Market guide
Threat intelligence is the oldest idea in security and the hardest one to buy well. Every organisation already receives more of it than it can read: vendor feeds, government advisories, ISAC bulletins, open-source indicator lists, and the output of every tool it already owns. A threat intelligence platform is not sold to produce more of that. It is sold to decide which of it matters here, and to get that decision to somewhere it changes what happens.
The category has spent two years being absorbed. What is left is a market with two quite different halves, which are usually reviewed as though they were one.
Intelligence that nobody acts on is a subscription, not a control. The problem a platform solves is the gap between a feed arriving and something changing: a block applied, a detection written, a patch prioritised, an engineering ticket raised. Most of the work is unglamorous. Deduplicate indicators arriving from nine sources. Decide which of them relate to anything you own. Attach enough context that an analyst can act without opening five tabs. Keep a record of what you knew and when, because that is what a regulator or an insurer asks for afterwards.
The second reason is that relevance is local. An indicator tied to a banking trojan matters enormously to a bank and not at all to a manufacturer whose exposure is a fleet of shipped devices running components chosen four years ago. A platform earns its price by knowing which of those you are.
The independents were bought, and not by security companies.
Mastercard acquired Recorded Future, the largest independent in the category, for $2.65 billion. The logic was that fraud data and threat data increasingly describe the same activity, and a payments network already sits where both land. Google folded Mandiant and VirusTotal into a single Google Threat Intelligence offering, selling one verdict on an indicator rather than a separate lookup in each. Dataminr, which detects events from public and social data in real time, bought ThreatConnect for $290 million to add the operational layer that turns a detection into a workflow.
Three of the best-known names in the category now sit inside a payments network, a hyperscaler and a real-time event detection business. None of those buyers is a traditional security vendor, which tells you what they think intelligence is for: it is a data asset that improves something they already sell.
Demand has not softened. Mordor Intelligence puts the market at $10.4 billion in 2026, up from $9.2 billion in 2025, and forecasts $18.9 billion by 2031. The money is going into consolidation rather than new entrants, which is the same pattern visible in cloud security.
Everything above concerns intelligence about infrastructure: the estate you run, the identities in it, the indicators that suggest somebody is inside. It is built on indicators of compromise, and it is bought by a security operations team.
A second category has grown alongside it, driven by regulation rather than by attack volume. If your organisation ships products rather than only running systems, the question is not which indicator is active on your network, it is which vulnerable component is inside a device you sold three years ago and cannot easily reach. The Cyber Resilience Act, UNECE R155, IEC 62443-4-2 and PCI PTS all now demand a documented answer, and the unit of analysis is a bill of materials rather than an indicator.
PCA CERVUS, from the Hungarian firm PCA Cyber Security, is a clear example of the shape. It takes supplier SBOMs, validates the components against vulnerability intelligence, identifies which shipped products are affected, prioritises what is actually exploitable and routes the result to engineering rather than to a SOC. PCA are explicit that it complements a traditional platform rather than replacing one, and their own comparison is the clearest statement of the split: embedded products against general IT assets, device components as the model against indicators of compromise, engineering as the consumer against security operations.
Buyers in payments, automotive and industrial manufacturing increasingly need both, and they are not substitutes. An enterprise platform will not tell you that a component in a payment terminal shipped in 2023 is now exploitable. A product security platform will not tell you that someone is authenticating as your finance director.
Ask what it is intelligence about. Your infrastructure or your products. This decides the shortlist before any feature comparison, and getting it wrong is how organisations end up with a platform nobody in engineering will open.
Ask where the intelligence comes from. Proprietary collection, licensed feeds, open sources, or the vendor’s own customer telemetry. Each has a different failure mode, and a platform that mostly aggregates other people’s feeds is selling workflow, which is a legitimate thing to sell but a different one.
Ask what happens after the alert. A platform that raises an issue and stops has moved work rather than reduced risk. Look for the route into a ticket, a detection rule, a block, or an engineering backlog, and ask whether that route exists without a services engagement.
Ask how it decides relevance to you. Every vendor claims prioritisation. The question is what it is prioritising against: your asset inventory, your software bill of materials, your sector, or nothing but a generic severity score.
Ask who owns it after the pilot. Intelligence platforms are often bought by people who will not operate them. A platform nobody opens once the pilot ends has bought nothing, however good its collection is.
The enterprise half is becoming a feature of larger platforms, and the remaining independents are competing on collection depth against buyers who have been told to consolidate. That is a difficult argument, though a real one for organisations whose risk justifies specialist collection.
