15 Best Threat Hunting Tools in 2026: Enterprise Platforms, Open-Source, and AI-Native Compared

1. What Are the 15 Best Threat Hunting Tools for Security Operations in 2026?

Selecting the right threat hunting tool is among the highest-stakes decisions a security operations team will make this year. With the average attacker dwell time still measured in weeks and agentic AI compressing attack timelines from days to hours, proactive hunting has shifted from “nice to have” to operational survival. Rather than ranking by brand recognition alone, this guide evaluates 15 providers across enterprise XDR/SIEM, AI/behavioral, and open-source categories, using operational, technical, and business criteria relevant to modern security organizations.

For this report, we analyzed 15+ threat hunting platforms and managed hunting services offering capabilities such as proactive threat hunting, endpoint/network/cloud detection, MITRE ATT&CK mapping, and incident response orchestration.

✅ Our Evaluation Criteria

Each provider included in this list was assessed across five key areas:

• Threat Hunting Depth & Detection Coverage (25%): Telemetry breadth, query language flexibility, MITRE ATT&CK mapping maturity, and proactive hunting capabilities
• Cross-Functional Intelligence & Integration (20%): Vendor-agnostic integration across SIEM, EDR, cloud, identity, and SaaS; ability to work with existing security investments
• Response & Analyst Workflow (20%): Automated and human-led response capabilities, ChatOps/user verification, analyst collaboration, and SOAR orchestration
• Setup, Usability & Deployment (15%): Time-to-value, onboarding speed, learning curve, deployment model flexibility (cloud, on-prem, hybrid, managed)
• Pricing Transparency & TCO (20%): Published pricing availability, per-endpoint vs. per-GB models, total cost of ownership including infrastructure and staffing

👤 Who This Guide Is For

This shortlist is designed specifically for:

• SOC managers and threat hunting leads evaluating tools to mature their hunting program
• CISOs and IT Directors building or expanding detection-and-response capabilities
• PE operating partners standardizing security tooling across portfolio companies
• Security teams assessing whether to build, buy, or outsource threat hunting

If your organization is moving toward vendor evaluation or preparing an RFP, the providers below represent established threat hunting platforms and services frequently considered during the buying process.

Provider	Best For	Key Strength	Compliance
1. UnderDefense MAXI ★★★★★	Vendor-agnostic managed hunting layered on existing stacks	AI SOC + Human Ally; 250+ integrations; 2-min alert-to-triage	SOC 2, HIPAA, ISO 27001, GDPR, PCI DSS
2. CrowdStrike Falcon Insight XDR ★★★★	Falcon-native enterprise threat hunting at scale	OverWatch managed hunting; CQL; Threat Graph 90-day retention	SOC 2, FedRAMP, PCI DSS, HIPAA
3. Microsoft Defender XDR ★★★★	Microsoft-centric environments with M365 E5	KQL advanced hunting; cross-domain (endpoint, identity, email, cloud)	SOC 2, ISO 27001, HIPAA, FedRAMP
4. Splunk Enterprise Security ★★★★	Large enterprises with mature SOC teams needing flexible analytics	SPL queries; massive community detection library	SOC 2, PCI DSS, HIPAA
5. Elastic Security ★★★★	Organizations wanting open-source flexibility with cloud option	EQL sequence detection; self-hosted or Elastic Cloud	SOC 2, HIPAA, PCI DSS
6. SentinelOne Singularity XDR ★★★★	Autonomous response with AI-driven storyline visualization	Purple AI; ransomware rollback; one-click remediation	SOC 2, FedRAMP, HIPAA
7. Palo Alto Cortex XDR ★★★	Organizations already in the Palo Alto ecosystem	XQL; XSIAM integration; Unit 42 threat intel	SOC 2, ISO 27001, PCI DSS
8. IBM QRadar SIEM ★★★	Regulated enterprises requiring deep correlation	STIX/TAXII; compliance-heavy correlation engine	HIPAA, PCI DSS, SOX, GDPR
9. Exabeam Fusion ★★★	Insider threat detection via behavioral analytics	UEBA-powered automated timelines; compliance reporting	SOC 2, HIPAA, PCI DSS
10. Vectra AI ★★★	Network-centric AI behavioral detection complementing endpoint stacks	NDR-first approach; identity threat detection	SOC 2, HIPAA
11. Darktrace ★★★	Detecting novel/zero-day attacks via unsupervised ML	Self-learning AI “immune system” approach	SOC 2, ISO 27001
12. Cynet 360 AutoXDR ★★	SMBs needing all-in-one autonomous breach protection	Deception honeypots; UEBA; built-in SOAR	SOC 2, HIPAA, GDPR
13. Velociraptor ★★★	Forensic-depth endpoint hunting for DFIR teams	VQL custom queries; cross-platform open-source	N/A (open-source)
14. TheHive + Cortex ★★★	Incident response orchestration with enrichment automation	SOAR-lite; community-driven analyzers; free deployment	N/A (open-source)
15. YARA + Sigma Rules ★★	Detection-as-code compiling to any SIEM target	Rule-based malware ID + Sigma cross-platform detection rules	N/A (open-source)

1. UnderDefense MAXI — ★★★★★ Best for Vendor-Agnostic Managed Threat Hunting Layered on Existing Security Stacks

📋 Overview

UnderDefense is a managed cybersecurity provider founded in 2017 and headquartered in New York, with 120 security engineers across three continents. The company’s AI-powered Under Defence MAXI platform delivers 24/7 threat detection, proactive threat hunting, incident response, compliance automation, and penetration testing as a unified security-as-a-service offering. What makes UnderDefense architecturally distinct is its vendor-agnostic approach: instead of forcing you to rip out your existing tools, MAXI integrates with 250+ security products, including CrowdStrike, Splunk, SentinelOne, Elastic, Microsoft Defender, Okta, and more, providing the 24/7 human-led hunting and response layer that standalone detection tools can’t deliver on their own.

