NEWS
Summaries of public announcements, with links to the original source. Updated monthly.
In one paragraph
This page summarises public announcements from the vendors in this guide's directory and from the MITRE ATT&CK and Sigma projects, newest first. Each summary is written by this site and reads the announcement for what it says about automation and autonomy. Every item links to its original source, and every company is presented the same way.
Guide updated September 2026 · Autonomous Threat Hunting editors
Vega added exposure, privilege and sensitive-data attributes from Wiz to its detection and investigation workflows. The change gives an automated workflow more context about how much a flagged cloud asset matters before a person reviews it.
Source: Vega blog
A Mars Security blog post introduced MARS playbooks, built on the idea that some attacks fail a hypothesis instead of firing an alert. The framing puts a testable hypothesis, not an alert, at the start of an automated hunt.
Source: Mars Security blog
Mars Security announced Real-Time Intel-Based Detection, which turns threat intelligence advisories into ATT&CK-mapped detections and backtests each one against 30 days of the customer's own data before release. The company says the feature is available to all customers at no additional cost.
Source: Security Boulevard
MITRE's updates page dates v19.2 to 6 August 2026. The release adds groups including ShinyHunters and TeamPCP with related supply chain software, and systems that map hunts to ATT&CK automatically now track a reference that changes in smaller steps.
Source: MITRE ATT&CK
Vega released Detection Skills, an open specification built on the Agent Skills format, with a library of more than 50 skills. It packages detection work in a form that agents can load, which makes the agent's instructions something a team can read.
Source: Vega blog
Anvilogic's version 8.0 covers data onboarding, search, detection and investigation, adds Elastic, CrowdStrike LogScale and Dynatrace to federated search, and adds case management. The release reaches the steps before and after a hunt, not only the hunt itself.
Source: Anvilogic
Helix allows Nebulock's agents to query vulnerability management and other security tools on demand, instead of ingesting that data in advance. Part of the agent's work becomes deciding what to look up while a hunt is running.
Source: Nebulock blog
Cotool Router provides fallback across model providers, access to open-weight models and model selection based on evaluations. It addresses a practical dependency of autonomous agents: what happens when the model they rely on is unavailable.
Source: Cotool blog
Anvilogic made Blueprints and Federated Search generally available.
Source: Anvilogic
The SigmaHQ release added 20 new detection rules and updated more than 80 existing ones, including coverage for supply-chain attacks. Open rules in this format are a common input and output for automated detection work.
Source: GitHub SigmaHQ
Artemis added events from the Claude Enterprise Compliance API, normalized to OCSF, alongside the cloud, identity and SaaS data it already correlates. The announcement treats enterprise AI usage as one more source for automated investigation.
Source: Artemis Security blog
ATT&CK v19 divided the Enterprise Defense Evasion tactic into Stealth and Defense Impairment and lists 15 Enterprise tactics and 222 techniques. Hunts and detections mapped to the old tactic need remapping.
Source: MITRE ATT&CK
Artemis came out of stealth with an AI-native protection platform that runs autonomous investigations and holds response actions for human confirmation. The approval step sits between what the agent finds and what it changes.
Source: Artemis Security blog
Nebulock published a post introducing Vespyr, described as an autonomous hunter. Its platform page adds that Vespyr hunts without a directive, a statement about who starts the work.
Source: Nebulock blog