Threat intelligence platforms collect indicators and reports on attackers, enrich them and pass them to the tools that act. Threat intelligence platforms collect, enrich and share attacker data.
The ranking here weighs installation effort, the bill once feeds and modules join, how indicators come back out, supplier independence, and which team size each product fits.
Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. How that works.
In short
What threat intelligence platforms do
A threat intelligence platform gathers indicators and reports about attackers from many sources, stores and enriches them, then passes them to security tools and analysts for detection.
To rank threat intelligence platforms we asked, in turn, how much work setup takes, what it truly costs, whether data can be taken back out, whether leaving is possible, and who the product suits. Top three places belong to challengers outside the best-known brands whenever possible, and incumbents follow from four. For why these five were chosen, and why nothing here gets a numeric score, see how we work.
For a team that can run its own server, MISP removes the licence question altogether: the AGPL-3.0 text sits in the repository and nobody can reprice it. What replaces the invoice is labour. Someone installs it, patches it and decides who may see which events.
The site links to paid support and training, though without figures, so budget for that conversation separately. It is a sharing tool first, and the pages say nothing about scoring or analyst workflow.
What stands out
Open source
Self-hosted
AGPL-3.0
Where it costs you
Only self-deployment is described, so installation and upkeep sit with your own engineers.
Paid support and services are linked with no figures, which leaves their cost to a separate conversation.
Right for
Teams with their own engineers who want to exchange indicators with peers
Wrong for
Anyone expecting a hosted service from a single named company
Not stated by the vendorFree to use under AGPL-3.0; commercial support linked without prices
Self-serve indicator lookup with a monthly Pro plan and API feed
Ranked #2 of 13 in Best Threat Intelligence Platforms in 2026.
Published pricingElsewhere
Pulsedive suits a buyer who wants to try a platform by signing up rather than booking a demo. Exit routes are plain: the application offers STIX/TAXII 2.1, CSV, a bulk API and a feed download.
The gap is on the upper tiers. Enterprise TIP carries no price or scope, and the Rate Limits section of the API docs gives no figures, so a larger rollout needs terms the site never shows.
What stands out
Monthly Pro plan
STIX/TAXII export
API feed
Where it costs you
The Pro page lists no ceiling on API requests, feeds or indicators, so the plan's real limit is unknown.
The About page names no country or staff, so the supplier cannot be placed from the site.
Right for
Individuals and small groups trying indicator lookups before any sales call
Wrong for
Organisations that need an enterprise platform with documented limits
Not stated by the vendorPro plan published monthly; API Feed, Enterprise TIP and Add-On unpriced on the page
Filigran's threat intelligence product with an Apache-licensed community edition
Ranked #3 of 13 in Best Threat Intelligence Platforms in 2026.
Open sourcePricing on requestElsewhere
Licensing is the buying decision here. The community code carries an Apache licence and can run without a vendor involved; paid-tier features arrive under a separate agreement that the licences page points to, without prices.
Filigran also lists SaaS under its services, so a team can start hosted and move later, though the homepage does not describe a self-run installation. Note the features you depend on before trusting that the community code covers them.
What stands out
Open source
Apache 2.0
SaaS option
Where it costs you
A second licence governs Enterprise Edition features, so the Apache code alone will not deliver all of them.
Neither prices nor a country for Filigran appear on the homepage, so both need asking.
Right for
Teams that want to start on licensed source code and add a paid tier later
Wrong for
Anyone who needs a price list or a stated headquarters
Not stated by the vendorCommunity Edition under Apache 2.0; Enterprise Edition on separate licence; SaaS listed
Intelligence Center platform, browser extension and feeds listed as separate offerings
Ranked #4 of 13 in Best Threat Intelligence Platforms in 2026.
Self-hostablePricing on requestEurope
EclecticIQ is a platform sale with add-ons around it: Intelligence Center on one side, feeds and a browser extension listed beside it. That layout helps if you already have feeds and want the platform alone, and awkward if you expect one bundled figure.
