02 / HUNT

Threat Hunting

Hypothesis-driven. Telemetry-agnostic. We find the dwell-time the SIEM missed.

Engage on this 24/7 hotline
Overview

The detections you have were written for the threats you knew about.

Threat hunting is the discipline of looking for adversaries who are already inside but have not yet tripped a rule. We work from intelligence-led hypotheses — specific TTPs, specific actors, specific abuse patterns — across your existing telemetry stack.

Every Versus hunt produces three durable outputs: an explicit verdict on whether the hypothesis was substantiated, a set of new high-fidelity detections delivered in your SIEM and EDR content language, and a hunt playbook your team can run on a quarterly cadence without us.

We hunt in environments others struggle with: identity providers, SaaS estates, OT networks, multi-cloud control planes, and Kubernetes clusters where lateral movement looks like normal traffic.

Fig. 02 · HUNT workflow HYPOTHESIS DETECTION Intel-led TTP EDR Identity Cloud / SaaS Network SIGMA / SIEM CONTENT
Capabilities

How a hunt actually runs

Each engagement is led by senior operators. Scope is shaped to your environment, not pulled from a template.

01

Compromise assessment

Time-boxed assumed-breach hunt across endpoint, identity, network, and cloud telemetry — verdict in two to four weeks.

02

Identity hunting

Token theft, conditional-access bypass, OAuth abuse, and federated-trust abuse hunts in Entra ID, Okta, and AD.

03

Cloud & SaaS hunting

Control-plane abuse, IAM persistence, and exfiltration patterns in AWS, Azure, GCP, M365, and Workspace.

04

OT & ICS hunting

Hunts adapted for operational technology environments where active scanning is unsafe and visibility is partial.

05

Detection engineering

New SIGMA, YARA, and SIEM/SOAR content delivered in your stack’s native language — Sentinel, Splunk, Elastic, Chronicle, CrowdStrike.

06

Purple team validation

Detection content tested against live emulation of the threats it was written for. We don’t ship signatures we haven’t fired.

Engagement flow

How we run it.

A consistent rhythm whether the engagement is a single audit or a multi-quarter program.

PHASE 01

Hypothesize

Intel-led hypotheses tied to threat actors and TTPs relevant to your sector and threat model.

PHASE 02

Collect

Telemetry inventory, gap analysis, and acquisition strategy across endpoint, identity, network, and cloud.

PHASE 03

Hunt

Iterative search across all available telemetry. Suspicious patterns escalated to live forensics if substantiated.

PHASE 04

Harden

New detections, identity tightening, and a quarterly hunt playbook delivered for your blue team to operate.

FAQ

Common questions.

If yours isn’t here, the hotline and engagement intake both reach a senior partner.

How is this different from an MDR alert queue?

MDR is reactive — it processes what fires. Hunting is proactive — it looks for what should be there but is not, or what is there but should not be. They are complementary, not competing.

We don’t have a SIEM. Can you still hunt?

Yes. We hunt against EDR, identity logs, cloud audit trails, and SaaS APIs directly when needed. A central SIEM helps but is not required.

What do we get if you find nothing?

A documented negative result with full hypothesis, scope, and methodology — plus the new detections we built during the hunt. "Clean" is a finding too, and it has a half-life.

How often should we hunt?

Quarterly is the floor for sophisticated environments. Monthly thematic hunts (identity one month, cloud the next) are common for high-target organizations.

Related capabilities

Often paired with.

Hunt engagements frequently sit alongside these capabilities. The same operating doctrine, the same partners.

▲ Engage Versus · Hunt

Ready to scope a hunt engagement?

Most engagements begin with a 30-minute scoping call. We’ll tell you within that call whether we’re the right fit.

+41 79 923 60 07 Open a brief