Autonomous Threat Hunting

Directory · Alphabetical · No scores

Autonomous threat hunting vendors: a directory

What six vendors say about their own products, with sources. Listed A to Z.

In one paragraph

This directory lists six vendors whose public material describes AI-driven threat hunting, detection engineering or the automation around it. Each entry records what the vendor states it automates, where it runs, the human controls it describes and what it does not publish, with links to the pages we read. There are no scores or rankings, and the order is alphabetical.

Guide updated September 2026 · Autonomous Threat Hunting editors

Placements on the autonomy ladder use this guide's own five-level model and record what each vendor describes, not what we tested.

As described by vendor

Figure 1. The autonomy ladder. Levels are this guide's own editorial model. Each vendor is placed on the rung that its own public material describes, as reviewed in September 2026. A placement records what a vendor says, not what we tested, and it is not a ranking: a higher rung is not better for every team.
  1. Level 4, Autonomous, human-approved actions: Artemis Security
  2. Level 3, Continuous hunting, human review: Anvilogic, Cotool, Mars Security, Nebulock
  3. Level 2, Directed autonomous hunts: Vega
  4. Level 1, Assisted hunting: No vendor in this directory describes this level
  5. Level 0, Manual hunting: No vendor in this directory describes this level

Jump to: Anvilogic · Artemis Security · Cotool · Mars Security · Nebulock · Vega

Anvilogic

As described by vendor:L3· Continuous hunting, human review

Describes agents that take threat intel through to deployed detection logic and search across connected data without a per-query request.

AI automation across SOC workloads, with agents for onboarding, search, detection and investigation on top of data you already store.

What it states it automates

  • Agents for four SOC workloads: Onboard, Search, Detect and Investigate, plus Blueprints.
  • Detection: "From threat intel to validated, deployed detection logic on every connected platform."
  • Tuning agents and coverage scoring against MITRE ATT&CK; a library it describes as "thousands of MITRE-mapped detections".
  • Detection-as-code with version control.

Where it runs and what it reads

  • Runs on top of the customer's storage layer; the platform page describes "Augment, Standalone, or Any Combination".
  • Search: "One query across Splunk, Snowflake, Sentinel, S3, and more, without moving the data."
  • Data platforms named: Splunk, Azure Sentinel, CrowdStrike NG-SIEM, Elastic; Snowflake, Databricks, Azure Data Explorer, Azure Log Analytics, Microsoft Fabric, Amazon Security Lake; S3, Azure Blob, GCS.

Human controls it describes

  • Detection-as-code with version control implies reviewable changes; approval steps for hunts are not described on the pages reviewed.
Founded2019
Current release named on siteAnvilogic 8.0 (GA)
Cost toolA calculator estimates data-lake compute and storage; it states that savings do not include Anvilogic annual licensing
Vendor sitehttps://www.anvilogic.com/

What is not published

  • List price or licensing model
  • How hunt results are reviewed or approved by people
  • Query cost controls for federated search

Source: anvilogic.com · Platform · Calculator · Reviewed Sep 2026

Alternatives to Anvilogic · Compare with others

Artemis Security

As described by vendor:L4· Autonomous, human-approved actions

Describes continuous daily hunts plus staged response actions that require human confirmation.

An AI-native protection platform that correlates identity, cloud, endpoint and SaaS data, investigates autonomously and stages response actions for human confirmation.

What it states it automates

  • Autonomous investigation across identity, cloud, endpoint and SaaS signals.
  • Continuous hunts run daily against a growing library and "100+ intelligence feeds"; hunts can be described in natural language.
  • Staged response actions.

Where it runs and what it reads

  • "Hot-path data ingested, high-volume data queried where it lives."
  • Ingested sources named: Splunk, Microsoft Sentinel, Exabeam, LogRhythm, CrowdStrike NG-SIEM.
  • Queried in place: AWS Athena, AWS Security Lake, Google SecOps, BigQuery, Snowflake, Elasticsearch, ClickHouse, Trino.
  • Identity: Entra ID, Okta, Auth0, JumpCloud, PingOne. EDR: CrowdStrike, Defender XDR, SentinelOne, Carbon Black, Cortex XDR. The connectors page states 225+ connectors in 17 categories.

