What is the difference between threat hunting and incident response?

Threat hunting proactively searches for unknown threats within a network, assuming a breach has already occurred, using hypotheses and data analysis to find hidden malicious activity. Incident response, conversely, is a reactive process that begins after a known security incident has been detected, focusing on containing, eradicating, recovering from, and post-analyzing the specific event. For example, a SOC analyst at Wipro might hunt for specific C2 beaconing patterns, while incident response kicks in when a SIEM alert confirms a successful phishing attack. Bangalore hiring note: Many L1 SOC roles at companies like HCL or Movate expect a foundational understanding of both, even if you primarily perform one function.