The product half is growing for a reason that has nothing to do with attacker behaviour. Regulation created it, the deadlines are fixed, and the buyers are manufacturers who have never bought security intelligence before. It is the less crowded half, and the one where the evidence requirement is written into law.
Every company we track in this segment, in the same shape: what it does, who it suits, and what to check. Ordered alphabetically: this is not a ranking.
Anomali provides a threat intelligence platform and security analytics, built around its ThreatStream intelligence management product.
Where it fits. A long-standing independent platform built around ThreatStream, relaunched in May 2026 as ThreatStream Next-Gen and positioned as the decision layer inside security workflows rather than a store of feeds. A fit for teams that want to pull many sources together and push the result into tools they already run.
Watch for. One of the few sizeable independents left in a category whose other leaders have been bought. Check how much of the relaunch is new capability and how much is new framing, and how it sits alongside a SIEM you already own.
Black Kite provides an AI-native third-party cyber risk management platform for monitoring and assessing vendor risks.
Where it fits. Scores other organisations from the outside: suppliers, partners and acquisition targets rather than your own estate. It belongs in third-party risk programmes and vendor due diligence.
Watch for. It answers a different question from an intelligence platform, and the two are often confused in procurement. An outside-in rating reflects what is visible from the internet, which is not the same as a supplier's actual security.
Check Point Software provides cyber security solutions including network, cloud, and AI security.
Where it fits. Intelligence delivered as ThreatCloud, feeding Check Point's own firewall, email and endpoint products. Strongest for organisations already running a Check Point estate.
Watch for. Much of its value is the enforcement it drives inside Check Point products. As a standalone platform across a mixed estate it is a less natural choice.
Criminal IP provides threat intelligence solutions for uncovering exposed assets and detecting malicious infrastructure.
Where it fits. A search engine for internet-exposed assets combined with threat intelligence, from the South Korean company AI Spera, founded in 2017 as a spin-off from Korea University. Useful for discovering and checking what an organisation has exposed.
Watch for. A younger and smaller company than most here. Better suited to attack surface and exposure checks than to serving as an organisation's primary intelligence platform.
CrowdStrike provides AI-native cybersecurity solutions to stop breaches.
Where it fits. Intelligence sold as part of the Falcon platform, drawn from its endpoint telemetry and adversary tracking. The obvious choice for an organisation already running Falcon.
Watch for. Most valuable where Falcon is already deployed and the intelligence is integrated. Buyers on another endpoint platform get less of what makes it distinctive.
Cyble provides AI-native threat intelligence and cybersecurity platforms for enterprises and governments.
Where it fits. External threat intelligence focused on the dark web, leaked data and brand exposure. A fit for monitoring what is said and sold about an organisation outside its own perimeter.
Watch for. Its strength is external and underground monitoring rather than a full intelligence operations platform. Usually bought alongside a platform rather than instead of one.
Cyware provides a platform for threat intelligence management, security orchestration, and collective defense.
Dataminr detects events and risks in real time from public and social data, and acquired ThreatConnect for $290m to add intelligence operations.
Where it fits. Real-time detection of events and risks from public and social data, now combined with ThreatConnect's intelligence operations workflow after a $290m acquisition. Suited to organisations that want early warning and the process to act on it in one place.
Watch for. Two products built separately are being brought together, and that takes time. Check which parts of the combined offer are unified today and which are still two tools.
EclecticIQ provides a threat intelligence platform aimed at government and large enterprise analysts, with an emphasis on analyst-led workflows.
Where it fits. A Dutch intelligence platform aimed at government and large-enterprise analyst teams, built around analyst-led workflows rather than automation first. A fit where a dedicated intelligence team does the analysis.
Watch for. It suits organisations with trained analysts to run it. Teams that mostly want automated prioritisation may find the analyst-centred model heavier than they need.
F-Secure provides antivirus, VPN, identity protection and scam protection software for consumers and partners.
Flashpoint provides intelligence collected from illicit online communities, covering cyber threat, fraud and physical security risk.
Where it fits. Intelligence collected from illicit online communities, covering cyber threats alongside fraud and physical security risk. Useful where one organisation needs visibility across several kinds of risk.
Watch for. The breadth across cyber, fraud and physical security is the selling point, and it also means the cyber coverage competes with specialists on depth. Check coverage against the threats you actually face.
Group-IB provides cybersecurity products and services to prevent digital crime.
Where it fits. Threat intelligence and incident response with particular depth in financial crime and cybercrime across Asia, the Middle East and Europe. Headquartered in Singapore since 2019.
Watch for. It completed its exit from Russia in April 2023, selling the Russian business, which now operates separately as F.A.C.C.T. Buyers with strict provenance policies will want to understand that history, which the company has addressed publicly.
