Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. The largest vendors in threat intelligence platforms
cannot hold places 1 to 3. Places 1 to 3 go to challengers, vendors outside the best-known brands in a category,
wherever the category has them; the established names follow from place 4 in their ranked order. How it works: placement disclosure ·
editorial process.
The 11 tools, reviewed
#1 OpenCTI (Filigran)
Open source threat intelligence management from Paris · France · filigran.io
open source STIX France
OpenCTI takes first place because it is the one entry where a small team can start without a contract. The Community Edition carries the Apache License, with Filigran SAS named as copyright holder in the project's license file, so the code is readable and the terms are fixed.
- Pricing: Open source + paid tiers. The Community Edition is Apache-licensed and free to use; the pricing page returned an empty response, so no paid plan or price could be read. Free plan: open source.
- Best for: Teams with analysts who run their own stack
- Strengths: Threat intelligence management; Apache-licensed Community Edition; Adversarial Exposure Validation.
Where it falls short
No paid price list could be read, because the pricing page returned nothing, so a support budget starts with a quote. The vendor pages read do not describe a feed of finished intelligence reports; the platform organizes what you bring to it.
Wrong for
A company with no analyst time that wants finished reports delivered on a schedule.
Visit OpenCTI (Filigran) →
#2 Sekoia.io
Threat intelligence bundled with a European SIEM · France · sekoia.com
SIEM CTI France
Sekoia.io ranks second because it treats intelligence as one module of a security operations suite. The home page lists Sekoia Intelligence next to a SIEM, digital risk protection, asset management and an agentic SOC analyst. Its integration framework exchanges signals, alerts and context in both directions across the stack. Agent decisions and actions are logged, which the page ties to compliance in regulated industries.
- Pricing: Quote only. No prices or free trial appear on the home page, which offers a self-guided tour and a demo request, so cost arrives as a quote. Free plan: none.
- Best for: Mid-sized teams wanting SIEM plus intelligence
- Strengths: Sekoia Intelligence (CTI); Sekoia Defend (SIEM); Sekoia Digital Risk (DRP).
Where it falls short
Intelligence is one module among five, so a buyer who only wants a threat intelligence platform pays attention to a larger product line. No prices are shown anywhere on the page read.
Wrong for
A team that already runs a SIEM it likes and needs a standalone intelligence layer.
Visit Sekoia.io →
#3 EclecticIQ
Dutch threat intelligence platform with feeds and browser extension · Netherlands · eclecticiq.com
TIP Netherlands STIX/TAXII
EclecticIQ earns third place as the dedicated platform of the group that comes from inside the European Union. Its imprint names EclecticIQ B.V., registered with the Dutch Chamber of Commerce under number 61333999, at an address in Amsterdam. Intelligence Center is presented as the AI-embedded platform that cuts data overload with prioritized, context-specific insights.
- Pricing: Quote only. No prices or free trial are shown on the pages read; the call to action is a booked demo, so cost is by quote. Free plan: none.
- Best for: Analyst teams needing prioritized, contextual intelligence
- Strengths: Intelligence Center platform; Browser extension; Threat intelligence feeds.
Where it falls short
Nothing about price is public beyond the demo button, so comparing it with open source options needs a quote. The pages read do not name hosting options or the number of seats and sources included.
Wrong for
A company with one part-time security person.
Visit EclecticIQ →
#4 Recorded Future
Intelligence Graph with an in-house analyst group · United States · recordedfuture.com
packages Insikt Group United States
Recorded Future is the incumbent most buyers will be pointed to, so it sits fourth under our rules. The Intelligence Graph correlates technical sources, the dark web, the open web and adversary infrastructure, and Insikt Group adds human analysis. The home page claims more than 100 native integrations.
- Pricing: Quote only. Core, Professional and Elite packages plus solution packages; no prices shown, and the basis is workforce credentials or named users. Free plan: none.
- Best for: Larger security teams buying wide coverage
- Strengths: Intelligence Graph; Insikt Group analysis; Core, Professional and Elite packages.
Where it falls short
No price or currency is printed, and neither a free plan nor a trial is named. Packages include defined capacity for API calls and scanned assets but the numbers are not published.
Wrong for
A small company that wants to try a tool before talking to sales.
Visit Recorded Future →
#5 Silobreaker
Cyber and geopolitical intelligence in one engine · United Kingdom · silobreaker.com
geopolitical MCP United Kingdom
Silobreaker ranks fifth because it covers more than malware and indicators. Its solutions are cyber threat intelligence and geopolitical risk intelligence, which suits a team that briefs leadership on geopolitical risk as well as on intrusions. The integrations page says teams can bring their own feeds and internal data, map sources to intelligence requirements, and review where subscriptions overlap or underperform.