The legal notice gives a registered company and chamber of commerce number, so a procurement check is simple. The site shows no price, trial or hosting statement.
What stands out
Intelligence Center
Browser extension
Separate feeds
Where it costs you
Feeds and the extension sit outside the platform listing, so check whether they are in the quote.
Cloud or on-premises is never stated, so hosting must be confirmed before a pilot.
Right for
Analyst teams that want a registered European supplier and a platform-plus-feeds buy
Wrong for
Anyone who wants prices or trial access before a sales call
NetherlandsQuoted on request; demo bookable, trial not mentioned
Pre-emptive defence built on DNS, certificate and WHOIS indicators
Ranked #5 of 13 in Best Threat Intelligence Platforms in 2026.
Pricing on requestNorth America
The pitch here is data about attacker infrastructure rather than a workflow tool: DNS, certificate, web content and WHOIS signals packaged as feeds and hunting queries. That makes it a source to feed another platform as much as a platform itself.
Separate logins exist for Community, Enterprise and Partner users, which suggests tiers, but their terms are absent from the homepage. Find out what the Community tier covers, and what falls outside it, before planning around it.
What stands out
IOFA feeds
Threat hunting
Community Edition
Where it costs you
A Community Edition is linked with no explanation of its contents or cost.
Hosting is not described, so it needs confirming before any evaluation.
Right for
Hunters who want infrastructure-based indicators ahead of confirmed attacks
Wrong for
Teams wanting case management and workflow more than extra indicator sources
United StatesQuoted on request; Community Edition linked, terms not stated
Threat intelligence with exposure, brand and third-party risk modules
Ranked #6 of 13 in Best Threat Intelligence Platforms in 2026.
Pricing on requestMiddle East
Kela invites a first look with only a domain, which keeps early setup effort low. The cost question comes later, when the suite grows beyond intelligence: exposure management, digital risk, third-party risk and a national resilience suite for government are all listed.
Nothing shows which of them are bundled. Get the module list your quote covers in writing, and ask whether results from the start offer survive into a paid contract.
What stands out
Domain-based start
Modular suite
Government suite
Where it costs you
No duration or scope is given for the domain-based start.
Seven product areas appear without any figure, so a full set is impossible to estimate.
Right for
Teams wanting to try domain monitoring before committing to a suite
Wrong for
Anyone who needs only one threat intelligence feed
IsraelQuoted on request; domain-based start offer without card
Threat intelligence platform acquired by Securonix, citing over 450 integrations
Ranked #7 of 13 in Best Threat Intelligence Platforms in 2026.
Pricing on requestNorth America
The integration count is the selling point: over 450 are cited, which matters if your sources and sinks are already in place. What changed is the owner. Securonix bought the company and the announcement says focus is unchanged, but it commits to no roadmap, pricing or support terms.
Put those questions to Securonix before signing. The site also lists two offerings, intelligence management and security automation, without saying whether the second is part of the first quote.
What stands out
Securonix-owned
450+ integrations
Security automation
Where it costs you
Ownership changed in 2025, so product direction now depends on Securonix.
A demo request is on the homepage; a price and a hosting model are not.
Right for
Teams that already run many security tools and want them connected
Wrong for
Anyone who needs a supplier with no parent company
United StatesQuoted on request; demo request is the only action offered
Two suites for intelligence and collaboration, scoped per engagement
Ranked #8 of 13 in Best Threat Intelligence Platforms in 2026.
Pricing on requestElsewhere
The two-suite split matters for a buyer: the Collaboration Suite targets sharing between organisations, the Intelligence Suite targets analysts consuming and enriching feeds.
Both include sandboxing and intelligence operations, so overlap is possible, and whether one can be bought alone goes unanswered. Cost follows hosting choice, seats and feeds, so a pilot with five analysts will not predict the bill for twenty. Get a quote at the size you expect to reach.
