Compromise hunting is the practice of searching systems for evidence that an attacker already established a foothold. Instead of waiting for a visible alert, defenders inspect logs, files, processes, accounts, and network activity for subtle signs of intrusion such as web shells, unusual scheduled tasks, suspicious authentication events, or unexpected changes to application code.
It matters because many exploits, including remotely exploitable flaws in web applications, may be used quietly before anyone notices. In a commerce platform, compromise hunting helps determine whether a patch is enough or whether the environment has already been altered. Typical hunts focus on recent file modifications, outbound connections from web servers, new admin users, and abnormal request patterns. Used well, it turns a suspected breach into a concrete investigation and helps stop persistence, lateral movement, and further data theft.