- Pricing: Quote only. No pricing or free trial is stated on the pages read; the call to action is a demo request, so cost is by quote. Free plan: none.
- Best for: Teams tracking cyber and geopolitical risk
- Strengths: Silobreaker Intelligence Engine; PIR guided workflows; Mimir AI.
Where it falls short
No price is shown and no trial is named. The legal page names Silobreaker Limited, while the contact page lists a London office and a Stockholm office under Silobreaker AB, so check which entity signs your contract.
Wrong for
A team that only wants technical indicators pushed into a firewall or SIEM.
Visit Silobreaker →
#6 ThreatQuotient
Threat intelligence platform focused on prioritization · United States · threatq.com
TIP integrations United States
ThreatQuotient takes sixth place as a plain, purpose-built platform. ThreatQ is presented for detection, investigation and response, and the use cases listed are prioritizing intelligence, triaging alerts and prioritizing vulnerabilities. Integrations run through a marketplace and an integration framework, backed by a partner ecosystem. Support is more than a ticket queue: Professional Services, ThreatQ Academy and a Knowledge Hub are named.
- Pricing: Quote only. No prices are shown on the home page, where the call to action is a demo request, so cost is by quote. Free plan: none.
- Best for: SOC teams drowning in alerts and feeds
- Strengths: ThreatQ Platform; Intelligence prioritization; Alert triage.
Where it falls short
Prices are hidden and the only call to action is a demo. The home page banner promotes Securonix and its partner program, and the pages read do not explain the relationship, so ask who owns the product and how the roadmap is set.
Wrong for
A buyer who wants curated intelligence delivered by analysts.
Visit ThreatQuotient →
#7 Anomali
ThreatStream platform with a marketplace and free STAXX · United States · anomali.com
ThreatStream marketplace STAXX
Anomali ranks seventh. ThreatStream Next-Gen is its threat intelligence platform, presented as curated access to a large repository of intelligence. The Anomali Marketplace lets a buyer trial and purchase feeds from partners, which helps when you do not know yet which sources are worth paying for. STAXX is described as a free STIX/TAXII solution, a low-cost way to try sharing formats.
- Pricing: Quote only. No prices are shown and the pricing page returns Not Found; the home page offers Talk to Sales, so cost is by quote. Free plan: none.
- Best for: Teams wanting a marketplace of intelligence feeds
- Strengths: ThreatStream Next-Gen; Anomali Marketplace; STAXX STIX/TAXII tool.
Where it falls short
The pricing page is missing, so there is no published figure at all. The product story has moved toward a data lake and agentic SOC, which makes it harder to see what the intelligence platform costs on its own.
Wrong for
A small team that wants a single platform price it can put into a budget.
Visit Anomali →
#8 Google Threat Intelligence
Mandiant, VirusTotal and Google insight in one verdict · United States · cloud.google.com
Mandiant VirusTotal Google
Google Threat Intelligence is a big-tech platform, so it sits eighth. Its merit is the blend: Google's threat insights, Mandiant's analyst intelligence and the VirusTotal database go into a single verdict on an indicator. Hunting uses crowdsourced detection rules and YARA, and a unified score helps prioritize SIEM alerts through enrichment. Gemini produces summaries and is described as learning from user actions.
- Pricing: Flat annual / quote. Flat annual rate per subscription level with API calls included and extra packs available; Standard, Enterprise and OEM show only Contact sales for pricing. Free plan: none.
- Best for: Teams already running on Google Cloud
- Strengths: Unified verdict; Mandiant analyst intelligence; VirusTotal database.
Where it falls short
No prices are shown on the product page and no free plan or trial is named. Extra API call packs are bought separately, so heavy enrichment can add cost. Google LLC completed its Mandiant acquisition on 12 September 2022.
Wrong for
A company that wants to keep its security tooling independent of the largest US cloud vendors.
Visit Google Threat Intelligence →
#9 Flashpoint
Packaged illicit-community intelligence through Ignite · United States · flashpoint-intel.com
Ignite packages United States
Flashpoint ranks ninth because it is closer to an intelligence service than to a platform you operate. The Cyber Threat Intelligence core package is described as including Ignite API access, account takeover credentials, vulnerability intelligence, request-for-information hours, curated alerts, integrations and customer success. Other products cover physical security, fraud, brand and national security.
- Pricing: Quote only. The pricing page shows no prices; core packages say Get Pricing, and public-sector buyers go to a separate request page. Free plan: none.
- Best for: Teams buying finished intelligence and alerts
- Strengths: Flashpoint Ignite API; Account takeover credentials; Vulnerability intelligence.
Where it falls short
No price is shown and no free plan or trial is named on the pricing page. The address listed is a mailing address for privacy requests, with a private mailbox number, so it says little about where the company works.