What stands out
Two suites
Seat and feed sizing
Malware sandboxing
Where it costs you
Seats and feeds both move the price, so adding analysts or sources changes the quote.
The pricing page lists no hosting options, so deployment is a question for sales.
Right for
Sharing communities and teams that need collaboration alongside intelligence
Wrong for
Anyone who wants a fixed per-seat price on the page
Not stated by the vendorQuoted per organisation; depends on deployment, analyst seats and feeds
Agentic SOC platform that bundles threat intelligence with security data
Ranked #9 of 13 in Best Threat Intelligence Platforms in 2026.
Self-hostablePricing on requestNorth America
Anomali has moved its description from intelligence platform to SOC platform, with threat intelligence as one component alongside security data and agentic AI.
That helps a team consolidating tools and hurts one that wants only an intelligence repository, since the site gives no way to see what a narrow purchase costs. STAXX is the exception: Anomali calls it a free STIX/TAXII solution, a low-commitment way to try feeds. The platform itself needs a demo.
What stands out
Agentic SOC
STAXX tool
Demo-led
Where it costs you
The offer is framed as a whole SOC product, so intelligence may not be sold on its own.
Neither prices nor a deployment model is on the homepage.
Right for
SOC teams that want intelligence tied to detection and AI-assisted triage
Wrong for
Anyone after a standalone intelligence repository
United StatesQuoted on request; two buttons, demo and sales
Verity471 platform with adversary, malware and credential intelligence modules
Ranked #10 of 13 in Best Threat Intelligence Platforms in 2026.
Pricing on requestElsewhere
Intel 471 is organised by module, which lets a buyer start narrow: adversary, malware, credential, vulnerability, fraud, geopolitical and hunt intelligence are listed separately. So the quote will track the number of modules you pick.
The 700-plus hunt packages are the concrete deliverable on the site, tied to actors that target a sector. The Thoma Bravo release describes an investment without terms; raise ownership directly before any multi-year deal.
What stands out
Verity471
Threat hunting packages
Thoma Bravo investment
Where it costs you
Modules are named one by one with no figures, so a full set cannot be costed in advance.
The investment release leaves open who controls the company.
Right for
Teams seeking adversary and credential intelligence plus ready-made hunting packages
Wrong for
Anyone requiring a price list or trial
Not stated by the vendorQuoted via sales contact; no plans listed
Five request-priced packages built around Ignite, including physical security intelligence
Ranked #11 of 13 in Best Threat Intelligence Platforms in 2026.
Pricing on requestElsewhere
Flashpoint sells analysis alongside data. Ignite is described as data access with finished intelligence, alerting and analytics, and the packages add requests to its analysts through RFI hours.
That helps a small team without its own researchers, and could prove expensive if hours are metered tightly, a point the page leaves open. Public sector and government buyers are sent to a separate pricing request. No headquarters is named anywhere, so find out where the contracting entity sits.
What stands out
Five packages
Ignite and API
RFI hours
Where it costs you
Two packages list Request for Information hours without an amount, so analyst access cannot be sized.
The About page gives no headquarters and does not name the partner it thanks.
Right for
Organisations that want finished intelligence and analyst access, not just feeds
Wrong for
Teams wanting self-serve access at a listed price
Not stated by the vendorQuoted per package; pricing form instead of prices; no demo or trial named
Unified risk platform spanning threat intelligence, fraud and managed XDR
Ranked #12 of 13 in Best Threat Intelligence Platforms in 2026.
Pricing on requestAsia-Pacific
The breadth of the catalogue is both the attraction and the risk: threat intelligence sits beside fraud, brand, email and cloud posture products, so a buyer needing only the first pays for a bigger relationship.
The Managed XDR tiers show how features are gated, since API access, hunting and response arrive at Pro, and a named hunter at Enterprise. Retention grows from 7 to 30 days. Borrow that tier table as a template when negotiating terms for the intelligence product.
