Phishing has been and continues to be one of the most common methods (TTPs) cyber attackers use because it is so effective. Phishing is a simple attack vector that enables cyber attackers to easily scale their attacks, customize for their intended targets, and bypass many security controls. Reports like the Verizon DBIR or the Microsoft Digital Defense continue to identify phishing as a top risk. While technologies like email filtering (example Proofpoint) and EDR (example Crowdstrike) make it much more difficult to succeed, cyber attackers have continued to adapt.

Threat hunting is proactively identifying and thwarting unusual network activity that could indicate an attempted security breach. It’s a historically manual activity, making it time-intensive and arduous. It’s no wonder, then, why most organizations don’t have the time, budget, or resources to undertake it effectively…if at all. That’s why many organizations rely on “reactive” threat response solutions, including firewalls, intrusion detection, and SIEM to alert analysts to an event after it occurs. Without the resources to commit to proactive threat hunting, reactive solutions are the next best option.