all appear under the same heading on a data sheet.
- 🏆 DeepSeas leads this list because it approaches hunting the way the discipline is supposed to work: starting from what would actually harm a specific organization, with hypotheses informed by its own offensive testing and threat intelligence.
- 🔍 Only hypothesis-driven hunting produces new detection logic as a byproduct: a hunting programme that never changes what the platform detects was not really hunting.
- 📊 Hunting quality tracks environment familiarity more closely than tooling: an analyst who has never seen an environment cannot tell unusual from normal in it.
- ⚠️ The five areas where hunting most consistently finds genuine activity are: identity behavior, living-off-the-land activity, persistence mechanisms, cloud control plane activity, and lateral movement in flat networks.
Almost every managed detection and response provider advertises threat hunting, and almost none of them mean the same thing by it. For one vendor it describes analysts forming a hypothesis about how an adversary might operate inside a specific customer environment and going looking for evidence. For another it describes a scheduled query that runs against stored telemetry and produces nothing most weeks. Both appear on a data sheet under the same heading.
The distinction is worth pressing on, because hunting is the part of MDR that finds what detection missed. Everything else in the service responds to something a rule already flagged. Hunting exists precisely for the activity no rule was written for.
Three Different Activities Sold as Threat Hunting
Before comparing vendors, it helps to separate the three things the term covers, because they produce very different results.
Alert triage, relabeled
What it is: analysts reviewing detections the platform already generated, described as hunting because a human looked at them
What it finds: what the detection rules were already going to surface, investigated more carefully. Useful work, and not hunting
Indicator sweeps and retrospective search
What it is: searching stored telemetry for indicators from new intelligence, then checking whether they appeared historically
What it finds: known threats that arrived before the indicator was published. Genuinely valuable, and limited to adversaries somebody else already documented
Hypothesis-driven hunting
What it is: a hunter proposing how an adversary would plausibly operate in this specific environment, then testing that idea against the data
What it finds: activity nobody had an indicator for, including insider misuse, novel persistence, and living-off-the-land technique that never trips a signature
Only the third produces new detection logic as a byproduct, which is the clearest sign it happened at all. A hunting programme that never changes what the platform detects was not really hunting.
The 8 MDR Vendors
1. DeepSeas
How hunting is delivered: hypothesis-driven hunting inside a CyberFusion SOC, directed by each client’s risk profile
DeepSeas approaches hunting the way the discipline is supposed to work, which is by starting from the question of what would actually harm this organization. Its MDR is risk-driven rather than uniform, so detection and hunting concentrate on the assets, exposures, and adversary behaviors that matter to a specific business instead of applying one generic playbook to every client on the roster.
That focus is what makes hunting productive rather than performative. A hunter who knows which systems carry the organization’s crown jewels, which exposures its own offensive testing surfaced, and which threat actors target its sector has a short list of plausible hypotheses to test. A hunter working from a generic template has an infinite one, and infinite lists produce activity reports rather than findings.
The surrounding capability is what supplies those inputs. DeepSeas operates a CyberFusion security operations center where detection, response, and intelligence work together rather than in separate queues, integrates threat intelligence directly into operations, and runs offensive security that reveals real exposures. When an attack path is demonstrated by the offensive side, defenders know exactly where to hunt for evidence that someone else already walked it. Governance, risk, and compliance advisory keeps the whole programme anchored to business risk instead of technical severity ratings.
What the hunt produces:
- Findings prioritized by impact on the specific business rather than a generic severity scale
- Hunt hypotheses informed by threat intelligence and by exposures its own offensive testing confirmed
- Detection improvements fed back into the CyberFusion SOC after each hunt
- Response that contains exposure rather than reporting it, shortening the attacker’s window
- Results communicated in business risk terms for executives and boards
2. eSentire
How hunting is delivered: a named research unit publishing threat intelligence and building detections
eSentire runs one of the more visible research operations in this market, and its hunting benefits from that. Original research into adversary tradecraft feeds hunts across the customer base, so a technique observed at one organization becomes a hunt hypothesis for the rest, usually within days.
Its response posture is aggressive by design, with isolation actions taken on the customer’s behalf rather than recommended for approval. Organizations that prefer to authorize containment themselves should confirm how that is configured before onboarding.
What the hunt produces:
- Hunts derived from original adversary research across the customer base
- New detection content shipped from research findings
- Rapid containment actions on the customer’s behalf
- Published threat intelligence available outside the service
3. Trustwave
How hunting is delivered: hunting supported by a long-standing research and forensics practice
Trustwave pairs managed detection with a research group whose work spans malware analysis, database security, and incident forensics, which gives hunters an unusually broad technical base to draw hypotheses from.
The forensics heritage shows in how findings are documented, which matters when a hunt result becomes evidence in a regulatory or legal process. As with any large provider, the depth of attention varies by service tier, so confirm what hunting is included at the tier being quoted.
What the hunt produces:
- Hunts informed by malware analysis and forensic research
- Documentation suited to regulatory and legal scrutiny
- Coverage across endpoint, network, database, and email telemetry
- Access to specialist consulting when a hunt escalates
4. ReliaQuest
How hunting is delivered: hunting executed through a platform layered over existing security tooling
ReliaQuest operates through its GreyMatter platform, which sits above the tools an organization already owns and normalizes their telemetry into one place. Hunting runs across that unified view rather than being limited to a single vendor’s sensor.
For enterprises with heterogeneous stacks accumulated over years, that model preserves existing investment while making cross-tool hunting possible. Results depend on the quality and coverage of the underlying tools, since the platform can only hunt across what those sensors record.
