Active threat hunting is the best protection against supply chain attacks like MOVEit and 3CX, experts say.