Vega
Vega brings Wiz cloud risk attributes into agentic detection
Source: Vega blog
In one paragraph
Autonomous threat hunting is software that turns threat intelligence into hunt hypotheses, runs the queries across your existing data, checks its own findings and hands people a short list to confirm. Products differ mainly in how much they do without being asked and in what they are allowed to change. This guide explains the process, gives a five-level model for describing autonomy, and lists what six vendors publish about themselves. It does not rank them.
Guide updated September 2026 · Autonomous Threat Hunting editors
What does this guide cover?
What it is
A definition, and how autonomous hunting differs from alerting and from a hunt run by hand.
How it works
The six stages from intelligence intake to a detection in production.
Autonomy levels
A five-rung model, Level 0 to Level 4, for describing what a system does without being asked.
Human in the loop
The decisions that should stay with people, and how to check that they do.
Risks
False confidence, data access scope and query cost, with mitigations.
Checklist
25 questions to put to any vendor, grouped by stage.
Where do vendors place themselves on the autonomy ladder?
Each vendor below is placed on the rung that its own public material describes. The levels are this guide's editorial model, not an industry standard, and a higher rung is not better for every team. A team that wants every hunt reviewed before anything changes may be well served at Level 2.
As described by vendor
- L4
Autonomous, human-approved actions
- L3
Continuous hunting, human review
- L2
Directed autonomous hunts
- L1
Assisted hunting
- L0
Manual hunting
- Level 4, Autonomous, human-approved actions: Artemis Security
- Level 3, Continuous hunting, human review: Anvilogic, Cotool, Mars Security, Nebulock
- Level 2, Directed autonomous hunts: Vega
- Level 1, Assisted hunting: No vendor in this directory describes this level
- Level 0, Manual hunting: No vendor in this directory describes this level
Or compare vendors side by side, or use the calculator to mark your must-haves.
Latest news
Mars Security
Mars Security frames hunting playbooks around failed hypotheses
Source: Mars Security blog
Mars Security
Mars Security automates the path from advisory to backtested detection
Source: Security Boulevard
What should you ask first?
Where does the data stay?
Ask whether the system queries your data platforms in place or copies data into its own store, and who pays for the queries it runs.
What can it change without asking?
Ask which actions run automatically, which wait for approval, and where that setting lives.
How does it show its work?
Ask to see the exact queries, the evidence and the reasoning behind one finding before trusting a thousand.
Common questions
Is autonomous threat hunting the same as AI threat hunting?
The terms overlap. "AI threat hunting" usually means any hunting assisted by machine learning or language models. "Autonomous" or "agentic" threat hunting usually means the system also plans and runs hunts on its own. The autonomy levels page gives a way to say exactly how much.
Does an autonomous hunting system need its own copy of my logs?
Not always. Several vendors in the directory state that they query data where it already lives, in the SIEM, data lake or cloud store, and some ingest a subset. Ask which applies to each source.
Does this guide recommend a vendor?
No. The directory lists what each vendor publishes, in alphabetical order, with source links and what is not published. The checklist is meant to help you run your own evaluation.
Who writes this guide?
The Autonomous Threat Hunting editors, from public sources. See the method page for sources and limitations.