On the eve of RSA 2026, Recorded Future highlighted a significant milestone as the adoption of its Autonomous Threat Operations (ATO) rapidly gained traction across global enterprises. This innovative capability is transforming how cybersecurity teams operate by equipping defenders with advanced tools to proactively detect and eliminate threats. More importantly, it converts real-time threat intelligence into continuous and automated threat-hunting processes across diverse and complex environments.
Since its general availability, ATO has already begun reshaping modern security operations. Organizations adopting the platform have significantly expanded their threat-hunting capabilities while maintaining the same level of analyst workload. As a result, teams can now identify and respond to more threats without increasing operational strain.
“Autonomous Threat Operations (ATO) has become a core part of how we approach modern threat intelligence,” according to a global biotechnology company. “By bringing relevant intelligence together and turning it into actionable outcomes, [ATO] has significantly reduced manual effort. Analysts spend more time focusing on what matters most, [helping] us move faster and work more proactively.”
As cyber threats continue to evolve alongside advancements in smart technologies, organizations are shifting from reactive to proactive defense strategies. Previously, security teams relied heavily on alerts and scheduled investigations. However, with ATO, they now conduct continuous and systematic threat hunting, enabling faster detection and autonomous mitigation of adversarial activities. Consequently, threat hunting is no longer a periodic task but an ongoing, intelligence-driven discipline.
“Best-of-breed tech stacks have raised the bar for adversaries, but autonomous threat hunting with high-fidelity intelligence sets a new benchmark for proactive defense,” said Jamie Zajac, Recorded Future Chief Product Officer. “Only 1-in-5 SOCs conduct regular threat hunts. Most organizations are hunting adversaries far less often than the threat demands. Autonomous Threat Operations reverses that equation.”
Furthermore, automation has become a key differentiator. Organizations now trust Recorded Future enough to automate critical processes, which significantly enhances operational efficiency.
“We have really high confidence in Recorded Future — enough confidence to automate. That’s Recorded Future’s big advantage: automation,” added the threat intelligence lead at a Global Financial Institution.
Additionally, emerging threats such as those from Iran-linked actor GreenGolf highlight the need for proactive hunting. These attackers often use stealthy techniques like credential misuse, lateral movement, and persistence mechanisms that evade traditional detection systems. Therefore, proactive threat hunting becomes essential for uncovering such sophisticated intrusions.
ATO addresses this challenge by transforming intelligence into structured hunting hypotheses and detection logic, which run continuously and automatically. This allows security teams to scale operations efficiently and focus on high-priority threats.
“Defending isn’t enough — we all need to be hunters now,” said Colin Mahony, CEO of Recorded Future. “Threat hunting is the most effective way to uncover sophisticated adversaries, but it has always been the most resource-intensive. Not anymore — Autonomous Threat Operations puts the threat intelligence teams on offense, detecting and defeating adversaries across the entire enterprise. Recorded Future ATO users can dominate, searching relentlessly for signs of attacker activity and taking action.”
Moreover, automation significantly reduces manual tasks for analysts, freeing up valuable time for strategic initiatives.
“We were spending hours looking up IPs and blocking them. Now Recorded Future does it automatically, and our analysts get their time back,” said Kevin Mata, Director of Cloud Operations at Swimlane.
In collaboration with Mastercard, Recorded Future is also driving an intelligence-led approach to securing the digital economy. By combining ATO with expanded and simplified cybersecurity solutions, organizations can adopt a unified and scalable defense strategy. Ultimately, this marks a major step toward a fully autonomous cybersecurity future.
Recommended Cyber Technology News:
- Zenity Launches Continuous Security for Enterprise AI Agents
- BeyondID and Nexera Partner to Secure Enterprise AI Adoption
- CrowdStrike Expands Falcon Next-Gen SIEM With Microsoft Defender Integration
To participate in our interviews, please write to our CyberTech Media Room at info@intentamplify.com