What the hunt produces:
- Hunts spanning telemetry from multiple existing security tools
- Detection content deployed back into the customer’s own tooling
- Measurable metrics on detection and response performance
- Automation of repetitive investigation steps
5. Deepwatch
How hunting is delivered: named squads assigned to each customer, hunting with environment familiarity
Deepwatch assigns dedicated teams to customers rather than routing work through a general queue, which addresses one of the practical constraints on hunting: an analyst who has never seen an environment cannot tell unusual from normal in it.
That continuity makes anomaly-based hypotheses far more productive over time. The model depends on team stability, so it is reasonable to ask how staffing continuity is maintained across a multi-year contract.
What the hunt produces:
- Hunts grounded in accumulated familiarity with the environment
- Baselines that distinguish organizational normal from suspicious
- Tuning recommendations that reduce recurring false positives
- Continuity of context across investigations and incidents
6. Critical Start
How hunting is delivered: hunting alongside a zero-trust analytics model that resolves every alert
Critical Start built its service around resolving every alert rather than filtering by confidence score, on the reasoning that a suppressed low-severity alert is exactly where quiet intrusions hide. Hunting operates alongside that discipline.
The approach produces thorough coverage of the alert surface and depends on customer telemetry being complete. Where logging has gaps, no amount of alert discipline compensates, which makes onboarding coverage checks worth attention.
What the hunt produces:
- Investigation of low-severity signals that filtering models discard
- Transparency into how each alert was resolved
- Mobile access to investigation status for security leaders
- Contractual commitments on response timing
7. Huntress
How hunting is delivered: a 24/7 operations center focused on persistence and hands-on-keyboard activity
Huntress concentrates on the things attackers do after initial access, particularly persistence mechanisms and manual attacker activity that automated prevention tends to miss. Its research team publishes findings openly and often.
The service is priced and packaged for smaller organizations and managed service providers, which makes real hunting accessible well below enterprise budgets. Scope is narrower than full-spectrum enterprise MDR, which is the trade-off that makes the pricing possible.
What the hunt produces:
- Detection of persistence mechanisms and manual attacker activity
- Findings written for teams without dedicated security staff
- Public research and community threat sharing
- Coverage accessible to smaller organizations and service providers
8. Kroll
How hunting is delivered: hunting informed by a high volume of incident response casework
Kroll approaches managed detection from an incident response and investigations background, and the case volume is the asset. Hunters draw hypotheses from techniques observed in live breaches across many organizations rather than from published reporting alone.
That frontline exposure keeps hunting current with what attackers are doing this quarter. The firm’s centre of gravity remains investigations and response, so buyers should confirm the scope of proactive hunting included in a managed agreement.
What the hunt produces:
- Hypotheses drawn from active incident response engagements
- Findings documented to an investigative standard
- Direct escalation into full incident response when needed
- Support for litigation, insurance, and regulatory processes
Where Hunts Actually Find Things
Hunting is not evenly productive across telemetry. A few areas account for most genuine findings, and they are consistent enough to check against any provider’s methodology.
- Identity behavior. Valid credentials used at unusual times, from unusual locations, or to reach systems the account has never touched. Nothing here is malware, so nothing signature-based fires.
- Living-off-the-land activity. Administrative tools already present on the system used for attacker purposes. The binary is legitimate and signed, so the hunt has to reason about the pattern of use.
- Persistence mechanisms. Scheduled tasks, services, and startup entries created to survive reboots and remediation. These are quiet, durable, and frequently the only remaining evidence of an intrusion that was partially cleaned up.
- Cloud control plane activity. Permission changes, new access keys, and configuration modifications that look like administration until someone asks who requested them and why.
- Lateral movement in flat networks. Internal traffic between systems with no business reason to communicate, which is particularly revealing in operational technology environments where normal traffic is highly predictable.
Notice what these have in common: none produces a malicious file, and all of them require context about what normal looks like in a specific organization. That is why hunting quality tracks environment familiarity more closely than it tracks tooling.
Frequently Asked Questions
What is proactive threat hunting in MDR?
Proactive threat hunting means analysts actively searching for adversary activity that automated detection did not flag, guided by hypotheses about how an attacker would operate in a specific environment. It is distinct from alert triage, which examines what the platform already detected, and it is the part of MDR designed to catch what rules missed.
How is threat hunting different from detection and response?
Detection and response reacts to signals the platform generated. Hunting starts without a signal, testing an idea about what might be happening and looking for supporting evidence. Both are necessary. Hunting exists specifically for activity that no rule anticipated, including novel technique and insider misuse.
How often should threat hunting run?
Continuously, with hunt cycles driven by new intelligence, changes in the environment, and shifting risk rather than by a calendar. A quarterly scheduled hunt is better than none, and dwell time is measured in days, so a threat that arrives the week after a hunt sits undisturbed until the next one.
Does threat hunting require specific tooling?
It requires telemetry with enough depth and retention to test a hypothesis against history. The platform matters less than the coverage and the analysts. Providers that hunt across whatever tooling a customer already owns can be as effective as those that require their own sensor, provided the underlying data is complete.
Can automation replace human threat hunters?
Automation executes hunts at scale and cannot originate the hypothesis. Deciding that an adversary targeting this sector would probably abuse a particular administrative tool against these specific systems is reasoning about context, which is why hunting quality still tracks analyst expertise and familiarity with the environment.
What should a threat hunting report include?
The hypothesis tested, the data examined, what was found or ruled out, and what changed as a result. Hunts that find nothing are still worth documenting, because they narrow the space of what could be happening. Reports that list only confirmed incidents hide most of the work performed.
For broader context on how AI tools are reshaping enterprise security, threat detection, and managed security services in 2026, see our coverage of how AI is transforming enterprise security and threat response.