What stands out
Managed XDR tiers
Fraud protection
Attack surface
Where it costs you
API access starts at Pro, so Standard cannot be wired into other tools.
Endpoint forensic data is kept for just 7 days on Standard, against 30 on Enterprise.
Right for
Organisations buying intelligence together with fraud and managed detection
Wrong for
Anyone who wants only a threat intelligence repository
SingaporeQuoted per tier; Managed XDR in three tiers via sales contact
Core, Professional and Elite packages, now owned by Mastercard
Ranked #13 of 13 in Best Threat Intelligence Platforms in 2026.
Pricing on requestElsewhere
Sizing by workforce credentials means a company with many employees and a small security team pays for the headcount, not the analysts. Under that model the page promises no limits on users or integrations, which suits a big team, although API calls and monitored organisations still have capacity ceilings.
With Mastercard as owner, the vendor stands outside the independent group. Digital risk and third-party risk modules are sold separately and add to the base price.
What stands out
Mastercard-owned
Credential-based sizing
Solution add-ons
Where it costs you
Organisation size drives the price, so a bigger workforce raises cost without adding analysts.
Packages carry usage and capacity caps such as API calls, with no figures shown.
Right for
Large organisations content to be sized by headcount in one vendor package
Wrong for
Small teams, or anyone who wants a supplier outside a larger group
Not stated by the vendorQuoted on request; sized by workforce credentials, named users for small deployments
A threat intelligence platform gathers indicators and reports about attackers from many sources, stores and enriches them, then passes them to security tools and analysts for detection. A feature table will not settle this choice. These steps will.
01
Work out how much a sales call is worth to you
11 vendors on this page sell by quote, while 2 publish a pricing model you can read today: MISP, Pulsedive.
02
Decide how much the jurisdiction matters
Look at the contracting entity: these 13 vendors sit in 5 countries, split by region as Elsewhere 7, North America 3, Europe 1, Asia-Pacific 1, Middle East 1. The servers can be anywhere; the legal obligations follow the company.
03
Check the open source options
2 of these are open source: MISP, OpenCTI. Hosting one yourself trades a subscription for maintenance.
Open source or paid: where MISP and OpenCTI move the cost
MISP and OpenCTI turn the question from price into labour. MISP is AGPL-3.0 software you download and deploy yourself, with no hosted option mentioned, so the opening ninety days are spent on installation, patching and deciding who sees which event. OpenCTI is divided: Filigran releases a Community Edition under Apache 2.0, paid features sit under a separate agreement, and SaaS is listed as a service.
Pulsedive sits between the two, with a monthly Pro plan on its navigation and unpriced upper tiers. A paid platform such as EclecticIQ or Cyware removes the installation work but replaces it with a quote. Weigh engineer hours against the quote before calling the open source route cheaper.
Estimate the hours to install, patch and administer MISP or OpenCTI yourself.
List the OpenCTI features you rely on and mark which need the paid licence.
Ask paid vendors to list what their first quote leaves out.
Name the sizing metric before comparing Recorded Future, Cyware and Flashpoint
Almost no vendor here publishes a price, so the metric behind the quote is the thing to compare. Recorded Future sizes most packages by unique workforce credentials, which charges for headcount, and offers named-user licences to smaller deployments. Cyware says cost depends on hosting choice, analyst seats and feeds, so each added analyst or source moves it.
Flashpoint sells five packages, and its intelligence packages include Request for Information hours without stating an amount. Group-IB gates features by tier instead: API access, hunting and response start at Pro. These are different meters, and a team of five analysts in a large company will be priced very differently under each. Have each vendor price the team you expect in two years.
Ask what the price is sized on: users, credentials, seats, feeds or packages.
Get the count of RFI hours or API calls included, in writing.
Price a team twice your current size.
Check export formats and integrations before you commit to a platform
A threat intelligence platform is only useful if indicators flow in and out. Pulsedive offers STIX/TAXII 2.1 export, a bulk API, CSV and a feed download, the clearest exit route on this list. MISP is built for sharing indicators with others. ThreatQuotient cites over 450 integrations, and Anomali pairs its platform with STAXX, a separate STIX/TAXII tool.