✅ Core Services

• 24/7 Managed Detection & Response (MDR) with 2-minute alert-to-triage and 15-minute escalation for critical incidents
• Campaign-based proactive threat hunting and sweeps for indicators of compromise, mapped to 99% MITRE ATT&CK coverage
• Concierge analyst response: dedicated Tier 3–4 analysts communicate directly with affected users via Slack, Teams, or email to verify suspicious activity (ChatOps user verification)
• Vendor-agnostic SIEM co-management: customer owns data; UnderDefense fine-tunes Elastic, Splunk, or Sentinel without vendor lock-in
• Compliance automation: forever-free SOC 2, ISO 27001, HIPAA compliance kits bundled with MDR
• Penetration testing: full-spectrum offensive security (web, cloud, network, mobile)

🎯 Why Companies Consider UnderDefense

Most threat hunting tools solve detection. UnderDefense solves the gap between detection and outcome. When your CrowdStrike flags suspicious PowerShell execution at 2 AM, someone still needs to investigate: was it your IT admin running a legitimate script, or an attacker? UnderDefense’s analysts reach out directly to the affected user via Slack to verify, then contain the threat if it’s real. That’s the difference between “suspicious activity detected, please investigate” and “incident contained at 2:52 AM, here’s what happened and what we did.”

In documented case studies, UnderDefense detected and contained threats 2 days faster than CrowdStrike’s own OverWatch service, because AI-driven detection without human organizational context still leaves gaps that only analysts communicating directly with users can close.

👤 Ideal Customer Profile

• Mid-market and enterprise organizations (100–10,000 endpoints) already running CrowdStrike, SentinelOne, Splunk, Elastic, or Microsoft Defender
• PE-backed companies needing standardized security across portfolio (UnderDefense protects 10 PE firms with $5B+ AUM)
• Security-lean teams that need managed hunting without building a full internal SOC
• Organizations handling compliance mandates (SOC 2, HIPAA, ISO 27001) that need audit-ready evidence collection included, not as a separate product

💰 Commercial Model

UnderDefense publishes transparent pricing: $11–15/endpoint/month, which includes MDR, threat hunting, SIEM co-management, compliance kits, and direct analyst access. No “contact sales” opacity. No forced tool replacement. 30-day onboarding with security hardening included. CAPEX and OPEX options available.

⏰ When to Shortlist

Shortlist UnderDefense if your team already has detection tools but lacks the 24/7 human analyst layer to investigate, verify, and contain threats. Particularly strong if you want to keep your existing SIEM investment while getting managed hunting and response on top, without paying $96K/year median (Arctic Wolf) or $184.99/device/year (CrowdStrike Enterprise) for capabilities that still escalate back to your team.

💬 Customer Reviews

“What we love most about UnderDefense is their proactive approach. Their experienced SOC engineers work closely with our team, providing continuous monitoring and threat detection. The seamless integration and optimization of the EDR platform, CrowdStrike, has been impressive. Despite the complexity involved, they delivered the deployment to 1,200 endpoints in just 2–3 business days.”

— Oleksii M., Mid-Market (51–1,000 emp.) UnderDefense G2 – Verified Review

“UnderDefense MAXI integrates well with our systems, specifically with our SIEM, Splunk. Their team is proactive in identifying and addressing threats, providing 24/7 oversight. With UnderDefense MAXI, we’ve reduced security breaches. Their adherence to SLAs gives me confidence in our infrastructure’s protection. As the Information Security Director, it lets me focus on strategy, knowing the day-to-day security is managed effectively.”

— Oleg K., Director Information Security, Mid-Market UnderDefense G2 – Verified Review

2. CrowdStrike Falcon Insight XDR — ★★★★ Best for Falcon-Native Enterprise Threat Hunting at Scale

📋 Overview

CrowdStrike Falcon is a cloud-native endpoint protection platform that combines threat intelligence, EDR/XDR, and the OverWatch managed threat hunting service into a unified architecture. The platform’s Threat Graph processes over 2 trillion events per week, and CrowdStrike claims up to 150x search speed improvements for threat hunting queries. For organizations already invested in Falcon agents, the platform offers one of the deepest endpoint telemetry pools in the industry.

✅ Core Services

• Falcon OverWatch: 24/7 managed threat hunting by CrowdStrike’s elite team, augmenting automated detections
• CQL (CrowdStrike Query Language) for ad-hoc and structured hunting across Threat Graph
• Charlotte AI: generative AI assistant for accelerating investigation and plain-language hunting queries
• Threat Graph: 90-day data retention with cloud-scale analytics and cross-endpoint correlation
• Falcon Insight XDR: real-time detection and response across endpoints and third-party data sources

🎯 Why Companies Consider CrowdStrike

CrowdStrike has earned its reputation for endpoint detection depth. OverWatch’s managed hunting team proactively sweeps for threats that automated detections miss, and the Threat Graph’s 90-day retention gives hunters a substantial investigation window. Charlotte AI lowers the barrier for junior analysts to run complex threat hunts using natural language.

👤 Ideal Customer Profile

• Large enterprises (1,000+ endpoints) that want best-in-class EDR with a managed hunting overlay
• Organizations that have standardized on CrowdStrike Falcon and want hunting capabilities native to their existing agent
• Security teams with dedicated hunters who value CQL flexibility and deep telemetry

💰 Commercial Model

CrowdStrike Falcon Enterprise, which includes Falcon Insight XDR and OverWatch, is priced at $184.99/device/year (approximately $15.42/device/month). Falcon Elite (which adds advanced threat intelligence and priority support) requires custom pricing. OverWatch as a standalone managed hunting add-on is priced separately for existing Falcon customers.

⏰ When to Shortlist

Choose CrowdStrike if your organization has already standardized on Falcon endpoints and wants the deepest possible threat hunting on that telemetry. Be aware that CrowdStrike’s hunting strength is endpoint-centric. If you need hunting across identity, SaaS, or network telemetry from non-CrowdStrike sources, you’ll need additional tools or a vendor-agnostic layer.

💬 Customer Reviews

“The pre-sales crew is great. Really make you think you’ll get high tier support.”

— Verified User in Farming, Mid-Market Rapid7 Security Services – G2 Verified Review

3. Microsoft Defender XDR — ★★★★ Best for Microsoft-Centric Environments with M365 E5

📋 Overview

Microsoft Defender XDR provides cross-domain threat hunting across endpoints, identities, email, and cloud apps, all within the Microsoft 365 security ecosystem. The Advanced Hunting console supports both guided mode (for analysts new to hunting) and advanced mode using KQL (Kusto Query Language), with a 30-day data window for raw event exploration.

