Blog

Threat hunting news recap: June to September 2026, grouped by theme

Four months of announcements from the tools in this guide and the standards they rely on.

By Threat Hunting Tools staff · 29 September 2026 · 4 min read

News recap

This recap covers announcements from June to September 2026. It groups them by theme rather than by date, because several vendors moved in the same direction in the same weeks. Every item links to the original announcement in the sources list, and the news page keeps the same items in date order. Summaries are ours; the claims are the vendors' own.

Which announcements were about reaching more data?

This was the busiest theme of the period.

28 July: Anvilogic announced general availability of Blueprints, its workflow automation, and of a Federated Search experience powered by Anvilogic Compute.
29 July: Nebulock introduced Helix, which lets its agents query vulnerability management and other security tools when a hunt needs the data, instead of loading that data in advance.
30 July: Anvilogic released version 8.0 of its platform, covering data onboarding, search, detection and investigation. The release adds Elastic, CrowdStrike LogScale and Dynatrace as federated search sources, along with case management.
21 September: Vega added Wiz cloud risk context to its detection and investigation workflows, bringing in attributes on exposure, privileges and sensitive data.

The common thread is reaching more sources and more context from the systems a team already runs, with Anvilogic and Nebulock both describing access that does not require loading data in advance. For a hunter the practical question is unchanged: which of your sources each tool can reach, and how. Our post on federated search and the data source grid cover that.

What shipped for turning intelligence into detections?

4 August: Vega released Detection Skills, an open specification built on the Agent Skills format, with a library of more than 50 skills.
8 September: Mars Security announced Real-Time Intel-Based Detection. According to its press release, the capability converts threat intelligence advisories into MITRE ATT&CK-mapped detections, writes them in the native query language of each source, and backtests each rule against 30 days of the customer's own data before it goes live. The release says it is available to all customers at no additional cost.
16 September: Mars Security published a blog post introducing MARS playbooks, framed around attacks that fail a hypothesis rather than fire an alert.

Both vendors address the step between reading an advisory and having a tested rule running. Our post on backtesting and retrohunts covers what a pre-deployment test can and cannot show.

What changed underneath the agents?

Two announcements concerned the plumbing that agent-based tools depend on.

4 June: Artemis Security added Claude Enterprise Compliance API events, normalized to OCSF, to the cloud, identity and SaaS telemetry it correlates.
29 July: Cotool launched Router, which adds cross-provider model fallback, access to open-weight models and evaluation-based model selection for its security agents.

Neither changes what a hunt looks for. Both change what the tools can see or how they keep running, which is worth asking about in a demo.

Who raised money?

25 June: Nebulock announced a $25 million Series A led by FirstMark, alongside insider risk features, correlation rules and a Command Center view.

Funding is not a product feature, and we do not score it. It is listed here because the announcement also described product additions.

What did the standards projects release?

9 July: the Sigma project published release r2026-07-01, adding 20 new detection rules and updating more than 80 existing ones, including rules for supply-chain attacks. Our post on Sigma in 2026 covers this and the two earlier releases of the year.
6 August: MITRE's updates page dates ATT&CK v19.2 to this day. It is described as the first release in a narrower-scope agile format and adds groups including ShinyHunters and TeamPCP, plus related supply chain software. It does not change the 15 Enterprise tactics set in v19. See what ATT&CK v19 changes for threat hunters.

What does it add up to?

Three things are clear from the dates alone. First, reaching more data sources and context was the most common subject of announcements from the tools in this guide during these months. Second, the step from intelligence to a tested rule is getting product attention from more than one vendor. Third, the shared references hunters use, ATT&CK and Sigma, kept moving, which means hunt logs and rule tags need the version recorded.

None of these announcements changes a score on its own. Scores in this edition come from the public product pages reviewed for the ranking; announcements are a prompt to check those pages again at the next review.

Sources

Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-18