software) and proprietary software (see :category:computer security software companies for a partial list). Cyber threat management Threat management involves a wide variety of threats including physical threats like flood and fire. While ISMS risk assessment process does incorporate threat management for cyber threats such as remote buffer overflows the risk assessment process doesn't include processes such as threat intelligence management or response procedures. Cyber threat management (CTM) is emerging as the best practice for managing cyber threats beyond the basic risk assessment found in ISMS. It enables early identification of threats, data-driven situational awareness, accurate decision-making, and timely threat mitigating actions. CTM includes: Manual and automated intelligence gathering and threat analytics Comprehensive methodology for real-time monitoring including advanced techniques such as behavioural modelling Use of advanced analytics to optimize intelligence, generate security intelligence, and provide Situational Awareness Technology and skilled people leveraging situational awareness to enable rapid decisions and automated or manual actions Threat hunting Cyber threat hunting is "the process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions." This is in contrast to traditional threat management measures, such as firewalls intrusion detection systems, and SIEMs, which typically involve an investigation after there has been a warning of a potential threat, or an incident has occurred. Threat hunting can be a manual process, in which a security analyst sifts through various data information using their knowledge and familiarity with the network to create hypotheses about potential threats. To be even more effective and efficient, however, threat hunting can be partially automated, or machine-assisted, as well. In this case, the analyst utilizes software that harnesses machine learning and user and entity behaviour analytics (UEBA) to inform the analyst of potential risks. The analyst then investigates these potential risks, tracking suspicious behaviour in the network. Thus hunting is an iterative process, meaning that it must be continuously carried out in a loop, beginning with a hypothesis. There are three types of hypotheses: Analytics-driven: "Machine-learning and UEBA, used to develop aggregated risk scores that can also serve as hunting hypotheses" Situational-awareness driven: "Crown Jewel analysis, enterprise risk assessments, company- or employee-level trends" Intelligence-driven: "Threat intelligence reports, threat intelligence feeds, malware analysis, vulnerability scans" The analyst researches their hypothesis by going through vast amounts of data about the network. The results are then stored so that they can be used to improve the automated