✅ Core Services

• Advanced Hunting console with KQL for structured and ad-hoc queries across Microsoft 365 Defender tables
• Cross-domain telemetry: endpoint (Defender for Endpoint), identity (Defender for Identity), email (Defender for Office 365), and cloud apps (Defender for Cloud Apps)
• Guided hunting mode for analysts who need point-and-click exploration alongside advanced KQL
• Microsoft Sentinel integration for extended log retention beyond 30 days and broader third-party ingestion
• Defender Experts for Hunting: Microsoft’s managed hunting service for organizations wanting human-led proactive sweeps

🎯 Why Companies Consider Microsoft Defender XDR

If your organization runs Microsoft 365 E5, you already have Defender XDR included in your licensing, making the incremental cost of threat hunting effectively zero for the base capability. The cross-domain visibility (endpoint + identity + email + cloud apps in one hunting interface) is a real architectural advantage that point EDR solutions can’t match.

👤 Ideal Customer Profile

• Organizations with 500+ employees running Microsoft 365 E5 or E5 Security add-on
• Security teams that want unified hunting across endpoint, identity, and email without deploying separate tools
• Environments where Azure Sentinel is the primary SIEM

💰 Commercial Model

Included with Microsoft 365 E5 licensing (~$57/user/month), which bundles Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps. Sentinel (for extended retention and SIEM capabilities) incurs additional per-GB ingestion costs. Defender Experts for Hunting is priced as a separate managed service add-on.

⏰ When to Shortlist

Shortlist Microsoft Defender XDR if you’re already paying for M365 E5 and want to maximize that investment. The 30-day raw data window is a limitation for long-dwell investigations; pair with Sentinel for extended retention. Be mindful that hunting across non-Microsoft telemetry (third-party firewalls, non-Azure cloud) requires Sentinel connectors and additional configuration.

4. Splunk Enterprise Security — ★★★★ Best for Mature SOC Teams Needing Flexible Analytics and Community Detections

📋 Overview

Splunk Enterprise Security (ES) remains one of the most powerful SIEM platforms for threat hunting, thanks to its Search Processing Language (SPL), which gives hunters near-unlimited flexibility to query across any data source. The platform’s massive community of shared detection rules and hunting queries, along with Splunk’s ThreatResearch GitHub and BOTS competitions, gives mature hunting teams a deep ecosystem to draw from.

✅ Core Services

• SPL (Search Processing Language) for ad-hoc and scheduled hunting across any structured/unstructured data
• Extensive community detection library: thousands of community-contributed detections and hunting queries
• Adaptive Response Framework for automated response actions triggered by hunting findings
• ES Content Update for regularly updated correlation searches aligned to MITRE ATT&CK
• Splunk SOAR integration for orchestrated response playbooks

💰 Commercial Model

Splunk uses a per-GB ingestion pricing model, starting at approximately $150+/GB/day for Enterprise Security. Workload-based pricing is also available. Costs escalate significantly at scale, which is the primary pain point for large-volume environments.

⏰ When to Shortlist

Choose Splunk if your team has mature SPL skills and needs maximum query flexibility. Be prepared for cost challenges at high data volumes. Many organizations are evaluating migrations to Elastic or Microsoft Sentinel specifically because of Splunk’s per-GB economics.

5. Elastic Security — ★★★★ Best for Open-Source Flexibility with Optional Cloud Management

📋 Overview

Elastic Security combines the power of the Elastic Stack (Elasticsearch, Kibana, Logstash, Beats) with purpose-built security features including EQL (Event Query Language) for sequence-based detection and hunting. Organizations can self-host for maximum cost control or use Elastic Cloud for managed infrastructure.

✅ Core Services

• EQL (Event Query Language) for sequence-based detection, allowing hunters to define multi-step attack patterns
• Lucene and KQL query options alongside EQL for flexible hunting approaches
• Self-hosted deployment with open-source licensing or Elastic Cloud managed service
• Pre-built detection rules mapped to MITRE ATT&CK and community-contributed rules
• Elastic AI Assistant for natural language hunting queries

💰 Commercial Model

Elastic Cloud starts at approximately $95/month for the Standard tier. Self-hosted is free (Basic license) but requires infrastructure and staffing investment. Enterprise features (ML-based anomaly detection, cross-cluster search) require paid tiers.

⏰ When to Shortlist

Choose Elastic if your team values open-source flexibility and wants to own your data without vendor lock-in. The self-hosted vs. cloud tradeoff is real: you save on licensing but absorb operational burden for cluster management, scaling, and tuning.

6. SentinelOne Singularity XDR — ★★★★ Best for Autonomous Response with AI-Driven Storyline Visualization

📋 Overview

SentinelOne Singularity XDR provides endpoint, cloud, and identity protection with a strong emphasis on autonomous response. The platform can detect, contain, and remediate threats without human intervention using pre-built response workflows. Purple AI, SentinelOne’s generative AI engine, enables natural language threat hunting across the Singularity Data Lake.

✅ Core Services

• Purple AI: natural language threat hunting across the unified data lake
• Storyline attack visualization: auto-correlates events into attack narratives, reducing investigation time
• Ransomware rollback: restores endpoints to pre-attack state using VSS snapshots
• One-click remediation: automated containment and cleanup across endpoints
• Singularity Data Lake: centralized telemetry repository for cross-domain hunting

💰 Commercial Model

SentinelOne uses per-endpoint annual pricing. Singularity Core starts at approximately $69.99/endpoint/year; Complete (with threat hunting and Deep Visibility) and Enterprise tiers are priced higher. Purple AI and Data Lake capabilities require premium licensing.

⏰ When to Shortlist

Choose SentinelOne if autonomous response speed is your priority and your hunting team values visual attack storylines over raw query output. The ransomware rollback capability is a genuine differentiator for organizations where rapid recovery is critical.

7. Palo Alto Cortex XDR — ★★★ Best for Organizations Already in the Palo Alto Ecosystem

📋 Overview

Cortex XDR by Palo Alto Networks integrates endpoint, network, and cloud data into a single detection and investigation platform. XQL (XDR Query Language) provides structured hunting capabilities, and Unit 42 threat intelligence feeds enrich detections with real-world adversary context.

✅ Core Services

• XQL (XDR Query Language) for hunting across endpoint, network, and cloud telemetry
• Cortex XSIAM integration for AI-driven SOC automation
• Unit 42 threat intelligence for adversary tracking and context enrichment
• Behavioral analytics engine with ML-based anomaly detection
• Automated root cause analysis with attack chain visualization

💰 Commercial Model

Enterprise pricing; requires custom quoting. Typically deployed alongside existing Palo Alto firewalls, Prisma Cloud, and other ecosystem products.

