What autonomous threat hunting vendors publish about price, and how to budget without it

By Autonomous Threat Hunting editors · 25 September 2026

• Cost
• Buying

What is published, vendor by vendor?

In alphabetical order, as reviewed in September 2026.

• Anvilogic: no list price or licensing model. It publishes a calculator that estimates data-lake compute and storage costs, and states that the savings shown do not include Anvilogic annual licensing.
• Artemis Security: no pricing on the pages reviewed. It states connectors go live in under an hour and real cases arrive inside 48 hours, which bears on time to value rather than price.
• Cotool: no pricing on the pages reviewed.
• Mars Security: no list price. Its September 2026 announcement states that the new intel-to-detection capability is available to all customers at no additional cost. It is listed on AWS Marketplace.
• Nebulock: no pricing on the pages reviewed. Its hunting and detection engineering frameworks are open source under the MIT license, which is a way to read the method before any commercial conversation.
• Vega: no pricing on the pages reviewed. It offers a sandbox at sandbox.vega.io.

The side-by-side view carries the same facts in its pricing row.

Which costs sit outside the licence?

• Query compute on your data platforms. When a system queries data in place, each query runs on the platform that holds the data and is metered under that platform's terms. Continuous hunting and long backtests read more data than a person hunting by hand.
• Storage for anything ingested. Where a vendor ingests part of your data, as Artemis Security describes for hot-path data, ask where it is stored and whether storage is priced separately.
• Review time. Findings, proposed detections and staged actions all need a person. The review-time calculator turns your measured counts into hours per week.
• Engineering time for promotion and upkeep. Rules promoted from hunts need review, testing and, later, revision or retirement, as the lesson on retiring and revising automated hunts describes.

What drives the licence price?

Because no vendor in the directory publishes it, the only reliable way to learn the price basis is to ask. Common bases in security software include data volume, number of data sources, number of users or endpoints, and platform tiers. Ask which applies, and whether hunting, detection and response are priced together or separately.

What to ask for in writing

• The price basis and what counts toward it, with an example quote for your scope.
• What is included and what costs extra: intelligence feeds, connectors, response features, support levels.
• What happens to the price if you add data sources or increase hunting frequency.
• Any query budget or rate limit the product enforces on your data platforms, and who sets it.
• Exit terms: export of hunts and detections, and deletion of your data.

A budget with four lines

Put the licence quote on the first line. On the second, the data platforms' compute for the trial period, taken from their own usage reports for the system's service identity, scaled to a year. On the third, measured review hours per week multiplied by your internal cost per hour. On the fourth, an estimate of engineering hours for promotion and upkeep. Only the first line comes from the vendor, which is why a trial matters more than a price sheet.

Frequently asked questions

Sources

• Anvilogic, calculator anvilogic.com
• Artemis Security, platform overview artemissecurity.com
• Cotool, home page cotool.ai
• Mars Security launch announcement, Security Boulevard securityboulevard.com
• Nebulock on GitHub github.com
• Vega, connectors and sandbox vega.io