In one paragraph
This guide is desk research from public vendor material, last reviewed September 2026. We did not test products, interview vendors or use private briefings. The directory records what each vendor publishes and marks what it does not; the autonomy ladder places each vendor on the rung its own material describes. Nothing on the site is a score or a ranking.
Guide updated September 2026 · Autonomous Threat Hunting editors
What sources does the guide use?
Vendor websites, product pages, documentation, vendor announcements carried by trade press, and public repositories. For framework references we use attack.mitre.org for MITRE ATT&CK (version 19.2, 15 Enterprise tactics at the time of review) and the SigmaHQ repository on GitHub for Sigma. Each directory entry links to the pages we read. Pages were read in September 2026; vendors change their sites often, so check the linked source before relying on a detail.
How is the autonomy ladder built?
The five levels are this guide's own editorial model, written to make different vendor wording comparable. We placed each vendor on the rung that best matches the words on its own pages: for example, a page saying the user supplies a hypothesis and the system runs the hunt maps to Level 2, and a page describing hunts started from intelligence without a request maps to Level 3. Level 4 requires a published description of response actions gated by human approval. Where material does not describe hunting at all, the vendor is not placed. A placement can change when a vendor publishes more detail.
What does the directory record, and what does it leave out?
The directory covers six platforms whose public material describes continuous threat hunting on existing security data. Coverage-only and detection-reliability tools are outside its scope.
Each entry records what the vendor states it automates, where it runs and what data it reads, the human controls it describes, a few stated facts such as location or funding, and a list of things a buyer would want that the vendor does not publish, such as pricing. We do not score vendors, rank them, or repeat performance claims we could not check beyond quoting them as the vendor's own words. SIEM and data platforms are named only as the places these systems read from; this guide does not assess them.
What are the limitations?
- Public sources only. No hands-on testing, no vendor interviews, no customer interviews.
- Vendor pages describe intent and design; they do not prove behavior in your environment.
- Absence from a vendor's public pages does not mean a capability is absent from the product. We say "not published", not "not supported".
- Two vendors named in early research could not be verified from a working public website and were left out.
- The directory is not exhaustive.
How do corrections work?
Write to editors@autonmusthreathunting.com with the page and the source. We correct factual errors within ten days and update the stamp on the page.
Trademarks
Names of products and frameworks belong to their owners. MITRE ATT&CK is a registered trademark of The MITRE Corporation; this guide is not affiliated with MITRE.