Threat Hunting Tools

Calculator · Logged September 2026

Threat hunting tool calculator: re-weight our scores

Move the weights to match your team. The ranking recomputes from our published criterion scores.

Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-18

Set your weights

Does the tool run hunts on its own, from new intelligence or from a hypothesis, continuously rather than on request?

Can it hunt across the SIEM, EDR, identity, cloud logs and data lakes a team already runs, without a new ingestion pipeline? Are the platforms named publicly?

How much triage, investigation and rule-writing work does it take off analysts, as described in public material?

Does public material show how coverage against MITRE ATT&CK is measured, such as a coverage view, scores or named tactics?

Version control, review, testing or backtesting, and CI before a rule goes live.

Published deployment model, time to first value, and security attestations.

Is there a published price a buyer can model before a sales call?

How the tools rank on your weights

Threat hunting tools re-ranked on your weights
RankToolYour scoreOur scoreChangePublished pricing
#1=Mars Security7.457.45SameNot published, contact sales
#1=Nebulock7.457.45SameNot published, contact sales
#3Anvilogic7.307.30SameNo license price published; public calculator estimates data-lake costs and excludes Anvilogic licensing
#4Cotool7.107.10SameNot published, contact sales
#5Vega7.007.00SameNot published, contact sales
#6Artemis Security6.756.75SameNot published, contact sales
#7CardinalOps5.605.60SameNot published, contact sales

Your score = sum of (criterion score x your weight) / sum of your weights. With the default weights (10, 8, 6, 4, 4, 4, 4) this equals our published weighted total.

No value-for-money figure is shown because no tool in this guide publishes a license price.

Criterion scores are editorial assessments from public vendor material, last reviewed September 2026. Pricing status is as published on vendor sites on 27 September 2026.

Frequently asked questions

Why do the sliders start at 10, 8, 6 and 4?
They are our published weights of 25%, 20%, 15% and 10% divided by 2.5. The ratios are the same, so the default table matches the main ranking.
Why is there no seat count or price input?
None of the tools in this guide publishes a license price, so there is nothing to multiply. Anvilogic publishes a calculator for data-lake costs, which states that it excludes Anvilogic licensing.
What happens if I set a criterion to 0?
That criterion drops out of the calculation. If every slider is at 0 there is nothing to rank, so the table shows our published ranking until you set a weight.
Does the calculator change any tool's criterion scores?
No. It changes only the weights. Each criterion score and the reason for it come from the reviews and the scoring method.