Wrong for
A team that wants to own the intelligence workflow, with its own sources and tuning.
Visit Flashpoint →
#10 CrowdStrike Falcon Intelligence
Adversary intelligence tiers from an endpoint vendor · United States · crowdstrike.com
adversary managed hunting endpoint vendor
CrowdStrike Falcon Intelligence sits tenth because its strength is tied to a larger purchase. The product page lists four layers: Adversary Intelligence, a Premium tier with reports, pre-built detections and workflows, Adversary OverWatch for round-the-clock hunting, and Counter Adversary Elite for expert services. For a company already standardized on CrowdStrike endpoints, adding intelligence to the same vendor relationship is simple.
- Pricing: Quote only. The threat intelligence page shows no prices; the pricing menu lists endpoint bundles priced per endpoint, so modules here need a quote. Free plan: none.
- Best for: Existing CrowdStrike endpoint customers
- Strengths: Adversary Intelligence; Adversary Intelligence Premium; Adversary OverWatch hunting.
Where it falls short
No module prices are shown, and the only prices on the site belong to endpoint bundles. Hosting model, ownership and open source status are not stated on the pages read. The product page gives no trial terms.
Wrong for
A company on another endpoint product that wants vendor-neutral intelligence.
Visit CrowdStrike Falcon Intelligence →
#11 Team Cymru Pure Signal
Infrastructure telemetry and feeds, not a workflow platform · United States · team-cymru.com
feeds telemetry netflow
Team Cymru Pure Signal comes last because it is a data source more than a platform. The home page presents intelligence on adversary infrastructure as it forms, and claims more than 400 billion daily connections observed, 1,000 trusted partners, 60 data types fused and 180 CSIRT teams supported. Direct feeds cover botnet and malware, fraud and ransomware data.
- Pricing: Quote only. The home page states no pricing or free tier; the site offers Talk To an expert, so cost is by quote. Free plan: none.
- Best for: Hunters wanting raw infrastructure visibility
- Strengths: Pure Signal Command; Passive Asset Discovery Tool; Proactive Threat Hunting Tools.
Where it falls short
It does not replace a case workflow, since the product set is discovery, hunting, intelligence and netflow tools. The pages read state no prices, and the figures above are the vendor's own claims.
Wrong for
A team looking for one console to manage reports, tasks and sharing.
Visit Team Cymru Pure Signal →
Questions and answers
What is the best threat intelligence platform in 2026?
OpenCTI (Filigran) ranks first of 11, best for teams with analysts who run their own stack. Sekoia.io is second (mid-sized teams wanting SIEM plus intelligence) and EclecticIQ third (analyst teams needing prioritized, contextual intelligence). Places 1 to 3 go to challengers, vendors outside the best-known brands, wherever the category has them.
What is the difference between a threat intelligence platform and a feed?
A feed is a stream of indicators or reports. A platform is where you collect several feeds, remove duplicates, score them and send results to detection tools.
Is there a free threat intelligence platform?
Yes. The OpenCTI Community Edition is licensed under the Apache License and costs nothing to use. MISP is also free, but we ranked it out because its pages do not state a company or city.
Do any of these vendors publish their prices?
Not on the pages we read. Recorded Future shows package names and says pricing depends on organization size. Google describes a flat annual rate per level. The rest offer a demo or sales call.
Which vendors are based in Europe?
Three of the eleven. Filigran, the company behind OpenCTI, is registered in Paris; Sekoia.io SAS is registered in Rennes under number 913 174 744; EclecticIQ B.V. is registered in Amsterdam under KvK number 61333999.
Does a threat intelligence platform replace a SIEM?
No. A SIEM collects and correlates your own logs and raises alerts. The platform supplies outside context about the indicators in those alerts.
How many analysts do we need to run one?
That varies by product, and vendors do not publish figures. A workbench such as OpenCTI or ThreatQuotient assumes someone curates sources and tunes scores, which in practice means part of a person's week at minimum.
What are STIX and TAXII, and why do they matter?
STIX is a format for describing threats, and TAXII is a protocol for exchanging them. They matter because they let you move intelligence between tools and sharing groups.
Is Mandiant still a separate product?
Mandiant joined Google Cloud after Google LLC completed its acquisition of Mandiant, Inc. on 12 September 2022, and kept the Mandiant brand.
Why are some well-known vendors missing?
We kept only products whose own pages let us back a city and the main facts. MISP was dropped because its pages state no company or city. ThreatConnect now redirects to Dataminr after an announced acquisition.
What should a small company watch for in the contract?
Check the signing entity, the governing law, the capacity limits and the renewal terms. Google Cloud EMEA Limited contracts for much of EMEA, while Recorded Future's terms apply Massachusetts law to most customers.