⏰ When to Shortlist

Shortlist Cortex XDR if your network and cloud infrastructure already runs Palo Alto. The XDR value proposition is strongest when it ingests telemetry from Palo Alto firewalls, Prisma Cloud, and Cortex agents together.

8. IBM QRadar SIEM — ★★★ Best for Regulated Enterprises Requiring Deep Correlation and Compliance Reporting

📋 Overview

IBM QRadar remains a staple in heavily regulated environments, including financial services, healthcare, and government, where deep correlation, compliance reporting, and STIX/TAXII integration are non-negotiable requirements.

✅ Core Services

• Deep correlation engine for complex multi-source event analysis
• STIX/TAXII threat intelligence ingestion for structured threat data sharing
• QRadar Advisor with Watson for AI-assisted investigation
• Extensive compliance reporting pre-built for HIPAA, PCI DSS, SOX, GDPR
• Network flow analysis for behavioral anomaly detection

💰 Commercial Model

IBM QRadar uses EPS (Events Per Second) and FPM (Flows Per Minute) licensing. On-premises and SaaS options available. Enterprise pricing requires custom quoting.

⏰ When to Shortlist

Choose QRadar if you’re in a compliance-heavy industry where audit-ready reporting and regulatory evidence collection are as important as detection capability.

9. Exabeam Fusion — ★★★ Best for Insider Threat Detection via UEBA-Powered Behavioral Analytics

📋 Overview

Exabeam Fusion combines SIEM and XDR capabilities with industry-leading User and Entity Behavior Analytics (UEBA), making it particularly effective for insider threat hunting and detecting compromised credentials.

✅ Core Services

• UEBA-powered behavioral analytics with automated user/entity timelines
• Smart Timelines: auto-assembles investigation narratives from raw events
• Pre-built threat hunting content with MITRE ATT&CK mapping
• Compliance reporting automation for regulated environments
• Cloud-native deployment with Exabeam Security Operations Platform

💰 Commercial Model

Subscription-based; pricing varies by data volume and number of monitored users/entities. Custom quoting required.

⏰ When to Shortlist

Shortlist Exabeam if insider threat detection and compromised credential hunting are your primary use cases, particularly in environments with high user-to-endpoint ratios.

10. Vectra AI — ★★★ Best for Network-Centric AI Behavioral Detection Complementing Endpoint Stacks

📋 Overview

Vectra AI takes an NDR-first (Network Detection and Response) approach, using AI to analyze network traffic and identity behaviors for attacker techniques that endpoint-only tools miss: lateral movement, command-and-control, and data exfiltration.

✅ Core Services

• AI-driven behavioral detection across network, cloud, and identity
• Attack Signal Intelligence: prioritizes threats by urgency and severity across the kill chain
• Identity threat detection: monitors Azure AD, AWS, and M365 for account compromise
• Vectra Match: combines AI behavioral detection with Suricata signature matching
• Cloud detection for AWS, Azure, and GCP environments

💰 Commercial Model

Subscription-based pricing aligned to monitored IP space and cloud workloads. Custom quoting required.

⏰ When to Shortlist

Choose Vectra if your hunting stack is endpoint-heavy and you need NDR to cover network and identity blind spots. Vectra works alongside CrowdStrike, SentinelOne, and Microsoft Defender as a complementary detection layer.

11. Darktrace — ★★★ Best for Detecting Novel/Zero-Day Attacks via Unsupervised Machine Learning

📋 Overview

Darktrace uses unsupervised machine learning, its “Enterprise Immune System” approach, to learn what normal looks like in your environment and flag deviations, making it effective at detecting novel attacks that signature-based and supervised ML tools miss.

✅ Core Services

• Self-learning AI that models normal behavior without rules or signatures
• Antigena autonomous response: auto-contains threats in real-time
• Cyber AI Analyst: AI-generated investigation reports mimicking a human analyst’s workflow
• Coverage across email, cloud, network, OT/IoT, and endpoints
• Darktrace HEAL for incident readiness simulations

💰 Commercial Model

Subscription-based; pricing depends on the number of monitored devices and modules deployed. Enterprise pricing requires custom quoting.

⏰ When to Shortlist

Shortlist Darktrace if detecting novel, zero-day, and insider threats without pre-existing signatures is your priority, and you’re comfortable with an AI that learns from your environment rather than following predefined rules.

12. Cynet 360 AutoXDR — ★★ Best for SMBs Needing All-in-One Autonomous Breach Protection

📋 Overview

Cynet 360 AutoXDR combines endpoint detection, network analytics, UEBA, and deception technology (honeypots) into a single autonomous platform aimed at small to mid-size businesses that lack dedicated security teams.

✅ Core Services

• Deception technology: honeypots and honey users for attacker detection
• UEBA-driven behavioral analytics for insider threat detection
• Built-in SOAR: automated response playbooks without separate orchestration tools
• 24/7 CyOps MDR: included managed detection and response service
• Autonomous breach protection: end-to-end detection through remediation

💰 Commercial Model

Per-endpoint pricing; includes CyOps MDR at no additional cost.

⏰ When to Shortlist

Choose Cynet if you’re an SMB looking for consolidated XDR + SOAR + deception in one platform without the complexity of assembling a multi-vendor hunting stack.

13. Velociraptor — ★★★ Best for Forensic-Depth Endpoint Hunting for DFIR Teams

📋 Overview

Velociraptor is an open-source endpoint visibility and digital forensics tool that enables DFIR teams to perform deep forensic collection and hunting across endpoints using its custom VQL (Velociraptor Query Language).

✅ Core Services

• VQL (Velociraptor Query Language) for custom forensic collection and hunting queries
• Real-time endpoint monitoring and artifact collection
• Cross-platform support: Windows, Linux, macOS
• Community-contributed artifact exchange for shared hunting content
• Lightweight agent designed for deployment at scale

💰 Commercial Model

Free and open-source. Infrastructure costs for hosting the server and managing endpoints are self-funded.

⏰ When to Shortlist

Shortlist Velociraptor if your DFIR team needs forensic-grade endpoint hunting and you have the technical expertise to deploy and manage open-source infrastructure.

14. TheHive + Cortex — ★★★ Best for Incident Response Orchestration with Community-Driven Enrichment

📋 Overview

TheHive is an open-source Security Incident Response Platform (SIRP) that, paired with Cortex for automated analysis and enrichment, provides a SOAR-lite capability for threat hunting teams that need structured case management and automated IOC enrichment.

