Autonomous Threat Hunting

RESEARCH NOTE

Autonomous hunting announcements in 2026, grouped by what they change

Nine months of announcements, sorted by the part of the hunt they touch.

In one paragraph

This note groups public announcements from January to September 2026 by what they change about autonomous hunting rather than by company: who starts a hunt, what an agent can reach while it runs, how intelligence becomes a rule, what the agents themselves run on, who is funding the category, and which shared references moved. Every item is taken from the announcement itself and linked at the end. The note records what was announced; it does not judge it.

By Autonomous Threat Hunting editors ·

What does this note cover?

It covers announcements dated from 29 January to 21 September 2026, from the six vendors in this guide's directory and from the MITRE ATT&CK and Sigma projects. Short summaries of most items are on the news page; here they are grouped by theme, and within each theme listed by date.

Who starts the hunt?

Two announcements are statements about initiative, the question at the center of this guide's autonomy levels.

What can an agent reach while it hunts?

Several releases widen the data or context an agent can use during a hunt without copying it first.

The common thread is that more of the agent's work happens at query time. That makes the questions in query cost and data scope more pressing, because each new source an agent can reach is also a new place where it runs queries.

How does intelligence become a rule?

This is the promotion step described in the lesson from hunt to production detection, and the backtest window is one of the few specific numbers any vendor in the directory publishes about it.

What do the agents run on?

These are announcements about the layer beneath the hunt: which model an agent uses, what happens when it is unavailable, and how an agent's instructions are packaged. For buyers they turn into two questions: can we see what the agent was told to do, and what happens to hunting when a model provider has an outage?

Who is funding the category?

Which shared references moved?

Any system that maps hunts to ATT&CK automatically had to absorb the v19 split this year. The note on ATT&CK v19 and autonomous hunts covers what that means in practice.

How to use this recap

Announcements describe intent. Before relying on one, read the source, then ask the vendor to show the feature in a trial on your data. The checklist has the questions, and the news page is updated monthly.

Frequently asked questions

Which period does this recap cover?
Announcements dated from 29 January to 21 September 2026, from the six vendors in the directory and the MITRE ATT&CK and Sigma projects.
Does the recap rate the announcements?
No. It groups them by theme and restates what each announcement says, with a link to the source.

Sources