Human controls it describes

  • Response actions are staged and require human confirmation.
Funding stated$70 million in combined seed and Series A funding, with the Series A led by Felicis
Time to value stated"Connectors live in under an hour, real cases inside 48 hours"
ATT&CKStates "comprehensive MITRE coverage from day one"; tactic-level detail not published
Vendor sitehttps://artemissecurity.com/

What is not published

  • Pricing
  • Which data is ingested versus queried for a given deployment beyond the connector lists
  • How detections from hunts are reviewed before going live

Source: artemissecurity.com · Platform overview · Threat hunting · Connectors · Reviewed Sep 2026

Alternatives to Artemis Security · Compare with others

Cotool

As described by vendor:L3· Continuous hunting, human review

Describes agents that gather intel, check relevance to the environment and propose detections without a per-hunt request.

"AI for the blue team": agents for detection, response and threat hunting built across a team's existing security stack.

What it states it automates

  • Hunt: agents crawl the web to produce structured threat intel, check each item for relevance to the customer's environment and propose forward-looking detections.
  • Detect: maps the detection suite across sources onto MITRE ATT&CK to monitor coverage and surface gaps; automatic tuning.
  • Respond, under the stated idea "Investigate once, automate forever".

Where it runs and what it reads

  • Works through integrations; the detect page states 40+ native integrations and compatibility with existing detection-as-code infrastructure.
  • Integrations named include CrowdStrike, Microsoft Defender, SentinelOne, Okta, Code42, Kandji, Splunk, Datadog, Panther, Snowflake, Databricks, incident.io, Jira, Linear, TheHive, Tines, VirusTotal, AbuseIPDB, GreyNoise, urlscan, Socket, Slack and Microsoft Teams; custom MCP.
  • Custom intel sources including STIX/TAXII.

Human controls it describes

  • Agent version control. Approval steps for proposed detections are not described in detail.
LocationSan Francisco
Investors statedAndreessen Horowitz, WndrCo, Y Combinator, Homebrew
Vendor sitehttps://www.cotool.ai/

What is not published

  • Pricing
  • How proposed detections are approved before deployment
  • Query cost controls

Source: cotool.ai · Hunt · Detect · About · Reviewed Sep 2026

Alternatives to Cotool · Compare with others

Mars Security

As described by vendor:L3· Continuous hunting, human review

Describes hunts generated from intelligence and run continuously, with a corroborated shortlist handed to analysts and detections backtested before release.

Converts threat intelligence into behavioral hunts and backtested detections, run against data where it already lives.

What it states it automates

  • "We convert threat intelligence into behavioral hunts, run them continuously against the data where it already lives, and hand analysts a corroborated shortlist rather than a scored queue."
  • Real-Time Intel-Based Detection: writes queries in each source's native query language, produces MITRE ATT&CK-mapped rules with a severity rating, scores indicators against false-positive history and backtests each rule against 30 days of the customer's own data before it goes live.
  • Advisory sources named in its September 2026 announcement: CISA, Mandiant, Unit 42, Microsoft Threat Intelligence.

Where it runs and what it reads

  • Queries data in place: "Hunt across every log source, cloud, and endpoint without moving a byte"; no ingestion pipelines; works across existing tools without replacing them.
  • Sources named: CrowdStrike Falcon, Wiz, Splunk, firewall logs, Linux Sysmon, identity providers, AWS telemetry, Snowflake and Databricks.
  • Site navigation lists Slack and Microsoft Teams apps and a Splunk extension. Available on AWS Marketplace.