✅ Core Services

• Case management for structured hunting workflows and incident tracking
• Cortex analyzers: 100+ automated enrichment and analysis modules (VirusTotal, Shodan, MISP, etc.)
• MISP integration for threat intelligence sharing
• Collaborative investigation with multi-analyst support
• REST API for integration with SIEM, EDR, and ticketing systems (ServiceNow, Jira)

💰 Commercial Model

Free and open-source. Commercial support available through StrangeBee (TheHive Project).

⏰ When to Shortlist

Choose TheHive + Cortex if you need structured incident response workflows and automated IOC enrichment without paying for a full commercial SOAR platform.

15. YARA + Sigma Rules — ★★ Best for Detection-as-Code Compiling to Any SIEM Target

📋 Overview

YARA (for malware identification via pattern matching) and Sigma (for detection rule writing that compiles to any SIEM backend) together represent the open-source backbone of many threat hunting programs. They aren’t platforms. They’re the shared language that makes cross-tool hunting possible.

✅ Core Services

• YARA rules: pattern-based malware identification and classification
• Sigma rules: vendor-agnostic detection rules that compile to Splunk SPL, Elastic EQL, Microsoft KQL, QRadar AQL, and more
• Community-maintained rule repositories with thousands of detections mapped to MITRE ATT&CK
• Detection-as-code workflow: version-controlled, CI/CD-compatible detection engineering
• Cross-platform portability: write once, deploy to any supported SIEM/XDR backend

💰 Commercial Model

Free and open-source. No licensing costs. Infrastructure is your existing SIEM/XDR platform.

⏰ When to Shortlist

Every hunting team should be using Sigma and YARA regardless of what commercial platform they run. These aren’t alternatives to the other tools on this list. They’re the detection content layer that makes any platform more effective.

The Detection-to-Response Gap

Every tool on this list excels at some form of detection. But here’s what I’ve learned from a decade of building security operations: detection without response is expensive noise. An alert at 2 AM means nothing if someone still has to wake up, log in, triage for 45 minutes, and manually decide what to do.

Under Defence MAXI integrates with all 14 other tools listed here, layering the 24/7 human analyst response that turns alerts into contained incidents. Our documented 2-minute alert-to-triage and 15-minute escalation for critical incidents exists because the system that detects the threat also verifies it with the affected user and contains it. No escalation chain, no “please investigate” tickets back to your team.

“Underdefense is a great choice for teams like ours that are short on resources. It automates many tasks, plus, with 24/7 monitoring, we know we’re always protected. The platform seamlessly integrates our existing security tools, simplifying management. Plus, it’s incredibly easy to deploy. I used to work with many MDR solutions in the past, and so far Underdefense is the best one!”

— Inga M., CEO, Mid-Market UnderDefense G2 – Verified Review

Q2: How Were These Threat Hunting Tools Selected and Scored?

These 15 tools were evaluated using a 100-point weighted framework across five criteria, scored from vendor documentation, MITRE Engenuity ATT&CK Evaluations, G2/Gartner Peer Insights, published pricing data, and operational outcomes across 500+ SOC deployments. Here’s exactly how each criterion was weighted, and why.

✅ The Five Evaluation Criteria

Detection Depth & MITRE ATT&CK Coverage (25%) Tactic and technique breadth, analytic vs. telemetry-only detections, behavioral analytics maturity, and coverage across the full kill chain. Tools were scored against MITRE Engenuity Enterprise Evaluation results (2024–2025), where applicable, including whether detections triggered at the technique level or merely generated telemetry.

Query Language & Hunting Flexibility (20%) Power and expressiveness of the native query language (CQL, KQL, SPL, EQL, VQL, XQL), support for hypothesis-driven hunting workflows, custom rule creation, and community detection content availability. Tools with richer query ecosystems and Sigma/YARA compatibility scored higher.

Integration Ecosystem & Deployment (20%) Number of native integrations, vendor-agnostic vs. proprietary lock-in architecture, cloud/on-prem/hybrid deployment options, and SOAR compatibility. A tool that forces you to abandon existing investments scores lower than one that enhances what you already have.

Pricing Transparency & TCO (20%) Whether pricing is published or hidden behind “contact sales,” per-endpoint vs. per-GB models, free tiers for open-source tools, and hidden infrastructure costs. Transparent pricing signals confidence in value delivery.

User Reviews & Analyst Validation (15%) G2 aggregate ratings, Gartner Peer Insights scores, community maturity (for open-source tools), and real-world operational feedback from verified security practitioners.

⭐ Star Rating Scale

Score Range	Star Rating	Meaning
81–100	★★★★★	Exceptional across all criteria
61–80	★★★★	Strong in most areas with minor gaps
41–60	★★★	Solid in category-specific strengths
21–40	★★	Functional with significant limitations
0–20	★	Niche or experimental

📊 How the Top 5 Scored

Tool	Detection (25)	Query (20)	Integration (20)	Pricing (20)	Reviews (15)	Total	Stars
Under Defence MAXI	24	18	20	18	13	93	★★★★★
CrowdStrike Falcon XDR	24	18	14	12	12	80	★★★★
Microsoft Defender XDR	22	17	15	16	11	81	★★★★
Splunk ES	20	20	16	8	12	76	★★★★
Elastic Security	19	18	17	16	10	80	★★★★

🔍 Why This Methodology Matters

Most “best threat hunting tools” listicles rank by brand recognition or feature count, which tells you nothing about operational fitness. This framework surfaces tools that perform where it counts: detection depth you can verify against MITRE evaluations, pricing you can actually budget for, and integration flexibility that protects your existing investments. Under Defence MAXI scores ★★★★★ (93/100) because it combines 99% MITRE ATT&CK coverage with 250+ integrations and published $11–15/endpoint/month pricing, the only platform in this list where detection, response, and transparent cost all score above 90th percentile.

Q3: What Is Cyber Threat Hunting and Which Maturity Level Is Your SOC At?

Cyber threat hunting is the proactive, human-led search for threats that have evaded automated detection systems. It differs fundamentally from threat detection (automated/reactive alerting) and incident response (post-breach containment and recovery). Where your SIEM alerts on known-bad signatures, a threat hunter asks: “What if an attacker is already inside our environment and our tools haven’t flagged it yet?”

