How to Implement a Risk-Based Strategy for "Killer" Threat Hunting Programs