Human controls it describes

  • Hands analysts a corroborated shortlist to confirm; rules are backtested before they go live.
  • Response actions are not described on the pages reviewed.
HeadquartersNew York
Compliance statedSOC 2
Deployment stated"Deploys in hours", no data ingestion
Intel-to-detection featureAvailable to all customers at no additional cost, per the announcement
Vendor sitehttps://marssec.ai/

What is not published

  • Pricing
  • Response or remediation actions
  • Per-tactic ATT&CK coverage
  • Query cost controls on customer data platforms

Source: marssec.ai · AI threat hunting guide · Cloud threat hunting guide · Launch announcement, Security Boulevard · Reviewed Sep 2026

Alternatives to Mars Security · Compare with others

Nebulock

As described by vendor:L3· Continuous hunting, human review

Describes hunting without a directive and continuous hunts, with detections gated by a Retrohunt before deployment.

A platform to hunt threats continuously, deploy detections and run investigations, with published open-source hunting frameworks.

What it states it automates

  • "Continuously hunt threats, deploy detections, and run investigations in a single platform" using a swarm of agents across the hunting lifecycle and TRACE Graph memory.
  • "Vespyr hunts without a directive, turning a threat intel report into a deployable detection in minutes."
  • LOCK framework: Learn (start with a hypothesis, map to MITRE ATT&CK), Observe, Check, Keep. Retrohunts.
  • Docs describe a focus on endpoint and identity threats such as credential theft, privilege escalation and lateral movement; detects human and AI-agent insider threats.

Where it runs and what it reads

  • SaaS. Helix federated search "to get data just-in-time, not just-in-case".
  • Integrations: Okta, Microsoft Entra, Duo, CrowdStrike, Microsoft Defender, SentinelOne, AWS CloudTrail, Microsoft Event Hub, Microsoft Sentinel, vulnerability tools (beta), Jamf, Slack, Microsoft Teams, Tines, Jira, GitHub.
  • Intel from CrowdStrike, Mandiant, MISP and community feeds.

Human controls it describes

  • "Every detection rule must pass a Retrohunt before deployment."
  • Rules edited via chat or direct SQL, exported to GitHub, with immutable version history, compare and revert.
Open sourceAgentic Threat Hunting Framework and Agentic Detection Engineering Framework on GitHub, MIT license
Vendor sitehttps://nebulock.io/

What is not published

  • Pricing
  • Response actions
  • Query cost controls

Source: nebulock.io · Platform · Docs · Detection engineering docs · GitHub · Reviewed Sep 2026

Alternatives to Nebulock · Compare with others

Vega

As described by vendor:L2· Directed autonomous hunts

Its threat hunting page describes a user supplying the hypothesis and the system running the whole hunt autonomously.

An AI-native SecOps platform with agentic search and detection and federated analytics that queries each source in place.

What it states it automates

  • "Give Vega a hypothesis and it runs the whole hunt autonomously across your sources."
  • "When a hunt finds something, promote it to a MITRE-mapped detection on the spot."
  • Agentic detection and agentic search; cross-platform detection-as-code; a security assessment to "See your real MITRE ATT&CK coverage and close the gaps".

Where it runs and what it reads

  • Federated analytics that queries every source in place: "No migration, ingestion, or egress."
  • MCP support. The connectors page does not name individual connectors. A sandbox is offered at sandbox.vega.io.

Human controls it describes

  • "Every step of the hunt shows its work."
  • "Detections live in source control, reviewed like any other code change"; "Every change has a diff, an author, and an approver."
Offices statedTel Aviv and New York
Vendor sitehttps://www.vega.io/

What is not published

  • Pricing
  • Named connectors
  • Whether hunts start without a user-supplied hypothesis

Source: vega.io · Platform · Threat hunting · Detection-as-code · Connectors · Reviewed Sep 2026

Alternatives to Vega · Compare with others

Frequently asked questions

How many vendors does the directory list?
Six, in alphabetical order: Anvilogic, Artemis Security, Cotool, Mars Security, Nebulock and Vega.
Can I compare two vendors directly?
Yes. Every pair has a head-to-head page, and the side-by-side view takes up to six at once. Neither picks a winner.
Why is a vendor I know missing?
The directory covers vendors whose public material describes AI-driven threat hunting or the automation around it, and whose claims we could check from a working public website. It is not exhaustive.

Spotted an error or a change? Write to editors@autonmusthreathunting.com. We correct factual errors within ten days.

Read the method behind this directory