All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Founded in 2018, Hunters sells small security teams a SIEM called Hunters SOC Platform, which collects security data and detects attacks in it. Hunters' Team Axon researchers write and tune the platform's detection rules, so customers need not write their own. The platform runs an automated investigation on every alert. Customers can also buy threat hunting, in which Team Axon searches their systems for threats other tools may not have detected. In January 2022, Hunters raised a $68 million Series C led by Stripes, for a total of $118 million. CB Insights lists it as Hunters' latest round. Hunters' named customers include Booking.com, Snowflake, Netgear, Cimpress, Pennymac, and Unzer. A customer that leaves Hunters must replace Team Axon's detection work as well as the software.
| Description | Hunters sells a SIEM built for small security teams. Its in-house Team Axon research group builds, manages, and tunes the platform's pre-built detections across identity, endpoint, cloud, and user-behavior telemetry, and the platform automates alert triage and investigation. | [f1] |
|---|---|---|
| Founded | 2018 | [f2] |
| HQ | Tel Aviv, Israel | [f3] |
| Funding | $118M total | [f4] |
| Latest funding | Series C, $68 million led by Stripes (January 2022) | [f2] |
| Product | What it does |
|---|---|
| Hunters SOC Platform | Next-gen SIEM with an open OCSF security data lake, always-on detections built and tuned by Team Axon, and AI-powered automated triage, investigation, and response. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
Hunters SOC Platform runs pre-built detections and automated investigation across the identity, endpoint, cloud, and user-behavior telemetry it ingests, which earns detect on those assets. The platform is mapped to the Cyber Defense Matrix. [f1]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Hunters names a specific buyer, small security teams expected to deliver a large SOC's outcomes, and states the pain as noisy alerts and slow manual investigations. The relief it quantifies, 80% less alert triage and 90% less excessive alerting, is Hunters' own figure. No captured independent source measures the pain at the scale Hunters describes. [s2, s16, s22] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | Hunters publishes documentation and dated release notes that describe its auto-investigation process, detector logic, enrichments, and scoring layers, which is concrete detail beyond marketing pages. The external points available are anonymous Gartner Peer Insights ratings and customer statements on Hunters' own pages. In the cited ratings and testimonials, reviewers and customers do not describe testing how Hunters' detections work. [s2, s13, s14, s22] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | The enabler is AI that investigates alerts on its own, which Hunters announced as Pathfinder AI in March 2025. The buyer-side demand in the captured sources is one kind of signal, verified Gartner Peer Insights reviews, including one dated April 7, 2026. One kind of buyer signal makes the timing plausible without corroborating it across several kinds. [s7, s8, s9, s22] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Uri May and Tomer Kazaz founded Hunters in 2018, and Hunters now lists Ian Forrest, its earlier VP of Product, as CEO with May as founder. The company runs a named research group, Team Axon, which is verifiable in-domain experience. The captured sources document no prior exit or independent recognition of its leaders. [s20, s6, s8, s3] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 | Hunters names multiple reference customers on its own pages, including Pennymac, Unzer, Cimpress, Spotnana, and ChargePoint. Press coverage in 2022 relays Booking, Snowflake, Netgear, and Cimpress as customers in the company's own claims. Gartner Peer Insights carries 41 buyer ratings, and Hunters sells the platform through AWS Marketplace. [s1, s5, s16, s17, s18, s22, s15] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | Hunters raised $118 million through a January 2022 Series C, and CB Insights lists that Series C as its latest round (s16, s17, s21). Hunters still ships, with release notes dated June 2026 (s14). For 2021 its CEO reported fivefold revenue growth and its lead investor more than fourfold annual recurring revenue growth (s19, s20). No absolute revenue, margin or later figure appears in the cited sources. The raise is broadly proportional to an enterprise SIEM motion, and its efficiency is unconfirmed. [s16, s17, s21, s14, s19, s20] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | Hunters fits the established SIEM category, and parties other than Hunters place it there. Gartner Peer Insights lists Hunters SOC Platform under Security Information and Event Management with 41 ratings. A reviewer there calls it a next-gen SIEM for small to mid organizations, and CB Insights describes Hunters as a SIEM provider. [s22, s21, s2, s15] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Hunters runs as the customer's SIEM from ingestion to response. Pennymac's CISO says Hunters handles the team's detection engineering, so absorbing the account means replacing that working practice. An incumbent could reproduce Hunters' detection engineering with its own analysts. The customer can keep its data in its own Snowflake account on the open OCSF schema. Gartner Peer Insights also lists Splunk Enterprise and Microsoft Sentinel as alternatives. [s1, s2, s13, s22] |
Hunters sells to small security teams that are expected to deliver a large SOC's outcomes. Its product page describes teams drowning in noisy alerts and false positives, with investigations that stay lengthy and manual.
