Guide, facts read 3 to 5 November 2026
Agentic threat hunting: how a hunt starts, runs and ends
The short answer
An agentic hunt starts from a hypothesis, runs queries across your data, and ends with a finding, a closed hypothesis or a new detection rule. Dropzone's AI Threat Hunter ships 250+ hunt packs; Mate, Prophet, 7AI, Intezer and Simbian also document hunting. CrowdStrike cites agents triggering 2.5 times more detection leads than humans, a figure without a method on the page.
A hunt begins with a hypothesis, not an alert
Triage starts from an alert. A hunt starts from a suspicion: an attacker technique you have no rule for, a new threat report, a gap in ATT&CK coverage, an odd pattern in last month's data. The hypothesis says what you would expect to see if it were true.
Dropzone describes its AI Threat Hunter as hypothesis-driven, with 250+ hunt packs. 7AI added Threat Hunt and Threat Intel Hunt on 2026-06-01. Mate lists Agentic Threat Hunting as a product. Prophet and Intezer list threat hunting among their use cases.
| Platform | Hunting feature | Date or detail |
|---|---|---|
| Dropzone AI | AI Threat Hunter | 250+ hunt packs |
| 7AI | Threat Hunt, Threat Intel Hunt | 2026-06-01 |
| Mate Security | Agentic Threat Hunting | Product page |
| Prophet Security | Threat hunting | Next to AI Detection Engineer (2026-07-30) |
| CrowdStrike Charlotte AI | Hunting leads | 2026 Threat Hunting Report |
Hypotheses come from three sources
Threat intelligence: a new campaign report names techniques and indicators. Coverage gaps: an ATT&CK technique with no detection. Environment change: a new SaaS app, a merger, a cloud migration. A good agentic hunting tool should accept all three and say which one started each hunt.
Ask the vendor whether you can write your own hypothesis in plain language, and whether the agent explains how it translated it into queries.
The run is a loop of query, read, refine
The agent writes a query, reads the results, discards noise, and refines. A human hunter does the same, slowly. The value of an agent is breadth: more data sources and more refinements in the same hour. Dropzone cites a customer testimonial saying the AI Threat Hunter compresses up to 40 hours of hunt work into about one hour. Grade C, a single testimonial.
Read the agent's query log for every hunt in a trial. You want to see it pivot on what it found, not run a fixed list.
A hunt ends in one of three ways
A finding: something real, handed to incident response. A closed hypothesis: nothing found, with the evidence of absence recorded. A new detection: the pattern is worth watching for continuously, so the hunt becomes a rule.
The third ending is where hunting and detection engineering meet. Intezer says investigation results feed back into detection rules. Prophet's AI Detection Engineer, launched 2026-07-30, sits next to its hunting. Ask whether a hunt can produce a rule draft directly, and who approves it.
Measure hunts by what they close
Count hunts run, hypotheses closed with evidence, findings, and detections created. Leads alone are a weak measure. CrowdStrike says AI agents trigger 2.5 times more detection leads than humans, citing its 2026 Threat Hunting Report; the method is not on the page. More leads are only useful if a person or an agent can work them.
Hunting is one of seven use cases in the index
Six of the twelve platforms document hunting as a use case. Torq, Microsoft, SentinelOne, Legion and Exaforce do not list it on the pages read; CrowdStrike lists hunting leads through its report.
Data reach sets the ceiling for any hunt
An agent can only hunt in data it can query. A hypothesis about lateral movement needs endpoint, identity and network telemetry; one about cloud credential abuse needs cloud audit logs and identity data. Before judging a hunting agent, list the data sources each of your priority hypotheses needs, and check them against the vendor's connectors.
Dropzone names Splunk, CrowdStrike Falcon, Microsoft Defender, SentinelOne, Google SecOps, Okta, Wiz, GuardDuty and Elastic among its integrations, read 2026-11-03. Simbian publishes counts by category, including 25 SIEM and log sources and 15 threat intelligence sources. 7AI announced a Federated SIEM on 2026-07-27, which suggests querying across sources rather than centralising them.
Retention decides how far back a hunt can look
A new threat report often describes activity that began months earlier. If your SIEM keeps 30 days of hot data, a hunt cannot see the start of the campaign. Ask whether the agent can query cold storage or a data lake, how long such queries take, and whether they cost extra. Microsoft's Sentinel data lake, in preview at the last page update, is one answer to this; check the retention your own licence actually provides.
Schedule hunts, do not wait for inspiration
Human hunting programmes stall because hunts compete with incidents for the same people. Agents remove that excuse. Set a cadence: one hunt per new threat report relevant to your sector, one per month against your oldest coverage gap, and one after every major environment change.
Review the results weekly with a person who owns detection engineering. A hunt that finds nothing three times in a row on the same hypothesis is either a solved problem or a data gap, and it is worth knowing which.
Threat intelligence agents feed the queue
Dropzone sells an AI Threat Intel Analyst next to its hunter, and 7AI added Threat Intel Hunt on 2026-06-01. The idea is to turn incoming reports into hypotheses automatically. Ask to see the chain for one recent report: what the intel agent extracted, which hypotheses it wrote, and what the hunt found.
Platforms discussed in this guide
- Dropzone AI, rank 6, 5.95
- 7AI, rank 11, 5.50
- Prophet Security, rank 7, 5.90