Threat Hunting Revolution Accelerates with Rapid Adoption of Recorded Future's Autonomous Threat Operations (ATO)

ATO Users Detect and Eradicate Adversaries with Autonomous Intelligence-Driven Threat Hunting

SAN FRANCISCO, March 24, 2026 /PRNewswire/ -- On the eve of RSA 2026, Recorded Future reported strong growth in the adoption of Autonomous Threat Operations (ATO), a revolutionary capability that gives defenders the tools they need to detect and eradicate adversaries in the cyber domain, turning real-time threat intelligence into continuous threat hunts across heterogeneous environments.

In the first month of general availability, Recorded Future's ATO users have radically expanded their threat-hunting programs to deter and defeat adversaries stalking their networks. Early adopters have exponentially increased the number of threats hunted without increasing analyst workload.

"Autonomous Threat Operations (ATO) has become a core part of how we approach modern threat intelligence," according to a global biotechnology company. "By bringing relevant intelligence together and turning it into actionable outcomes, [ATO] has significantly reduced manual effort. Analysts spend more time focusing on what matters most, [helping] us move faster and work more proactively."  

As smart systems change the way battles are fought in both physical and cyber space, ATO embodies this shift for cybersecurity teams, who now use Recorded Future to defend proactively. Until now, operators relied on alerts and periodic investigations; now, Recorded Future customers are continuously and systematically hunting across their environments to detect and autonomously eradicate adversary activity, pushing threat hunting from a periodic, analyst-driven exercise to a continuous, intelligence-driven discipline.

"Best-of-breed tech stacks have raised the bar for adversaries, but autonomous threat hunting with high-fidelity intelligence sets a new benchmark for proactive defense," said Jamie Zajac, Recorded Future Chief Product Officer. "Only 1-in-5 SOCs conduct regular threat hunts. Most organizations are hunting adversaries far less often than the threat demands. Autonomous Threat Operations reverses that equation." 

"We have really high confidence in Recorded Future — enough confidence to automate. That's Recorded Future's big advantage: automation," added the threat intelligence lead at a Global Financial Institution.

Iran-linked threat actor GreenGolf starkly illustrates the risk: modern intrusions often rely on behaviors that evade traditional security alerts, including living-off-the-land techniques, credential misuse, slow lateral movement, and stealthy persistence. Serious intrusions are often identified through proactive threat hunting rather than automated alerts. 

ATO translates Recorded Future's threat intelligence into structured hunting hypotheses and detection logic, executed automatically and continuously. This allows security teams to detect and defend at scale, focusing their efforts on investigating strategic threats.

"Defending isn't enough — we all need to be hunters now," said Colin Mahony, CEO of Recorded Future. "Threat hunting is the most effective way to uncover sophisticated adversaries, but it has always been the most resource-intensive. Not anymore — Autonomous Threat Operations puts the threat intelligence teams on offense, detecting and defeating adversaries across the entire enterprise. Recorded Future ATO users can dominate, searching relentlessly for signs of attacker activity and taking action."

"We were spending hours looking up IPs and blocking them. Now Recorded Future does it automatically, and our analysts get their time back," said Kevin Mata, Director of Cloud Operations at Swimlane.

Working together, Mastercard and Recorded Future are bringing a unified, intelligence-led approach to securing the digital economy. With ATO, Recorded Future takes the fight to adversaries by putting intelligence to work at scale. When combined with Recorded Future's new, expansive, and simplified licensing and customer-friendly solutions for Cyber Operations, Digital Risk, Third Party, and Payment Fraud intelligence, the entire security team can join the autonomous defense revolution.   

Get in the fight at www.recordedfuture.com/products/autonomous-threat-operations 

About Recorded Future

Recorded Future is the world's largest threat intelligence company, serving over 1,900 businesses and government organizations across 80 countries. The Recorded Future platform provides the most complete coverage of adversaries, infrastructure, and targets through the Intelligence Graph^®, which contains 200+ billion nodes of specialized threat data. By combining precise, AI-driven analytics with breakthrough autonomous capabilities, Recorded Future enables organizations to transform from manual threat intelligence limitations to Intelligence Operations that automatically operationalize threats across entire security ecosystems. 

Recorded Future was acquired by Mastercard (NYSE: MA) in 2024. Headquartered in Boston with offices around the world, Recorded Future continues to lead the evolution from traditional threat intelligence to automated risk mitigation.

Media Contact
[email protected]

SOURCE Recorded Future