I had a slightly embarrassing moment a while back when a partner asked me to explain the difference between threat hunting and threat detection, and I realized halfway through my answer that I was describing the same thing twice. In my defense, so is half the market. Almost every managed security service now says it includes threat hunting, and from what I’ve seen across the channel, MSPs are understandably confused about what they are buying.

So I want to do two things in this piece. First, pin down what real threat hunting looks like operationally, so you have something to measure providers against. Second, walk through the main types of managed security service, ranked by how much genuine hunting they tend to include. To give you a bit of context: enhanced.io is a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT, so you’ll see where we sit, and I’ve tried to keep the rest of the list useful whichever way you go.

What real threat hunting looks like

The simplest way I’ve found to explain it is this. Detection waits for the alarm to go off. Hunting walks round the building assuming somebody already got in, and checks the places the alarm doesn’t cover.

In practice, that means hunting is hypothesis-driven rather than alert-driven. A hunter starts with an idea of how an attacker might behave in a particular environment, say, a compromised account logging in from somewhere new and then quietly moving between servers, and goes looking for evidence of it in the telemetry, whether or not anything has fired. The output is either a confirmed finding that becomes an incident, or confidence that the hypothesis didn’t play out, which is useful in its own right.

Two things decide whether that’s possible: what the hunters are able to see, and whether there’s a person doing the looking. If the only data available is endpoint telemetry, every hunt is limited to the endpoint. If no human is involved, it isn’t hunting at all, it’s automated detection with a new name. Our guide to building a threat detection program covers where hunting fits alongside detection rules, if you want to go deeper.

Managed security services, ranked by how much threat hunting they include

Here’s how the main service types compare. It’s a generalization, and individual providers vary, so treat it as a starting point for your questions rather than a verdict.

1. Multi-surface SOCaaS with analyst-led investigation

This is the benchmark. Hunters see telemetry from every surface, endpoint, network, cloud, identity and IoT/OT, correlated in one place, with analysts investigating around the clock. Because the data is joined up, a hunt is able to follow an attacker from a login to a server to the network traffic between internal systems, which is where a lot of the interesting activity hides.

This is the model enhanced.io is built on. The platform correlates detection across all five surfaces and runs automated hunting across that data, SOC analysts investigate what it surfaces, and your named Fractional Security Director turns the findings into prioritized actions for your team. You’ll find more on how that works in our threat detection and response guide.

2. MDR with a dedicated hunting tier

Many MDR services offer hunting as a premium tier. Analysts run hunts on a schedule, often against known attacker techniques. It’s genuine hunting, but it is usually limited to the telemetry the MDR service ingests, which in a lot of cases means the endpoint and whatever the EDR tool sees.

3. Endpoint-only MDR

Here, analysts respond to alerts from the EDR tool and sometimes investigate around them. Some providers describe that investigation as hunting. It’s useful work, but it only covers devices that run an agent, so the firewall, the cloud tenant, the identity provider and anything without an agent are outside its view. That’s why we say your MDR is often only showing you part of the picture.

4. Co-managed SIEM

A SIEM holds a lot of data, sometimes from every surface, so in theory it supports excellent hunting. In practice, with a co-managed SIEM the hunting is usually down to whoever writes the queries, and that is often your own team. If you have experienced hunters on staff, it works. If you don’t, the data sits there unhunted. Mark has written about why Open XDR suits MSPs better than legacy SIEM if you want the technical side.

5. Managed antivirus or EDR monitoring

This is alert response, and that’s fine for what it is. It is the foundation most MSPs already have, but it doesn’t include hunting, and it’s worth being clear with clients about that.

Does XDR actually catch threats that traditional tools miss?

This question comes up a lot, and the honest answer is that it depends on what you mean by XDR. The value isn’t a new type of detection, it’s correlation. A single unusual login is easy to dismiss. So is a single odd connection between two servers. When the same account produces both within an hour, that’s worth a look, and only a platform that sees identity and network data together is going to spot the pattern.

What tends to happen with separate tools is that each one sees its own piece and none of them sees enough to raise the alarm. That’s the gap correlation closes, and it’s the same reason hunting across joined-up data finds things that hunting in one tool won’t. If you want an example of how that plays out, our post on lateral movement in hybrid cloud environments walks through one.

Why IoT and OT change the threat hunting question

If your clients include manufacturers, building operators or anyone with a plant floor, the hunting question gets sharper. IoT and OT devices generally don’t run endpoint agents, so endpoint-based hunting simply doesn’t see them. The only way to hunt there is through network-level visibility, watching how those devices talk and spotting when that changes.

When you’re evaluating providers for those clients, ask specifically whether hunting covers devices without agents, and how. Our OT security use case gives a bit more context on what that coverage involves.

The questions to ask any provider about threat hunting

1. Where do your hunting hypotheses come from: threat intelligence, attacker techniques, or the alerts you already have?

2. Which telemetry do your hunters see for each of my clients: endpoint only, or network, cloud, identity and IoT/OT as well?

3. Who does the hunting, how often, and is it done for every client or only on a premium tier?

4. What do I receive when a hunt finds nothing, and what do I receive when it finds something?

5. Who acts on a finding, and how quickly does it reach my team?

I know that was a lot, so let me bring it back to the one thing I’d want you to remember. When a provider says it includes threat hunting, the two questions that matter are what the hunters are able to see and whether a person is looking. Get clear answers to those, and the rest of the comparison falls into place.

Key takeaways

• Real threat hunting is hypothesis-driven: it assumes an attacker might already be inside and goes looking, without waiting for an alert.

• How much hunting a service delivers depends on the telemetry hunters see and whether a person does the looking.

• Multi-surface SOCaaS with analyst-led investigation delivers the most hunting; managed AV or EDR monitoring delivers none.

• XDR’s advantage is correlation: joining identity, network and endpoint data reveals patterns single tools miss.

• IoT and OT devices don’t run agents, so hunting there needs network-level visibility.

About enhanced.io

enhanced.io is a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT. We work only through MSP partners and never sell direct to end clients. To talk about how enhanced.io fits your stack, book a partnership conversation with Hannah Lloyd.