Intel 471 provides cyber threat intelligence focused on adversary tracking, malware intelligence and underground marketplace coverage.
Where it fits. Intelligence focused on the criminal underground: tracking adversaries, their malware and the marketplaces where access and data are sold. Aimed at mature teams that want to understand who is behind a threat.
Watch for. A specialist source that assumes experienced analysts to get the most from it. Less a general-purpose platform than a supply of deep adversary intelligence.
Kaspersky develops antivirus and internet security software for home users and businesses.
Where it fits. Long-standing threat research with deep malware analysis capability, relevant to buyers outside the United States.
Watch for. Barred from new sale in the United States since 20 July 2024 under a Commerce Department determination, and from providing updates there since 29 September 2024. For a US buyer it is not an option, and other buyers should check their own regulatory position.
Mandiant provides threat intelligence and incident response, now sold as Google Threat Intelligence alongside VirusTotal within Google Cloud.
Where it fits. Intelligence grounded in incident response work, now sold within Google Cloud as Google Threat Intelligence alongside VirusTotal. The depth comes from what Mandiant's responders see in real breaches.
Watch for. Increasingly packaged with Google's wider security portfolio. Check how the intelligence is sold on its own against bundled, and how it fits if you do not run on Google Cloud.
PCA Cyber Security provides embedded product security services and PCA CERVUS, a device-centric vulnerability monitoring and threat intelligence platform driven from product SBOMs.
Where it fits. PCA CERVUS monitors embedded products rather than IT estates, resolving vulnerabilities against a product's bill of materials and routing findings to engineering. Built for manufacturers facing the Cyber Resilience Act, UNECE R155 and PCI PTS.
Watch for. PCA are explicit that it complements an enterprise intelligence platform rather than replacing one, so it answers the product question, not the network one. A Hungarian specialist with a penetration testing practice behind it, in a narrower market than the enterprise vendors.
Proofpoint provides cybersecurity solutions to protect people, data, and AI across email, cloud, and collaboration tools.
Where it fits. Intelligence drawn from its view of email-borne threats, feeding Proofpoint's own email and people-protection products. Strongest where email is the main route of attack.
Watch for. Most valuable inside Proofpoint's own products and against email-borne threats. As a general intelligence platform for other threat types it is a less natural fit.
Rapid7 provides AI-powered managed cybersecurity operations, including MDR, SIEM, and vulnerability management.
Where it fits. External threat intelligence from its 2021 acquisition of IntSights, for about $335m, sold as part of Rapid7's detection and response platform. A fit for Rapid7 customers wanting external threat and digital risk monitoring.
Watch for. Most useful inside a Rapid7 estate. As a standalone intelligence platform it competes with specialists that make intelligence their whole business.
Recorded Future provides a threat intelligence platform that indexes open, dark and technical sources. Acquired by Mastercard for $2.65bn.
Where it fits. The largest independent intelligence platform until Mastercard bought it for $2.65bn, indexing open, dark and technical sources at scale. The broadest collection in the category.
Watch for. Now owned by a payments network, whose interest is the overlap between fraud and cyber threat data. Watch whether the roadmap tilts towards payments and fraud.
RedLattice provides cyber capabilities for military, intelligence and law enforcement missions.
TRM Labs provides blockchain intelligence and AI tools to help investigate and disrupt criminal networks.
Two things worth knowing about any segment before reading vendor by vendor: how old the companies in it are, and what the money has done.
Every funding round and acquisition we hold for this segment, each linked to the report it came from.
The FBI has issued a public service announcement warning that fraudsters are using cloned candidate voices, logos and slogans to solicit fake campaign donations and harvest personal data…
Ukraine’s Defence Ministry says SpaceX’s Starshield satellite service is again usable on the move, after sudden restrictions disrupted drone missions along the front line. A ministry source told…
Criminal IP, the cyber threat intelligence platform operated by AI SPERA, has introduced AITEM, an AI-powered threat exposure management offering it describes as the next evolution of attack…
The prose is written and reviewed by us. The vendor list, the figures, the capability matrix, the deal table and the news below are queried from our directory each time this page loads, so they do not go stale between reviews.
What sits behind it: public reporting, each company’s own published material, and the funding and acquisition records we keep, every one of which links to its source. We have not run these products, spoken to their customers under NDA, or taken payment from anyone named here. Where a capability is listed it is because the vendor states it, not because we verified it. Treat this as a map of the market and a set of questions to ask, not as a substitute for a trial on your own data.
Something wrong or missing? Tell us: corrections are made on the page.