⚠️ Three Hunting Models

Security teams operate across three hunting approaches, each with different tool requirements:

Hypothesis-driven hunting Analysts start with a specific premise (“An attacker may be using RDP lateral movement with compromised credentials”) and search for evidence. Requires deep query languages like CQL, KQL, or SPL.

IOC-driven hunting Teams sweep environments for known indicators of compromise (file hashes, IP addresses, domains) using tools like YARA rules or threat intelligence feeds. Effective but purely reactive to already-known threats.

ML/Behavioral-driven hunting AI identifies anomalous patterns (unusual login times, abnormal data transfers, privilege escalation sequences) that signature-based systems miss. Tools like Darktrace, Vectra AI, and SentinelOne’s Purple AI operate here.

📊 The 4-Level SOC Maturity Model

The real bottleneck isn’t the tool, it’s operational maturity. Most SOCs buy hunting platforms but operate at Level 1–2, where they’re drowning in undifferentiated alert queues rather than conducting structured hunts.

Maturity Level	Description	Typical Tools	Staffing	Est. Annual Cost
Level 1: Reactive	Alert-based log review; no proactive hunting	YARA, OSSIM, basic SIEM	1–2 analysts	$80K–$150K
Level 2: Ad-Hoc	Occasional SIEM queries triggered by news or IOCs	Elastic Security, Defender XDR	2–4 analysts	$150K–$350K
Level 3: Structured	Dedicated hunters, formal hypotheses, documented hunts	CrowdStrike Falcon, Splunk ES, Velociraptor + TheHive	4–8 analysts	$350K–$750K
Level 4: Autonomous	AI-driven continuous hunting + human oversight	SentinelOne Purple AI, Darktrace + Under Defence MAXI orchestration	2–4 analysts + managed service	$150K–$300K (managed)

⏰ The Maturity Acceleration Problem

Here’s what breaks in practice: jumping from Level 1 to Level 3 requires 4–8 dedicated hunters earning $120K–$180K each, amid a 3.4 million global cybersecurity talent shortage. Most mid-market organizations stall at Level 2 because they can’t hire fast enough or retain analysts long enough (average SOC analyst tenure: 18 months before burnout).

✅ How UnderDefense Closes the Gap

UnderDefense accelerates SOC maturity from any level to Level 4 in 30 days, not by replacing your tools, but by adding the 24/7 analyst hunting team and AI orchestration layer that operationalizes whatever you already have. With 99% MITRE ATT&CK coverage across 250+ tool integrations, the Under Defence MAXI platform turns your existing Splunk, CrowdStrike, or Elastic deployment into a continuously hunted environment, at $11–15/endpoint/month instead of $750K+/year in staffing.

The gap between “tool deployed” and “threat contained” is where breaches happen. UnderDefense closes that gap, documented at 2 days faster than CrowdStrike OverWatch in head-to-head case studies, because AI-driven detection without human organizational context still leaves gaps that only analysts communicating directly with affected users can close.

“What we love most about UnderDefense is their proactive approach. Their experienced SOC engineers work closely with our team, providing continuous monitoring and threat detection. The seamless integration and optimization of the EDR platform, CrowdStrike, has been impressive. Despite the complexity involved, they delivered the deployment to 1,200 endpoints in just 23 business days.”

— Oleksii M., Mid-Market (51–1,000 emp.) Under Defence G2 – Verified Review

“UnderDefense MAXI integrates well with our systems, specifically with our SIEM, Splunk. Their team is proactive in identifying and addressing threats, providing 24/7 oversight. With UnderDefense MAXI, we’ve reduced security breaches. Their adherence to SLAs gives me confidence in our infrastructure’s protection. As the Information Security Director, it lets me focus on strategy, knowing the day-to-day security is managed effectively.”

— Oleg K., Director Information Security, Mid-Market Under Defence G2 – Verified Review

Q4: CrowdStrike Falcon vs. Microsoft Defender XDR: How Do the Top Platforms Compare for Advanced Hunting?

CrowdStrike Falcon and Microsoft Defender XDR dominate enterprise threat hunting through fundamentally different architectures: best-of-breed dedicated security platform vs. Microsoft 365 ecosystem bundled play. If you’re evaluating both, or wondering whether you need a managed layer on top of either, here’s how they compare across the dimensions that actually matter at 2 AM when something triggers.

🔍 Query Language Shootout

Detecting lateral movement via RDP looks different in each language:

CrowdStrike CQL:

#event_simpleName=UserLogon LogonType=10 | RemoteAddressIP4 != "127.0.0.1" | groupBy([aid, UserName, RemoteAddressIP4], function=count())

Microsoft KQL:

DeviceLogonEvents | where LogonType == "RemoteInteractive" | where RemoteIP != "127.0.0.1" | summarize count() by DeviceName, AccountName, RemoteIP

Splunk SPL:

index=wineventlog EventCode=4624 Logon_Type=10 | stats count by dest, user, src_ip

Elastic EQL:

authentication where event.type == "start" and winlog.logon.type == "RemoteInteractive" and source.ip != "127.0.0.1"

Each language has tradeoffs. CQL is tightly coupled to Falcon telemetry, powerful but locked to CrowdStrike’s data model. KQL is versatile across all Microsoft Defender tables but limited to a 30-day raw data window. SPL offers the most flexibility but requires significant expertise and carries high per-GB costs. EQL excels at sequence detection but depends on your Elastic cluster’s health.

📊 Head-to-Head Comparison

Dimension	CrowdStrike Falcon XDR	Microsoft Defender XDR	Under Defence MAXI
Query Language	CQL (proprietary)	KQL (Microsoft ecosystem)	Leverages CQL, KQL, SPL, EQL via analysts
Data Retention	90 days (Threat Graph)	30 days (raw); extended via Sentinel	Customer-owned SIEM (unlimited)
Managed Hunting	OverWatch ($184.99/device/yr)	Defender Experts (separate add-on)	Included ($11–15/endpoint/mo)
AI Assistant	Charlotte AI	Copilot for Security	MAXI AI + human analyst verification
Integration Breadth	Falcon-native + limited 3rd party	Microsoft ecosystem + Sentinel connectors	250+ vendor-agnostic integrations
Response Capability	Automated + OverWatch escalation	Automated + Defender Experts escalation	Full containment + ChatOps user verification
Pricing Transparency	Published (Falcon tiers)	Bundled with M365 E5 (~$57/user/mo)	Published ($11–15/endpoint/mo)

✅ When to Choose Each

Choose CrowdStrike if you’ve standardized on Falcon endpoints and want the deepest single-platform hunting with 90-day data retention. Charlotte AI lowers the barrier for junior analysts, and OverWatch provides elite managed hunting, but it’s endpoint-centric and detection stays within the CrowdStrike data model.

