In one paragraph
This calculator does two jobs. Part 1 lets you mark each of twelve capabilities as a must-have, a nice-to-have or not relevant, then shows which of the six vendors in the directory state each one on their public pages. Part 2 estimates the hours of human review an autonomous hunting system would need each week from the numbers you enter. It does not score or rank vendors, and it cannot price them, because none of the six publishes a list price.
Guide updated September 2026 · Autonomous Threat Hunting editors
Which vendors state your must-haves?
Set each row to Must have, Nice to have or Not relevant. Results update as you change them. Vendors stay in alphabetical order whatever you select; this is a filter, not a ranking.
- Anvilogic: no must-haves selected · rung L3 as described by vendor
- Artemis Security: no must-haves selected · rung L4 as described by vendor
- Cotool: no must-haves selected · rung L3 as described by vendor
- Mars Security: no must-haves selected · rung L3 as described by vendor
- Nebulock: no must-haves selected · rung L3 as described by vendor
- Vega: no must-haves selected · rung L2 as described by vendor
| Capability | Anvilogic | Artemis Security | Cotool | Mars Security | Nebulock | Vega |
|---|---|---|---|---|---|---|
| Hunts start without a per-hunt request | StatedDescribes agents that take threat intel through to deployed detection logic. | StatedContinuous hunts run daily against a growing library and "100+ intelligence feeds". | StatedAgents gather intel from the web, check relevance to the environment and propose detections. | StatedHunts generated from threat intelligence "run them continuously against the data where it already lives". | Stated"Vespyr hunts without a directive." | Not publishedThe hunting page describes a user supplying the hypothesis; whether hunts start without one is not published. |
| Queries data where it already lives | Stated"One query across Splunk, Snowflake, Sentinel, S3, and more, without moving the data." | Partly stated"Hot-path data ingested, high-volume data queried where it lives." | Not publishedWorks through 40+ native integrations; whether data is queried in place or copied is not stated on the pages reviewed. | Stated"Hunt across every log source, cloud, and endpoint without moving a byte." | StatedHelix federated search "to get data just-in-time, not just-in-case". | StatedFederated analytics: "No migration, ingestion, or egress." |
| New rules tested on historical data before release | Partly statedDescribes "validated, deployed detection logic"; what validation consists of is not published. | Not publishedHow detections from hunts are reviewed before going live is not published. | Not publishedHow proposed detections are approved before deployment is not published. | StatedEach rule is backtested against 30 days of the customer's own data before it goes live. | Stated"Every detection rule must pass a Retrohunt before deployment." | Not publishedPromotion of a hunt to a detection is described; a backtest step is not published. |
| Detection changes kept in version control | StatedDetection-as-code with version control. | Not publishedNot described on the pages reviewed. | StatedCompatible with existing detection-as-code infrastructure; agent version control. | Not publishedNot described on the pages reviewed. | StatedRules exported to GitHub, with immutable version history, compare and revert. | Stated"Every change has a diff, an author, and an approver." |
| Findings arrive with corroboration or shown working | Not publishedHow hunt results are presented for review is not published. | StatedCorrelates identity, cloud, endpoint and SaaS signals during autonomous investigation. | Not publishedNot described on the pages reviewed. | StatedHands analysts "a corroborated shortlist rather than a scored queue". | Partly statedThe LOCK framework includes a Check step; how findings are presented is not detailed. | Stated"Every step of the hunt shows its work." |
| Response actions staged for human approval | Not publishedResponse actions are not described on the pages reviewed. | StatedResponse actions are staged and require human confirmation. | Partly statedDescribes Respond automation; approval steps are not described in detail. | Not publishedResponse actions are not described on the pages reviewed. | Not publishedResponse actions are not published. | Not publishedResponse actions are not described on the pages reviewed. |
| Maps hunts or detections to MITRE ATT&CK | StatedTuning agents and coverage scoring against MITRE ATT&CK. | StatedStates "comprehensive MITRE coverage from day one"; tactic-level detail not published. | StatedMaps the detection suite across sources onto MITRE ATT&CK to surface gaps. | StatedProduces MITRE ATT&CK-mapped rules with a severity rating. | StatedThe Learn step starts with a hypothesis mapped to MITRE ATT&CK. | Stated"Promote it to a MITRE-mapped detection on the spot." |
| Names its intelligence sources | Not publishedIntelligence sources are not named on the pages reviewed. | Partly statedStates "100+ intelligence feeds"; individual feeds are not named on the pages reviewed. | StatedAgents crawl the web for intel; custom intel sources including STIX/TAXII. | StatedAdvisories from CISA, Mandiant, Unit 42 and Microsoft Threat Intelligence. | StatedIntel from CrowdStrike, Mandiant, MISP and community feeds. | Not publishedIntelligence sources are not named on the pages reviewed. |
| Publishes an open framework or specification | Not publishedNone found on the pages reviewed. | Not publishedNone found on the pages reviewed. | Not publishedNone found on the pages reviewed. | Not publishedNone found on the pages reviewed. | StatedAgentic Threat Hunting Framework and Agentic Detection Engineering Framework on GitHub, MIT license. | StatedDetection Skills, released 4 August 2026 as an open specification built on the Agent Skills format. |
| States MCP support | Not publishedNot stated on the pages reviewed. | Not publishedNot stated on the pages reviewed. | StatedCustom MCP listed among integrations. | Not publishedNot stated on the pages reviewed. | Not publishedNot stated on the pages reviewed. | StatedMCP support. |
| States a security attestation | Not publishedNot found on the pages reviewed. | Not publishedNot found on the pages reviewed. | Not publishedNot found on the pages reviewed. | StatedSOC 2, per its September 2026 announcement. | Not publishedNot found on the pages reviewed. | Not publishedNot found on the pages reviewed. |
| Publishes a list price | Not publishedNo list price. A calculator estimates data-lake compute and storage and states that savings do not include Anvilogic annual licensing. | Not publishedNo list price on the pages reviewed. | Not publishedNo list price on the pages reviewed. | Not publishedNo list price. Its intel-to-detection feature is available to all customers at no additional cost, per the September 2026 announcement. Listed on AWS Marketplace. | Not publishedNo list price on the pages reviewed. | Not publishedNo list price on the pages reviewed. A sandbox is offered at sandbox.vega.io. |
How this is calculated
Must-haves stated = the number of rows you marked Must have where the vendor's cell reads Stated. Partly stated and Not published both count as not stated, and each is listed so you can ask about it. Nice-to-have rows are shown but not counted. The rung filter compares your choice with the rung each vendor's own material describes on the autonomy ladder. Nothing is weighted or added into a score.
Not published is not the same as not supported. If a must-have reads Not published, put the question to the vendor; the checklist has the wording.
How much review time will autonomous hunting need?
Autonomous hunting moves work from running hunts to reviewing what they surface. Enter your own numbers. The starting values are round numbers chosen only to show the arithmetic; they are not benchmarks, vendor figures or measurements.
- Finding review: 8.3 hours per week
- Detection review: 1.7 hours per week
- Action decisions: 0.0 hours per week
- Total review: 10.0 hours per week
- Your available hours cover 100% of it
The review time you entered covers the work. Check it in a trial by timing real reviews.
Formula
Finding review = findings per day x days per week x minutes per finding / 60. Detection review = detections per week x minutes per detection / 60. Action decisions = staged actions per week x minutes per action / 60. Total = the sum of the three. Coverage = available hours / total hours x 100.
Capability cells are editorial readings of each vendor's public pages, reviewed September 2026. No vendor publishes a list price.