Group-IB's Standard Managed XDR tier has no API access, which would block automation until you upgrade. Silent Push and Kela, among others, leave hosting unstated on their homepages, so confirm the storage location and the exit route before the contract ends. Run an export while evaluating, not after signing.
Pull a full indicator set out in STIX format during evaluation.
Confirm that API access belongs to the tier quoted.
List the tools that must connect and ask for the integration by name.
Ownership changes at ThreatQuotient, Recorded Future and Intel 471
Several platforms here have changed hands or taken investment recently, and a threat intelligence contract usually runs for years. Securonix acquired ThreatQuotient, and the announcement promises unchanged focus without naming terms. Mastercard bought Recorded Future, and its intelligence is to be added to Mastercard's cybersecurity services.
Thoma Bravo made a strategic investment in Intel 471, and the release does not say whether control changed. EclecticIQ publishes its registered company details, while MISP is run by a project with no legal entity named. A buyer should ask who owns the product roadmap, whether feeds will stay available separately and what notice applies if the product is merged into a larger suite. Put the answers into the contract.
Ask whether the product will remain available as a standalone purchase.
Request a notice period and exit rights if the owner changes.
Check who the contracting legal entity is.
What goes wrong most often when buying threat intelligence platforms
Treating the first demo quote as the price while feeds, seats and add-on modules are priced separately.
Assuming a community edition covers your needs without checking which features need the paid licence.
Buying a SOC suite when the need is an indicator repository, and paying for modules nobody switches on.
Leaving the export untested, then discovering indicators exit in a format the next tool rejects.
07
Frequently asked questions
8 answers
What are the best threat intelligence platforms in 2026?
MISP leads our ranking of 13. MISP describes itself as open source software for collecting, storing, distributing and sharing cyber security indicators, and its repository states AGPL-3.0.
You download and deploy it yourself, and the site mentions no hosted offering, so installation hours and upkeep fall on your own staff. The site credits a project and names no legal entity, so no vendor stands behind it.
Which threat intelligence platforms publish their pricing?
The ones that do, with the model each states:
MISP: Free to use under AGPL-3.0; commercial support linked without prices.
Pulsedive: Pro plan published monthly; API Feed, Enterprise TIP and Add-On unpriced on the page.
The remaining 11 sell by quote.
Is there a free threat intelligence platform?
MISP can be used for free, either as a free plan or a self-hosted edition.
Where are these threat intelligence platform vendors established?
Vendor countries on this page, Elsewhere 7, North America 3, Europe 1, Asia-Pacific 1, Middle East 1:
MISP: Not stated by the vendor.
Pulsedive: Not stated by the vendor.
OpenCTI: Not stated by the vendor.
EclecticIQ: Netherlands.
Silent Push: United States.
Kela: Israel.
ThreatQuotient: United States.
Cyware: Not stated by the vendor.
Anomali: United States.
Intel 471: Not stated by the vendor.
Flashpoint: Not stated by the vendor.
Group-IB: Singapore.
Recorded Future: Not stated by the vendor.
Which threat intelligence platforms are open source?
MISP, OpenCTI.
Which threat intelligence platforms can you host yourself?
MISP, EclecticIQ, Anomali. 10 products offer no self-hosted option.
What should you use instead of MISP?
Second is Pulsedive, which suits Individuals and small groups trying indicator lookups before any sales call. Third is OpenCTI, which suits teams that want to start on licensed source code and add a paid tier later.
Who should not buy MISP?
Anyone expecting a hosted service from a single named company. Only self-deployment is described, so installation and upkeep sit with your own engineers..
Missing from this threat intelligence platforms ranking? Contact us with a short description of the product and its users. Adding it is an editorial choice, and software advice explains what a listing does and does not involve.
