Endpoint & Threat Security
Threat Intelligence software
Feeds and platforms that collect, enrich and operationalise intelligence about attackers, indicators and campaigns.
- Vendors to know
- 10
- Reviews
- 0
- Comparisons
- 0
- Guides and articles
- 0
Threat Intelligence vendors to know
Established leaders, challengers, newer entrants and the tools practitioners recommend to each other. Being listed is not a ranking or an endorsement, and no vendor paid to appear.
- Established leader
Recorded Future Intelligence Cloud
Recorded Future (Mastercard)
Aggregates technical, OSINT, dark web and geopolitical data at scale with machine learning; named a Leader in Gartner's inaugural 2026 Magic Quadrant for Cyberthreat Intelligence Technologies.
- Established leader
Google Threat Intelligence
Google (Mandiant)
Combines Mandiant incident-response intelligence with Google's global visibility; named a Leader in the 2026 Gartner Magic Quadrant for Cyberthreat Intelligence Technologies.
- Established leader
CrowdStrike Falcon Intelligence
Threat intelligence integrated with the Falcon platform; named a Leader in the inaugural 2026 Gartner Magic Quadrant, positioned furthest for Completeness of Vision.
- Established leader
Group-IB Threat Intelligence
Named a Leader in the 2026 Gartner Magic Quadrant for Cyberthreat Intelligence Technologies; now sold directly through AWS Marketplace as of August 2026.
- Challenger
Cyble Vision
AI-native platform monitoring surface, deep and dark web; named a Challenger in the 2026 Gartner Magic Quadrant and ranked
- Challenger
Flashpoint Ignite
Largest privately held threat intelligence provider, distinguished by human-collected access to closed criminal forums and encrypted channels; a Gartner MQ Challenger.
- Challenger
Anomali ThreatStream
Ingests and normalizes feeds from hundreds of commercial, open-source and government sources, correlating them against an organization's own telemetry.
- Emerging
Dataminr
Real-time AI-driven event and threat intelligence platform that absorbed ThreatConnect's capabilities after acquiring it in November 2025.
- Community favourite
Feedly for Threat Intelligence
AI-powered OSINT feed aggregator that extracts TTPs, CVEs, malware and IoCs from security publications; widely praised by practitioners for ease of use.
- Community favourite
Falcon Feeds.io
Technisanct
Cloud-native SaaS platform monitoring surface web, Tor and Telegram for real-time threat actor and ransomware alerts via Slack, Teams and email.
Reviews for this category are in progress.