Autonomous Threat Hunting

CHECKLIST · 25 QUESTIONS

Autonomous threat hunting evaluation checklist

Twenty-five questions to put to any vendor, grouped by stage.

In one paragraph

Use these 25 questions in vendor calls and trials. They follow the stages of an autonomous hunt, from data access to detection promotion, and end with commercial terms. Each question has a note on what a useful answer contains. Where you can, ask the vendor to show the answer in a trial on your own data rather than describe it.

Guide updated September 2026 · Autonomous Threat Hunting editors

25 questions in 6 groups

Data access and scope

  1. 01

    Which of our data sources can it query in place, and which does it ingest?

    A useful answer: A list per source, naming the platform and whether data is copied, cached or queried live.

  2. 02

    What permissions does it need on each source?

    A useful answer: Named roles or scopes, read-only where possible, and a statement of any write access.

  3. 03

    Where are query results processed and stored, and for how long?

    A useful answer: Region, retention period and who at the vendor can access them.

  4. 04

    Which query languages does it write natively?

    A useful answer: The languages for each of your platforms, with a sample query you can read.

  5. 05

    How are query volume and compute cost limited on our platforms?

    A useful answer: Budgets, rate limits or schedules you control, and a report of queries run.

Intelligence intake

  1. 06

    Which intelligence sources are included?

    A useful answer: Named feeds and advisories, and whether any cost extra.

  2. 07

    Can we add our own intelligence and incident notes?

    A useful answer: Supported formats, for example STIX/TAXII, and how private input is kept private.

  3. 08

    How does it decide an item is relevant to our environment?

    A useful answer: The signals it uses, such as our technologies and exposed services, and a way to override.

  4. 09

    How quickly does new intelligence become a hunt?

    A useful answer: A measured time in a trial, not a marketing figure.

Hunting and corroboration

  1. 10

    Can we read and edit each hypothesis before it runs?

    A useful answer: Yes, with the hypothesis in plain language and mapped to an ATT&CK technique.

  2. 11

    Does it run hunts without a request, and can we control when?

    A useful answer: Its autonomy level in the terms of this guide, and the schedule controls.

  3. 12

    How does it corroborate a hit across sources?

    A useful answer: A real finding showing every source that supported or contradicted it.

  4. 13

    What does an empty result tell us?

    A useful answer: The sources, fields and time range covered, so a clean result is not read as proof.

  5. 14

    Can it find a known past incident we plant as a test?

    A useful answer: A trial result on your own data.

Human control

  1. 15

    What does a reviewer see for each finding?

    A useful answer: Hypothesis, queries as run, matching rows, corroboration, mapping and stated confidence in one view.

  2. 16

    Which actions can it take without approval?

    A useful answer: A complete list, ideally none that change systems.

  3. 17

    Where is the approval setting, and who can change it?

    A useful answer: A named role, with changes logged.

  4. 18

    Is every decision logged with who made it?

    A useful answer: An exportable audit trail.

Detection promotion

  1. 19

    How is hunt logic turned into a detection?

    A useful answer: The steps, the format produced and where it is deployed.

  2. 20

    Is each rule backtested before release, and over what period?

    A useful answer: A stated window and a report of how often the rule would have fired.

  3. 21

    Do rules go through version control with review and rollback?

    A useful answer: A diff, an author, an approver and a way to revert.

  4. 22

    Can we export hunts and detections in a portable format?

    A useful answer: Export to our repository, and support for formats such as Sigma where relevant.

Commercial and support

  1. 23

    How is it priced, and what drives the price?

    A useful answer: A written price basis. Most vendors in this guide's directory do not publish pricing.

  2. 24

    What security attestations does the vendor hold?

    A useful answer: Current reports you can read under NDA, not only a logo.

  3. 25

    What happens to our data and detections if we leave?

    A useful answer: Export and deletion terms in the contract.

Pair this checklist with the vendor directory, which records what each vendor already publishes, including what it does not.