Autonomous Threat Operations: A New Era in Cybersecurity
SAN FRANCISCO, March 24, 2026 – Recorded Future is reporting significant growth in the adoption of Autonomous Threat Operations (ATO), a capability designed to proactively detect and eradicate cyber threats. This shift represents a fundamental change in how organizations approach cybersecurity, moving from reactive incident response to continuous, intelligence-driven threat hunting.
In the first month of general availability, users of ATO have expanded their threat-hunting programs, deterring and defeating adversaries without increasing the workload on security analysts. According to a global biotechnology company, ATO “has become a core part of how we approach modern threat intelligence,” significantly reducing manual effort and allowing analysts to focus on strategic tasks.
From Reactive to Proactive: The Evolution of Threat Hunting
Traditionally, cybersecurity teams have relied on alerts and periodic investigations. ATO changes this paradigm by enabling continuous and systematic threat hunting across an organization’s entire environment. This transforms threat hunting from a periodic, analyst-driven exercise into a continuous, intelligence-driven discipline.
Jamie Zajac, Chief Product Officer at Recorded Future, emphasizes that whereas best-of-breed security stacks have raised the bar for attackers, “autonomous threat hunting with high-fidelity intelligence sets a new benchmark for proactive defense.” Zajac notes that only one in five Security Operations Centers (SOCs) conduct regular threat hunts, and most organizations hunt for adversaries less frequently than the threat landscape demands. ATO aims to reverse this trend.
Automation as a Key Differentiator
A threat intelligence lead at a Global Financial Institution highlighted the importance of automation, stating, “We have really high confidence in Recorded Future — enough confidence to automate. That’s Recorded Future’s big advantage: automation.”
ATO is particularly effective against modern intrusions that rely on techniques designed to evade traditional security alerts, such as living-off-the-land tactics, credential misuse, slow lateral movement, and stealthy persistence. Proactive threat hunting, facilitated by ATO, is often crucial for identifying these sophisticated attacks.
How ATO Works
ATO translates Recorded Future’s threat intelligence into structured hunting hypotheses and detection logic, which are then executed automatically and continuously. This allows security teams to detect and defend at scale, focusing their efforts on investigating the most critical threats.
According to Colin Mahony, CEO of Recorded Future, “Defending isn’t enough — we all necessitate to be hunters now. Threat hunting is the most effective way to uncover sophisticated adversaries, but it has always been the most resource-intensive. Not anymore — Autonomous Threat Operations puts the threat intelligence teams on offense, detecting and defeating adversaries across the entire enterprise.”
Kevin Mata, Director of Cloud Operations at Swimlane, shared a practical example of ATO’s benefits: “We were spending hours looking up IPs and blocking them. Now Recorded Future does it automatically, and our analysts get their time back.”
Mastercard and Recorded Future: A Unified Approach
Recorded Future, acquired by Mastercard in 2024, is collaborating with Mastercard to deliver a unified, intelligence-led approach to securing the digital economy. ATO, combined with Recorded Future’s licensing and solutions for Cyber Operations, Digital Risk, Third Party, and Payment Fraud intelligence, aims to empower the entire security team to participate in autonomous defense.
Learn more about Autonomous Threat Operations at www.recordedfuture.com/products/autonomous-threat-operations.
About Recorded Future
Recorded Future serves over 1,900 businesses and government organizations in 80 countries, providing comprehensive threat intelligence through its Intelligence Graph®, which contains over 200 billion nodes of specialized threat data. The company’s platform combines AI-driven analytics with autonomous capabilities to transform threat intelligence limitations into Intelligence Operations that automatically operationalize threats across security ecosystems.
Media Contact: media@recordedfuture.com