Hunters quantifies the relief in its own figures. It says the platform reduces alert triage by 80% and excessive alerting by 90%. Co-founder Uri May framed the opportunity in 2022 as a SIEM market worth $4.3 billion. No captured independent source measures the two reduction percentages.
A buyer review frames the problem in the same terms Hunters uses. A Gartner Peer Insights reviewer in April 2026 described Hunters as a SOC for small to medium companies, built around AI-based automation. [s2, s16, s22]
Hunters SOC Platform combines a security data lake, pre-built detections, and automated investigation in one product. Team Axon, Hunters' research group, builds, manages, and tunes detections across user and entity behavior, identity, endpoint, and cloud telemetry. Hunters says customers can skip the burden of detection engineering.
Hunters builds the platform around automated investigation. Its documentation describes an auto-investigation process that enriches each lead with entities, attributes, enrichments, and a risk score. Pathfinder AI, announced in March 2025, adds Copilot AI for guided analysis and Agentic AI for autonomous detection, investigation, and response.
Hunters keeps the data layer open to the customer. A customer can bring its own security data lake or let Hunters manage one, with all data standardized to the open OCSF schema. Hunters says in its documentation that connecting a customer's Snowflake account gives the customer ownership over its data.
Hunters publishes release notes for its detection changes. Its June 2026 notes describe a new anomalous-login detector that replaces several legacy detectors whose accuracy had declined. [s1, s2, s3, s8, s13, s14]
Hunters competes for the SIEM budget of small security teams. It sells the platform on AWS Marketplace as a SIEM alternative. Gartner Peer Insights lists Splunk Enterprise and Microsoft Sentinel among the alternatives to Hunters SOC Platform.
Hunters argues that its AI investigates where many rival tools only assist. Its agentic AI blog describes many AI tools in cybersecurity as co-pilots that summarize alerts and translate queries. It presents Hunters' agents as running investigations on their own.
Hunters pairs the software with human detection work. Team Axon builds and tunes the detections every customer runs, and Hunters sells Team Axon's threat hunting and incident investigation as an additional service. A rival that matches the automated investigation would still need its own analysts to match that service. [s2, s9, s15, s22, s3]
Hunters names a broad set of customers on its own pages. Hunters publishes case studies on its customers page with Unzer, Spotnana, Cimpress, and ChargePoint. Its homepage quotes Pennymac's CISO saying Hunters handles the team's detection engineering.
Press coverage in 2022 relayed an earlier customer list. SiliconANGLE named Booking, Snowflake, Netgear, and Cimpress among Hunters' customers, while SecurityWeek attributed a similar list to Hunters' own claims. TechCrunch reported in 2020 that Snowflake was Hunters' first customer and design partner.
Hunters sells through partners as well as directly. It lists the platform on AWS Marketplace and offers MSSPs a multi-tenant version for their MDR services. In 2023, Hunters announced a partnership under which Kudelski Security was to integrate the platform into its Cyber Fusion Center.
Gartner Peer Insights carries dated buyer reviews of the product. It lists Hunters SOC Platform with 41 ratings averaging 4.4, including a review dated April 7, 2026. [s1, s5, s16, s17, s18, s12, s7, s15, s22]
Hunters has changed chief executives since its last funding round. Co-founder Uri May led the company as chief executive in 2022, and Hunters' about page now lists Ian Forrest as CEO with May as founder. Forrest appears as VP of Product on Hunters' Pathfinder AI page, and the captured sources do not date the change.
