Automated detection finds what it already knows. Hunting starts from how real attackers behave in your sector and searches for traces nothing has alerted on.
Each hunt ends with a short report, any threat found handed to incident response, and new detections added so the same behavior is caught next time.
Why it matters
Hunts built on current attacker techniques
Coverage of endpoints, identity and cloud
Evidence-backed findings
New detections handed to your SOC
Mapped to MITRE ATT&CK
Who delivers each serviceSome managed services are delivered by a vetted delivery partner rather than by CISO Consulting's own team. Each service states who delivers it, and the proposal confirms the delivering party and the contract before you commit. Explore managed security
How the engagement runs
- 1PlanChoose hypotheses from threats facing your sector
- 2HuntSearch logs, endpoints and identity data
- 3ReportFindings, evidence and risk
- 4HardenConvert findings into detections and fixes
What you receive
- Hunt plan and hypotheses
- Findings report with evidence
- New detection rules
- Coverage map against ATT&CK
Packages
| Essential | AdvancedRecommended | Enterprise | |
|---|---|---|---|
| Hunts a year | Two | Four | Twelve |
| Scope | Endpoints | Endpoints and identity | Endpoints, identity and cloud |
| Findings report | Summary | Full report with evidence | Full report with evidence and detections |
| Detection hand-off | Recommendations | Rules written | Rules written and tested |
| Review | Yearly | Quarterly | Monthly |
The exact scope and targets are confirmed in your proposal.
Questions
Do you need our SIEM or EDR?
Hunting uses the data you already collect. Where coverage is thin, the report says so.
How often should we hunt?
Quarterly suits most organizations; regulated and high-risk ones often choose monthly.