In one paragraph
This guide uses five levels to describe how much a hunting system does without being asked: Level 0 manual hunting, Level 1 assisted hunting, Level 2 directed autonomous hunts, Level 3 continuous hunting with human review, and Level 4 autonomous hunting with human-approved actions. The model is our own editorial framework, not an industry standard. Higher is not automatically better; the right level depends on how much review time and data access a team can give.
Guide updated September 2026 · Autonomous Threat Hunting editors
This five-level model is this guide's own editorial framework, written in September 2026 to make vendor claims easier to compare. It is not an industry standard and no vendor has endorsed it.
As described by vendor
- L4
Autonomous, human-approved actions
As Level 3, and the system also prepares response or remediation actions. Actions run only after a person approves them.
- L3
Continuous hunting, human review
The system turns intelligence into hypotheses and runs hunts continuously without a per-hunt request. People review what it surfaces and approve any new detection.
- L2
Directed autonomous hunts
A person supplies the hypothesis; the system plans and runs the hunt across sources on its own and returns findings with its working.
- L1
Assisted hunting
Software suggests hypotheses, translates queries or maps findings to ATT&CK, but a person runs each hunt and reads each result.
- L0
Manual hunting
An analyst writes the hypothesis, the queries and the conclusion. Tools store and search data but do not suggest anything.
- Level 4, Autonomous, human-approved actions: Artemis Security
- Level 3, Continuous hunting, human review: Anvilogic, Cotool, Mars Security, Nebulock
- Level 2, Directed autonomous hunts: Vega
- Level 1, Assisted hunting: No vendor in this directory describes this level
- Level 0, Manual hunting: No vendor in this directory describes this level
What are the five levels?
| Level | Name | What the system does | Who decides | Human role |
|---|---|---|---|---|
| L0 | Manual hunting | An analyst writes the hypothesis, the queries and the conclusion. Tools store and search data but do not suggest anything. | The analyst decides everything. | Author of every step. |
| L1 | Assisted hunting | Software suggests hypotheses, translates queries or maps findings to ATT&CK, but a person runs each hunt and reads each result. | The analyst decides what runs and what it means. | Runs and interprets every hunt. |
| L2 | Directed autonomous hunts | A person supplies the hypothesis; the system plans and runs the hunt across sources on its own and returns findings with its working. | The analyst chooses the hypothesis and judges the findings. | Sets direction, reviews output. |
| L3 | Continuous hunting, human review | The system turns intelligence into hypotheses and runs hunts continuously without a per-hunt request. People review what it surfaces and approve any new detection. | The system decides what to hunt; people decide what is true and what ships. | Reviews findings, approves detections. |
| L4 | Autonomous, human-approved actions | As Level 3, and the system also prepares response or remediation actions. Actions run only after a person approves them. | The system proposes actions; a person approves each one. | Approves or rejects each action. |
What does each level look like?
Level 0: Manual hunting
Example: A hunter reads an advisory, writes a query by hand in each data platform's own language and records the result in a notebook.
Level 1: Assisted hunting
Example: A tool proposes a query for a technique and converts it into two query languages; the analyst runs both and reviews the rows.
Level 2: Directed autonomous hunts
Example: An analyst asks the system to check for a specific credential-theft pattern; it queries identity, endpoint and cloud logs and returns a summary with the queries it used.
Level 3: Continuous hunting, human review
Example: A new advisory arrives; the system writes behavioral hunts, runs them against existing data, corroborates hits and hands analysts a short list to confirm.
Level 4: Autonomous, human-approved actions
Example: After corroborating a compromised account, the system stages a session revoke and a host isolation and waits for an analyst to confirm.
How were vendors placed?
Each vendor is placed on the rung that matches the words on its own public pages, as reviewed in September 2026. We did not test any product. Where a vendor describes several modes, we used the most autonomous mode it describes for hunting. Vendors whose material does not describe hunting are not placed.
| Vendor | Placement | Basis |
|---|---|---|
| Anvilogic | L3 · Continuous hunting, human review | Describes agents that take threat intel through to deployed detection logic and search across connected data without a per-query request. |
| Artemis Security | L4 · Autonomous, human-approved actions | Describes continuous daily hunts plus staged response actions that require human confirmation. |
| Cotool | L3 · Continuous hunting, human review | Describes agents that gather intel, check relevance to the environment and propose detections without a per-hunt request. |
| Mars Security | L3 · Continuous hunting, human review | Describes hunts generated from intelligence and run continuously, with a corroborated shortlist handed to analysts and detections backtested before release. |
| Nebulock | L3 · Continuous hunting, human review | Describes hunting without a directive and continuous hunts, with detections gated by a Retrohunt before deployment. |
| Vega | L2 · Directed autonomous hunts | Its threat hunting page describes a user supplying the hypothesis and the system running the whole hunt autonomously. |
Which level fits your team?
- Level 1 or 2 fits teams that want every hunt to start from a person's question and have analysts free to run them.
- Level 3 fits teams with more intelligence than hunting time, provided someone reviews the short list every day.
- Level 4 fits teams that already trust the system's findings and want response prepared, with approval kept per action.
- At every level, the system can only be as good as the data it can read and the review it gets.