Choose Microsoft Defender XDR if your organization runs M365 E5 and wants cross-domain hunting (endpoint + identity + email + cloud apps) at no incremental licensing cost. The 30-day data window is a limitation for long-dwell investigations; pair with Sentinel for extended retention.

Layer UnderDefense on either if you need 24/7 human response, cross-stack correlation beyond either platform’s native telemetry, and containment that goes beyond “please investigate.” At $11–15/endpoint/month with published SLAs, UnderDefense adds the concierge analyst layer that turns either platform’s detections into contained incidents, with documented response times 2 days faster than CrowdStrike OverWatch.

“UnderDefense is surprisingly affordable considering the level of protection we get. Their proactive threat hunting and rapid response have saved us from incidents that could have been incredibly costly.”

— Verified User in Program Development, Mid-Market (51–1,000 emp.) Under Defence G2 – Verified Review

“It’s reassuring to know they’re always watching for threats, and it doesn’t cost a fortune. They catch and stop problems quickly, which is a huge relief. The platform works really well with our other security tools, which makes things much simpler.”

— Serhii B., Chief Information Security Officer, Mid-Market (51–1,000 emp.) Under Defence G2 – Verified Review

Q5: What Are the Best Hunting Stack Recipes and Should You Build, Buy, or Partner?

The Decision Most Teams Get Wrong

Three paths sit in front of every SOC leader assembling a threat hunting program: Build (assemble open-source tools yourself), Buy (license an enterprise platform), or Partner (engage a managed hunting service). Most organizations default to Buy without calculating the true total cost of ownership, which includes staffing, tuning, 24/7 coverage requirements, and the inevitable knowledge attrition when your one senior threat hunter leaves for a 30% raise.

The decision isn’t just technical. It’s operational. A $200K Splunk license is meaningless if nobody’s writing detection rules at 2 AM. A free OSSIM instance is worthless if your single analyst is on PTO when a Cobalt Strike beacon lights up.

⏰ Four Stack Recipes by Budget and Team Size

Here’s what actually works at each maturity level, with the gaps nobody puts in the brochure:

Recipe	Budget/Year	FTEs Required	Core Stack	Strength	Primary Gap
🔹 Recipe 1: Budget/SMB	$0–25K	0–1	Osquery + Sigma rules + TheHive + OSSIM	Zero licensing cost; community-driven detection rules	No 24/7 coverage; manual correlation; steep learning curve
🔹 Recipe 2: Mid-Market	$25K–150K	1–3	Microsoft Defender XDR + Elastic SIEM + Velociraptor	Strong M365 integration; flexible query language (KQL + EQL)	Limited non-Microsoft visibility; Elastic cluster management overhead
🔹 Recipe 3: Enterprise	$150K–500K+	3–8	CrowdStrike Falcon + Splunk ES + Cortex XDR	Deep EDR telemetry; mature threat intel; broad MITRE coverage	Extremely high TCO; vendor lock-in risk across three platforms
🔹 Recipe 4: Cloud-Native	Varies by consumption	2–5	AWS GuardDuty + Security Lake + Athena / Azure Sentinel + Defender / GCP Chronicle	Native cloud integration; consumption-based pricing	Blind to on-prem/hybrid; limited cross-cloud correlation

Each recipe has the same architectural gap: who responds at 2 AM when the tool finds something?

💰 Build vs. Buy vs. Partner Scoring

Score each path across six criteria that actually matter in production:

Criterion	Build (OSS)	Buy (Enterprise Platform)	Partner (Managed Hunting)
TCO (Licensing + Staffing)	Low license, high FTE ($250K–400K/yr in analyst salary + infra)	High license ($150K–500K+), still need FTEs	Predictable: $11–15/endpoint/month ✅
Time to First Hunt	3–6 months (setup, tuning, hiring)	1–3 months (deployment + PS)	30 days ✅
Detection Depth	Depends entirely on team skill	Platform-defined (strong but bounded)	96% ATT&CK coverage, continuously validated ✅
Response Capability	Manual, your team does everything	Detection + basic response; escalation back to you	Full containment + remediation included ✅
Scalability	Breaks at ~500 endpoints without dedicated infra team	Scales with licensing cost	Scales with endpoint count; no additional hires ✅
Knowledge Risk	Critical, one departure = program collapse	Moderate, platform survives, but tuning expertise leaves	Zero attrition risk, dedicated analyst team ✅

💸 Pricing and TCO Transparency

The per-endpoint and per-GB models across the market look like this:

• CrowdStrike Falcon Complete: ~$25–50/endpoint/month (contact sales)
• SentinelOne Complete: ~$20–45/endpoint/month (varies by tier)
• Splunk Enterprise Security: $150+/GB/day ingestion (on-prem) or cloud-tiered pricing
• Elastic Security: From $95/month (cloud); self-managed is “free” but infrastructure and FTE costs add $250K–400K/year
• Microsoft Defender XDR: Bundled with M365 E5 (~$57/user/month), strong value if already in the Microsoft ecosystem
• UnderDefense MDR: Published $11–15/endpoint/month, all-inclusive

Hidden costs most teams miss: professional services ($20K–100K for initial tuning), SIEM integration labor (1–2 FTE-months), and per-investigation analyst hours (15–45 minutes average per alert, multiplied across hundreds of weekly alerts).

✅ The Operational Gap Every Recipe Shares

Every recipe above covers the detection spectrum. The operational question every SOC leader faces remains the same: who hunts, verifies, and contains threats 24/7 when your tools surface findings? We built UnderDefense to layer on any stack as the managed response engine, turning detection into containment without escalating back to your team. Published pricing, 30-day deployment, zero additional FTEs, and zero knowledge attrition risk.

“We received little value from Arctic Wolf. The product offered little visibility when we were using it… Anything you want to look at or changes you need to make in the product must go through their engineering team.”

— Matt C., Manager, Cybersecurity Services Arctic Wolf – G2 Verified Review

“Solid detection and response capabilities, but overly relies on the client’s team for remediation, which really hurts the value of the service.”

