# Insights for Cyber Threat Hunting

> See how Mercyhurst CIRAT cut OSINT research time in half using Babel Street Insights Investigator to improve speed, security, and analysis.

**Published:** Oct 28, 2026  
**Type:** success-story

---

## What’s at stake

- **1,968**: Average weekly cyber attacks per organization in 2025 [1]
- **$10.5 trillion**: In projected costs from global cybercrime in 2025 [2]
- **38%**: Of ransomware attacks that exploit vulnerabilities or stolen credentials start on exposed applications and systems [3]

It's a near certainty that any given organization will be the target of a cyber attack.

Cyber threat hunters proactively defend against attacks by looking externally through open-source and dark web data, seeking patterns of attack against targeted companies or industries. This advance warning gives organizations time to take meaningful steps to reduce their exposure and vulnerabilities.

Brian Fuller, the Executive Director of the [Center for Intelligence Research, Analysis, and Training (CIRAT) at Mercyhurst University](https://www.mercyhurst.edu/academics/cirat) and Athan Lee, a junior at Mercyhurst and Cyber Threat Hunter within CIRAT, spoke with us about three ways they use [Babel Street Insights](#) for cyber threat hunting.

## Sophisticated tools surface cyber threats in open source and dark web data 

*Understanding the Threat*
## Surface and dark web reveal vulnerabilities

- Organizations may not know what information about their network and software is on the internet, enabling criminal hackers or ransomware groups to target system-specific vulnerabilities.
- Criminal groups continually form and dissolve, and organizations need to know which groups are targeting them or their industry, along with current tactics, techniques, and procedures.
- An organization may experience a data breach of employee or customer data without becoming aware of it until months later, after the PII has been sold or used for unauthorized access to systems or to commit identity theft.

*Resolving Client Challenges*
## Criminal chatter provides advance warning

- [Insights Investigator’s agentic AI](#) accesses vast open source data from the surface and dark web to find an organization’s exposures (leaked credentials, exposed assets) in minutes instead of days — enabling them to proactively harden their defense mechanisms.
- Examining past attacks lets the cyber threat hunter persistently monitor the right keywords, online accounts, and forums to surface criminal chatter about future threats.
- Insights’ persistent monitoring of a company’s domains, emails, and key personnel quickly alerts an organization to data breaches — allowing them to rapidly mitigate damage by enforcing password resets, revoking active sessions, and alerting those affected.

## Proven in the field: Early warning against ransomware

Ransomware actors can lock victims out of their data and threaten to leak or sell it on the dark web, disrupting operations and causing reputational and financial damage.

In one case, thanks to CIRAT’s persistent monitoring in Insights for its airline and airport clients, an analyst noticed a cross-reference with a Chinese ransomware-as-a-service group which was known for attacking insurance companies.

Further investigation showed that the group was moving away from insurance and was going to attack the airline industry.

"We were able to alert our clients in the airline industry that this is how they [criminals] were going to do it,” said Brian Fuller. “The Insights auto-translation and multilingual keyword expansion capabilities in over 200 languages helped us inform clients what they could expect and be ready for it.”

## How will you use Babel Street for cyber threat hunting?

[Contact Us](https://www.babelstreet.com/contact)

---

## Endnotes

1. Check Point Cyber Security Report 2026 [https://www.checkpoint.com/security-report/](https://www.checkpoint.com/security-report/) 

2. Cybersecurity Ventures [https://cybersecurityventures.com/official-cybercrime-report-2025/](https://cybersecurityventures.com/official-cybercrime-report-2025/) 

3. Sophos The State of Ransomware 2026 [https://www.sophos.com/en-us/blog/sophos-state-of-ransomware-2026](https://www.sophos.com/en-us/blog/sophos-state-of-ransomware-2026)