In one paragraph
The autonomy ladder has five rungs, from Level 0 manual hunting to Level 4 autonomous hunting with human-approved actions. The quickest way to tell which rung a system sits on is to watch a week of use and note who started each hunt and where each one stopped. This lesson describes what you would see at each rung.
Guide updated September 2026 · Autonomous Threat Hunting editors
3 min read
The ladder is this guide's own editorial model, set out in full on the autonomy levels page. It is not an industry standard. Here is how each rung shows up in the record of an ordinary week.
Level 0: manual hunting
Every query in the week was written by an analyst. The tools stored and searched data and suggested nothing. If the analysts stop, the hunting stops.
Level 1: assisted hunting
The tool suggested hypotheses, translated a query into a second query language or mapped a finding to ATT&CK. An analyst still ran each hunt and read each result. The record shows suggestions accepted or ignored, and every hunt has a person's name on it.
Level 2: directed autonomous hunts
Each hunt began with a person typing a hypothesis. The system then planned the queries, ran them across sources and returned findings with its working. Count the hunts: there are as many as people asked for, and no more.
Level 3: continuous hunting, human review
Hunts appear in the record that nobody requested, usually tied to a new advisory or feed item. People review what surfaced and approve any new detection. Watch how many findings reach a person each day and how long each one takes to review, because that review time is the real cost of this rung.
Level 4: autonomous, human-approved actions
As Level 3, plus staged actions, such as a session revoke or a host isolation, waiting in a queue. None of them ran until someone approved it. Check who approved each one, and what happened to the requests nobody answered.
Reading the week
A system can sit on different rungs for different tasks: continuous for intelligence-led hunts, directed for everything else. Record the rung per task, not per product. A higher rung is not better for every team. It moves work from running hunts to reviewing them, and that review time has to exist. The vendor directory shows where each vendor's own public material places it.
Try it on your own week
You can run this exercise on a trial or on the tools you already use. It takes one person about an afternoon to set up and a week to collect.
- Export the list of hunts run in one week, with who or what started each one.
- Mark each hunt with the stage where it stopped: finding handed to a person, detection proposed, detection deployed, or action staged.
- Count the hunts nobody requested. If there are none, the system is working at Level 2 or below for that task, whatever its product page says.
- Note every point where a person approved something, and how long the approval waited.
The result is a rung per task, taken from the record rather than a slide. Compare it with where the vendor's own material places it in the directory, and bring any gap to the next vendor call.