— VP of Technology, Services Arctic Wolf – Gartner Verified Review

“Started out well but over the years the service has consistently not met expectations. The issues that we have experienced has greatly outweighed the benefits… Analysts provide little context, and when asked for more information in the investigation nothing is ever provided.”

— CISO, Manufacturing Arctic Wolf – Gartner Verified Review

Q6: How Are AI-Native Detection and MITRE ATT&CK Coverage Reshaping Threat Hunting in 2026?

AI-Native vs. AI-Assisted: The Taxonomy That Matters

The security market is drowning in AI claims right now, so let’s draw a clear line. AI-assisted means machine learning bolted onto an existing platform, including alert scoring, natural-language-to-query translation, or enrichment summaries layered on top of legacy detection engines. AI-native means a purpose-built reasoning engine that autonomously generates hypotheses, conducts multi-step investigations, and self-tunes detection logic without human prompting.

Here’s where the major platforms actually fall:

• CrowdStrike Charlotte AI: NL query interface over Falcon telemetry; accelerates analyst workflows but still requires human-initiated investigation. AI-assisted.
• SentinelOne Purple AI: Translates natural language into PowerQuery/Deep Visibility searches; automates notebook generation. AI-assisted with strong UX.
• Darktrace Self-Learning AI: Unsupervised ML modeling “normal” network behavior; autonomous response via Antigena. Closer to AI-native for network anomaly detection but generates significant false positives without tuning.
• Hunters.ai: Cloud-native SIEM with built-in detection logic and cross-source correlation. AI-native architecture for alert triage.

⚠️ The AI-Washing Problem

Adding a ChatGPT wrapper to a legacy SIEM console is not AI-native hunting. The test is simple: can the system autonomously generate a hunting hypothesis from raw telemetry, investigate across multiple data sources, and produce a verdict, without a human typing a query? If the answer is no, it’s AI-assisted at best and marketing at worst.

🔍 MITRE ATT&CK Coverage: How to Actually Evaluate Vendor Claims

Every vendor claims “broad MITRE ATT&CK coverage.” Here’s how to verify those claims instead of taking a marketing PDF at face value:

• Request Navigator layer files, ask for the actual ATT&CK Navigator JSON export showing technique-level coverage, not a slide deck
• Cross-reference with MITRE Engenuity Evaluations, the only independent, reproducible test of detection capabilities
• Check all 14 tactics, most vendors score well on Initial Access and Execution but leave gaps in Lateral Movement, Collection, and Exfiltration, which are where attackers actually dwell

Platform	Initial Access	Execution	Persistence	Priv. Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	C2	Exfiltration	Impact
CrowdStrike Falcon	High	High	High	High	High	High	Medium	Medium	Medium	High	Medium	High
Microsoft Defender XDR	High	High	High	High	Medium	High	High	Medium	Medium	Medium	Low	Medium
SentinelOne	High	High	High	High	Medium	Medium	Medium	Low	Low	High	Low	Medium
Elastic Security	Medium	High	Medium	Medium	Medium	Medium	High	Medium	Medium	Medium	Medium	Low
Palo Alto Cortex XDR	High	High	High	High	High	Medium	Medium	Medium	Medium	High	Medium	High
Under Defence MAXI	High	High	High	High	High	High	High	High	High	High	High	High

🔗 Automation and SOAR Integration

The hunting stack doesn’t exist in a vacuum. Detection findings need to flow into response workflows. Key integration points:

• SOAR platforms: Cortex XSOAR, Splunk SOAR, and TheHive all accept hunting output as incident triggers, but require playbook development and maintenance (1–2 FTE-months for initial build)
• Ticketing integration: ServiceNow and Jira connectors exist for most platforms, but mapping severity → priority → SLA requires operational design, not just API configuration
• Deployment models: Cloud-only (Hunters.ai, Microsoft Sentinel), hybrid (Elastic, Splunk), on-prem (Splunk ES legacy), and managed (UnderDefense) each impose different staffing and network architecture requirements

✅ How UnderDefense Approaches AI-Native Hunting

We maintain 96% MITRE ATT&CK coverage across all 14 tactics, validated via continuous red team testing, not annual self-assessment. Under Defence MAXI combines AI-native triage (99% of alerts resolved autonomously) with human-native judgment (concierge analysts for the 1% that matters). That’s the operational definition of Level 4 autonomous hunting with human oversight: the system reasons across your full telemetry stack, but a dedicated analyst verifies and contains the threats that require organizational context, like confirming whether that 3 AM VPN login from Romania is your developer on vacation or a compromised credential.

Q7: Ready to Operationalize Your Threat Hunting Stack with Expert-Led MDR?

The 15 tools covered in this article span the full detection spectrum, from free open-source Osquery deployments to enterprise-grade CrowdStrike Falcon + Splunk stacks. But the operational question every SOC leader faces is identical: who hunts, verifies, and contains threats 24/7 when your tools surface findings? The answer determines whether you’ve built a hunting program or just bought more dashboards.

The Decision Isn’t Which Tool. It’s Which Model

The evaluation criteria that separate managed hunting from expensive alerting: ✅ Vendor-agnostic integration, works with your existing stack (CrowdStrike, Splunk, Microsoft, Elastic, or open-source), not forcing proprietary replacement

✅ Human analyst access, direct Tier 3–4 communication, not ticket-based escalation queues

✅ Published response SLAs, documented 2-minute alert-to-triage and 15-minute escalation for critical incidents (UnderDefense: 0.5 hours for critical incidents), not marketing claims

✅ Pricing transparency, per-endpoint published rates ($11–15/endpoint/month), not “contact sales”

✅ Compliance automation included, forever-free compliance kits bundled, not a separate add-on requiring another vendor

🔗 How UnderDefense Layers on Any Stack

UnderDefense layers managed threat hunting and concierge response on top of any stack recipe covered in this article, including CrowdStrike, Microsoft, Splunk, Elastic, or open-source. Calculate your exact SOC cost savings and see how Under Defence MAXI operationalizes your existing investments.

📌 Credibility Anchor

This analysis is based on MITRE Engenuity ATT&CK Evaluations, G2 Spring 2025 rankings (12 badges including Best Support), documented case studies (detected threats 2 days faster than CrowdStrike OverWatch), and operational outcomes across 500+ MDR deployments with a 100% ransomware prevention record.