Uri May and Tomer Kazaz founded Hunters in 2018, according to CTech. The company runs a named research group, Team Axon, which researches new threats, investigates customer environments, and builds the detections the platform runs.
The captured sources document no prior exit by the founders and no independent recognition of the leadership team. [s6, s8, s16, s20, s3]
Hunters reports two commercial attestations on its compliance page. It says a Deloitte audit found Hunters compliant with SOC 2 Type II for security and confidentiality, with the report shared under a non-disclosure agreement. It also publishes an ISO/IEC 27001:2013 certificate issued to Cyber Hunters Ltd. in Tel Aviv.
Hunters lets customers keep custody of their security data. It says in its documentation that a customer that connects its own Snowflake account keeps ownership over its data. [s4, s13]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Panther | competes with | Competes with Hunters for the same SIEM budget. | |
| Splunk | competes with | Gartner Peer Insights lists Splunk Enterprise as an alternative to Hunters SOC Platform. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Sumo Logic | competes with | Competes with Hunters for the same SIEM budget. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Exabeam | competes with | Competes with Hunters for the same SIEM budget. | |
| Elastic | competes with | Competes with Hunters for the same SIEM and security analytics budget. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Dropzone AI | competes with | Competes with Hunters for the automated alert investigation work Hunters markets to small security teams. |
Add analyzed competitors to compare them side by side with Hunters.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Team Axon builds and tunes the detections every customer runs and sells investigation and threat hunting as an added service. A customer that leaves has to replace that work as well as the software. Hunters also keeps a library of detections and more than 200 researcher-built investigation tools that it extends to all customers. A customer can keep its security data in its own Snowflake account on an open schema. That analyst work matters most to a small team that wants Hunters to handle its detection work.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Hunters sells a SOC platform that investigates alerts and lets the customer’s analysts respond with one click (s2). Team Axon builds and tunes the platform’s detections (s1). Hunters sells threat hunting and incident investigation as an optional add-on to the platform (s3). The customer’s team operates the platform and owns the response, so the software is the product. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Leaving Hunters means migrating a working SIEM, its detections, and the team's investigation workflow, which is meaningful friction. The cited record documents that switching mechanism without sizing the migration. The customer can keep its data in its own Snowflake account on the open OCSF schema. The captured sources document no non-portable state that makes leaving expensive. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | Hunters reports SOC 2 Type II and an ISO/IEC 27001 certificate. A funded competitor can obtain those attestations through ordinary enterprise preparation, so they do not block a replacement. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Hunters correlates telemetry across sources with machine learning, behavioral baselines, and scoring models, and Team Axon keeps detections tuned against new threats. That combination of real-time detection engineering and data work takes years of specialized expertise to build. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Hunters has sold to financial-services buyers. On its customers page, Hunters files an Unzer case study under financial services and lists bunq among its customer logos (s5). CB Insights describes bunq as a digital bank (s21). Hunters builds the platform for small security teams (s2), but under policy 1.0.0 evidenced regulated financial-services buyers meet rung 3. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Hunters SOC Platform is a platform with application features. It ingests telemetry from other security tools and analysts work inside it, while no captured source shows other applications' requests passing through it to proceed. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | Hunters' evidenced asset is retained detection and investigation content. Team Axon researches new threats and adds detection methods to the platform for all customers, and Hunters says its agents rely on a library of over 200 researcher-developed investigation tools. Hunters publishes descriptions of new detectors and some hunting tools. The full library does not appear in the cited public sources. A rival could rebuild Hunters' accumulated detection and investigation content with time and effort. |
Hunters builds and sells its platform for small security teams. Hunters leads its product page with a next-gen SIEM for small security teams. A Gartner Peer Insights reviewer described it as a SOC for small to medium companies.
Hunters' named customers include enterprise and financial-services organizations. Pennymac's CISO is quoted on Hunters' homepage, Unzer appears in a financial-services case study, and 2022 press listed Fortune 500 customers including Booking and Cimpress. Hunters' customers page describes a range from budding startups to Fortune 500 leaders.
