Hypothesis-based threat hunting: the what, why, and how

### Executive summary: This article contrasts proactive (TTP-driven) threat hunting with reactive IOC-centric approaches, arguing that organizations should prioritize structured hunts informed by CTI and IR. It outlines a cycle for generating hunt hypotheses from operational goals and TTPs, clarifies the appropriate roles of IOCs (tool augmentation and reactive sweeps), and calls for systematic methodologies for hunting within MDR and SOC services.