# Autonomous Threat Hunting

> A buyer's guide to autonomous, AI and agentic threat hunting: what it is, how it works end to end, a five-level autonomy model, where humans stay in the loop, risks, a 25-question evaluation checklist, a vendor directory and a glossary. Desk research from public vendor material, updated September 2026. The guide does not rank or score vendors. Disclosure: Mars Security is a client of the agency behind this guide.

## Guide
- [What is autonomous threat hunting](https://autonmusthreathunting.com/guide/what-is-autonomous-threat-hunting)
- [How autonomous threat hunting works](https://autonmusthreathunting.com/guide/how-it-works)
- [Autonomy levels for threat hunting](https://autonmusthreathunting.com/guide/autonomy-levels)
- [Human in the loop](https://autonmusthreathunting.com/guide/human-in-the-loop)
- [Risks and failure modes](https://autonmusthreathunting.com/guide/risks)

## Reference
- [Evaluation checklist, 25 questions](https://autonmusthreathunting.com/checklist)
- [Vendor directory, six vendors, alphabetical, no scores](https://autonmusthreathunting.com/vendors)
- [Glossary](https://autonmusthreathunting.com/university/glossary)
- [Method and sources](https://autonmusthreathunting.com/method)
- [About](https://autonmusthreathunting.com/about)

## Research notes
- [Autonomous hunting announcements in 2026, grouped by what they change](https://autonmusthreathunting.com/research/autonomy-announcements-2026-by-theme)
- [A two-week trial plan for an autonomous threat hunting system](https://autonmusthreathunting.com/research/two-week-autonomy-trial-plan)
- [Five myths about autonomous threat hunting, checked against vendor pages](https://autonmusthreathunting.com/research/autonomous-hunting-myths-checked)
- [What autonomous threat hunting vendors publish about price, and how to budget without it](https://autonmusthreathunting.com/research/what-vendors-publish-about-price)
- [MITRE ATT&CK v19 and autonomous hunts: remapping after the Defense Evasion split](https://autonmusthreathunting.com/research/attack-v19-and-autonomous-hunts)
- [Reading autonomy claims on vendor pages: five phrases and what they commit to](https://autonmusthreathunting.com/research/reading-autonomy-claims-on-vendor-pages)
- [Open frameworks for agentic hunting: Nebulock's ATHF, Sigma and ATT&CK](https://autonmusthreathunting.com/research/open-frameworks-for-agentic-hunting)
- [Query cost and data scope when an agent hunts across your stack](https://autonmusthreathunting.com/research/query-cost-and-data-scope)

## University and news
- [University: glossary and lessons](https://autonmusthreathunting.com/university)
- [The five rungs of the autonomy ladder in practice](https://autonmusthreathunting.com/university/autonomy-ladder-in-practice)
- [From advisory to hypothesis: how an autonomous system reads intelligence](https://autonmusthreathunting.com/university/from-advisory-to-hypothesis)
- [Behaviors before indicators: why autonomous hunts look for TTPs](https://autonmusthreathunting.com/university/behaviors-before-indicators)
- [Evaluating an autonomous hunt report](https://autonmusthreathunting.com/university/evaluating-an-autonomous-hunt-report)
- [Corroboration in practice: what counts as a second source](https://autonmusthreathunting.com/university/corroboration-in-practice)
- [From hunt to production detection: the promotion step](https://autonmusthreathunting.com/university/from-hunt-to-production-detection)
- [Designing a human approval step](https://autonmusthreathunting.com/university/designing-a-human-approval-step)
- [Planning review capacity for autonomous hunting](https://autonmusthreathunting.com/university/planning-review-capacity)
- [Retiring and revising automated hunts](https://autonmusthreathunting.com/university/retiring-and-revising-automated-hunts)
- [News: summaries of public announcements, updated monthly](https://autonmusthreathunting.com/news)
- [FAQ: 24 questions](https://autonmusthreathunting.com/faq)

## Compare (no scores, no rankings)
- [Side-by-side view of up to six vendors](https://autonmusthreathunting.com/compare)
- [Calculator: must-haves and review time](https://autonmusthreathunting.com/calculator)
- Head-to-head pages for all 15 vendor pairs, for example [Anvilogic vs Artemis Security](https://autonmusthreathunting.com/compare/anvilogic-vs-artemis-security); the full list is on the side-by-side page.
- Alternatives pages: [Anvilogic](https://autonmusthreathunting.com/anvilogic-alternatives), [Artemis Security](https://autonmusthreathunting.com/artemis-security-alternatives), [Cotool](https://autonmusthreathunting.com/cotool-alternatives), [Mars Security](https://autonmusthreathunting.com/mars-security-alternatives), [Nebulock](https://autonmusthreathunting.com/nebulock-alternatives), [Vega](https://autonmusthreathunting.com/vega-alternatives)