MSSPs form a second segment. Hunters offers MSSPs a multi-tenant version of the platform for running MDR services across their own customers.
Hunters' differentiation is detection content that its own team writes and tunes for the customer. Team Axon builds, manages, and tunes pre-built detections across UEBA, identity, endpoint, and cloud. When a new threat emerges, Team Axon adds detection methods to the platform for all Hunters customers.
The platform's AI automates triage and investigation. Hunters says the platform investigates every alert and cuts alert triage by 80%. Pathfinder AI adds Copilot AI for guided analysis and Agentic AI for autonomous detection, investigation, and response.
Hunters shares detection logic across customers and tunes it on each customer's own data. Hunters writes in its agentic AI post that each rule has to work across hundreds of environments, and that its agents rely on a library of over 200 researcher-developed investigation tools. It adds that detection logic self-optimizes on signals from each customer's infrastructure. That reach across many environments is a latent path to cross-customer tuning benchmarks, which the captured sources do not show Hunters using.
Hunters sells the platform directly, through AWS Marketplace, and through partners. Its partners page describes work with distributors, system integrators, and resellers, and its MSSP program offers multi-tenant management.
Two strategic investors added distribution support at the Series C. Hunters wrote in 2022 that Cisco Investments and Databricks offer support around joint marketing, sales, product, and security research.
Hunters sells Team Axon as a separate service. The Team Axon page describes it as an additional service purchased with the platform to add threat hunting expertise to the customer's own team.
Hunters publishes a contract price on AWS Marketplace. There, Hunters lists a 12-month contract for Hunters SOC Platform at $250,000, which entitles the buyer to a specified quantity of use for the contract term.
Hunters prices Team Axon on its own. Customers can buy Team Axon as an additional service with the platform to add threat hunting expertise to their own team.
Hunters delivers the platform as a service and promises fast deployment. Hunters says on its product page that the platform deploys in days without professional services.
Hunters takes on ongoing detection upkeep. Team Axon tests and refines the built-in detections, and Hunters' June 2026 release notes record a new anomalous-login detector replacing legacy ones whose accuracy had declined.
Customers choose where to keep their data. They can bring their own security data lake or let Hunters manage one. Hunters says on its MSSP page that the lake architecture is built on Snowflake.
Hunters reports two commercial attestations on its compliance page. It says a Deloitte audit found Hunters compliant with SOC 2 Type II for security and confidentiality, with the report shared under a non-disclosure agreement. It also publishes an ISO/IEC 27001:2013 certificate issued to Cyber Hunters Ltd. in Tel Aviv.
Hunters lets customers keep custody of their security data. It says in its documentation that a customer that connects its own Snowflake account keeps ownership over its data.
Hunters positions the platform as a layer over the customer's existing security tools. It ingests data across the stack and correlates data sources to identify attacks that could be missed in isolation.
Hunters' central ecosystem commitment is OCSF, an open schema for security data. Hunters announced full OCSF adoption and OCSF-native search in May 2024, and it standardizes all ingested data to OCSF.
Hunters is an application that other tools feed. Security tools send it telemetry and analysts work inside it, while no captured source shows other applications depending on it to run.
Hunters has changed chief executives since its last funding round. Co-founder Uri May led the company as chief executive in 2022, and Hunters' about page now lists Ian Forrest as CEO with May as founder. Forrest appears as VP of Product on Hunters' Pathfinder AI page, and the captured sources do not date the change.
Uri May and Tomer Kazaz founded Hunters in 2018, according to CTech. The company runs a named research group, Team Axon, which researches new threats, investigates customer environments, and builds the detections the platform runs.
The captured sources document no prior exit by the founders and no independent recognition of the leadership team.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Hunters: homepage | official | 2026-10-13 |
| f2 | SiliconANGLE: Security operations center startup Hunters raises $68M | press | 2026-10-13 |
| f3 | CB Insights: Hunters company profile | research | 2026-10-13 |
| f4 | SecurityWeek: Hunters Raises $68 Million for Its SecOps Platform | press | 2026-10-13 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.