Threat Hunting
Find what's hiding before it finds you
Most breaches aren't discovered through alerts, they're found weeks or months later during routine checks, insurance renewals, or by chance. Lykos Defence helps you uncover silent compromises and latent attacker activity before it turns into a headline.
Our threat hunting and compromise assessment services combine forensic depth with practical detection. Whether you suspect unusual behaviour, need post-breach validation, or want a clean bill of health before an audit or insurance renewal, we help you know where you stand and what to do next.
What you can expect
Compromise Assessment
A structured, evidence-led review of your environment to identify signs of past or ongoing compromise. We analyse logs, endpoint telemetry, network data and authentication trails to detect attacker behaviours, not just alerts.
Threat Hunting
Targeted, hypothesis-driven investigations led by experienced forensic analysts. We focus on adversary tactics and techniques mapped to MITRE ATT&CK, using both endpoint and network indicators to find subtle persistence, lateral movement, or data exfiltration attempts.
Real-World Intelligence
We apply the same methods used in active investigations, informed by current attacker behaviours seen across the globe.
Practical Outcomes
No endless reports. You get verified evidence, clear risk insights, and prioritised remediation steps your team can act on immediately.
Readiness doesn't start after a breach
Our compromise assessments are the bridge between detection and prevention. They're the fastest way to validate your environment and strengthen your readiness posture before it's tested under pressure.
Frequently Asked Questions
A penetration test simulates an attacker to test your defences. A threat hunt looks for evidence that an attacker may already be inside. It’s forensic in nature; focused on detection, validation, and assurance rather than exploitation.
No. While telemetry helps, our approach is designed for organisations of any maturity. We work with what you have — logs, EDR, backups, or network captures — and can recommend improvements based on what we find.
Most small-to-mid-sized environments can be assessed within one to two weeks, depending on the number of endpoints, data availability, and scope. We provide a clear timeline before work begins.
We’ll immediately escalate our findings and, with your approval, move into containment and forensic investigation. Our goal is to help you respond swiftly and preserve evidence properly for legal, regulatory, and insurance purposes.
We recommend at least annually or after major infrastructure changes, mergers, or suspected incidents. Many clients include semi-annual or quarterly hunts as part of their readiness retainer.
Pricing depends on many factors like the number of systems involved, data volume, and complexity, so it's challenging to provide an accurate estimate without a call to adequately scope your needs.
As a general guide, pricing for small-to-medium engagements, may start from AUD$20,000–$30,000.