Setting your own weights for threat hunting tool scores

A weighted score is a set of opinions made explicit. Ours are published on the scoring method page. This lesson explains what they assume and how to replace them with your own in the calculator.

What do our weights assume?

The weights are 25% for hunt automation, 20% for working across existing SIEM and data lakes, 15% for analyst effort saved, and 10% each for ATT&CK coverage evidence, detection-as-code workflow, deployment and pricing transparency. Together they describe one kind of buyer: a team that wants hunts running continuously on the data it already collects, without adding headcount. The site's name and angle come from that buyer.

Your team may not be that buyer. Three common differences: - A mature detection engineering team may care more about how rules are versioned, reviewed and tested than about hunts that run on their own. - A team that reports ATT&CK coverage to an audit committee may need published coverage evidence more than anything else. - A team under pressure to show results within a quarter may put deployment near the top.

How to set weights without fooling yourself

1. Write your three priorities in plain words before you touch a slider. For example: "rules must go through our git review", "we need identity and EDR data first", "we cannot wait months".
2. Translate each priority into a criterion. Git review is detection-as-code workflow. Identity and EDR reach is working across existing data. Speed is deployment.
3. Set those criteria high and the rest lower. The calculator's sliders run from 0 to 10; only the ratios matter, so 10, 5 and 5 means the same as 8, 4 and 4.
4. Look at which tools moved, then open the criterion reasons that caused the move. The reasons, not the decimals, tell you whether the change reflects something real on the vendor's public pages.

Things that barely move the order

A criterion where the tools score close together changes the ranking little, however much weight it gets. Check the spread in the ranking table before spending effort on a weight. A criterion with a wide spread between the highest and lowest score is where weighting decisions matter.

How precise are the results?

Less precise than two decimals suggest. Each criterion score is an editorial judgment from public material on a 0 to 10 scale. A gap of a few hundredths between two tools is well inside that judgment. Treat tools within a small margin of each other as a group to examine more closely, not as a winner and a loser. Our ranking shows equal totals as ties for the same reason.

What weights cannot capture

Weights only rearrange criteria we already score. They cannot add what public pages do not show: how a tool behaves on your data, how responsive the vendor is, or what it costs, since none of the tools in this guide publishes a license price. Those questions belong in a proof of concept, ideally scored with the same weights you chose here, so the trial and the desk research can be compared.

Keep a record

Save the weights you chose and the reason for each, next to your data map from the previous lesson. When the shortlist is questioned later, the reasoning is on paper.