Threat hunting is often described as “predicting the future” — analyzing trends, correlations, and behaviors to identify what is coming before it arrives. But how does that actually work in practice, and what separates a good threat researcher from someone just following checklists?
We spoke with Josh Pyorre, a Security Research Engineering Technical Leader at Cisco Talos, on the Scale to Zero podcast. Josh has been in security since 2000, working as a researcher and analyst at organizations including Cisco, NASA, Mandiant, and various nonprofits. He has presented at DEF CON, RSA, and BSides, and hosts the security podcast Fruit Access.
You can read the complete transcript of the episode here >
What is threat hunting and how does it differ from security research?
Threat hunting is the practice of proactively looking for future threats to an organization. Rather than waiting for alerts to fire, threat hunters analyze patterns — phishing email trends, malware correlations, infrastructure relationships — to predict what is coming and produce actionable outputs like IOCs (Indicators of Compromise) that can be blocked or monitored.
Security research is the broader discipline. Josh describes it as exploring hypothetical scenarios and things outside normal boundaries. Threat hunting often fuels security research by surfacing patterns that warrant deeper investigation. The two feed each other: hunting narrows focus, and research expands understanding.
At NASA, for example, Josh analyzed phishing emails across the entire agency to find trends — a form of threat hunting that informed broader defensive strategy.
Why does proactive threat hunting matter more than reactive security?
Most organizations, particularly smaller ones, operate reactively — putting out fires as they appear. The problem with pure reaction is that you are always behind, always stressed, and always surprised.
Proactive threat hunting provides several advantages:
- Narrows focus: Instead of reacting to every new malware variant in the news, you understand which threats actually target your industry and infrastructure.
- Predicts future attacks: By analyzing trends and correlations, you can prepare defenses before an attack materializes.
- Reduces noise: You stop chasing irrelevant threats and concentrate resources where they matter.
Josh compares it to driving: you want to pay attention to what is coming toward you, not just react to cars hitting you from behind.
Why does threat research require creative thinking?
Josh comes from an artistic background — he makes music and approaches problems with a creative mindset. He argues that following checklists alone will never uncover novel or unique attacks. Creativity is what separates effective threat researchers from those who only find what they already expect.
A concrete example is attribution analysis. When examining an attack chain — from phishing email to compromise to lateral movement — researchers look for behavioral patterns, code variable similarities across malware variants, and hosting infrastructure relationships. Connecting these dots to attribute activity to a specific threat actor is fundamentally a creative process of exploration, not a mechanical checklist.
The MITRE ATT&CK framework provides structure for categorizing attack techniques, but the real insight comes from finding relationships and correlations that the framework alone does not surface.
How is GenAI changing the threat landscape?
GenAI is a double-edged sword for security. Josh sees clear benefits for defenders:
- Accelerated research: Tasks that would take six months can be completed in two months by using LLMs to help write complex code.
- Faster learning: Researchers can quickly get up to speed on new technologies and attack vectors.
- Automation of repetitive work: Writing Python scripts, processing data, and handling routine analysis can be offloaded to AI.
But attackers benefit equally:
- Better phishing: Emails are now grammatically perfect regardless of the attacker’s native language. Even experienced security professionals are finding phishing attempts that “almost got them.”
- Guardrail bypasses: While commercial LLMs refuse to write exploits directly, prompt engineering and locally-run models have no such restrictions.
- Deepfakes and impersonation: Voice cloning is already being used in social engineering attacks, with victims hearing what sounds like their family members asking for money.
Josh notes that attackers may actually be more creative than defenders because they are not bound by organizational rules and compliance requirements.
How should organizations approach security with limited budgets?
Josh has worked at nonprofits where the entire IT budget came from donations and the technical director salary was $50,000. Security was simply not on the table as a line item.
He identifies a systemic problem: security vendors consistently raise prices and remove lower-tier offerings to focus on enterprise clients. This leaves small businesses and nonprofits exposed — and those organizations often have access to larger companies through supply chain relationships, making them attractive targets.
His recommendations:
- Vendors should maintain affordable tiers or donation programs for nonprofits and small businesses.
- The industry needs more Cloudflare-like models that provide basic security (firewalls, DDoS protection) at accessible price points.
- Small organizations should at minimum invest in proactive basics — even without a dedicated security team, understanding your threat landscape is better than pure reaction.
The NotPetya attack illustrated this perfectly: a small Ukrainian accounting firm (MeDoc) was compromised, and the Trojanized update cascaded to shut down global shipping, costing billions.
What makes security knowledge accessible to diverse audiences?
Josh’s background in help desk and tech support taught him to explain complex topics without condescension. His approach to conference presentations:
- Start with the problem you are trying to solve, then provide answers in simple terms.
- Show code when necessary but walk through it step by step.
- Balance depth for technical audiences with accessibility for newcomers — neither boring experts nor overwhelming beginners.
- Draw from non-security sources for perspective. Josh recommends reading broadly (economics, history, art) because understanding where society is heading informs where security threats will emerge.
