The Best Threat Intelligence Platforms in 2026
We researched threat intelligence platforms from their official websites, including pricing pages, plan tables, and product documentation. Rankings reflect each product’s core intelligence-management job, value for money, and verified features for aggregating, enriching, managing, and operationalizing threat intelligence.
Our top picks
-
Top ranked
Anomali Platform#1 of 329.3/10A broad enterprise TIP combining intelligence operations, telemetry, cases, automation, and AI.
Pricing on request
-
Runner-up
9.2/10A broad intelligence platform for teams that need risk context across security workflows.
Pricing on request
-
Top-ranked free plan
MISP#4 of 328.8/10A capable free TIP for teams prepared to operate and extend their own platform.
Free plan
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
The full ranking 32 tools, best first
-
Best forEnterprise teams needing a complete TIP
A broad enterprise TIP combining intelligence operations, telemetry, cases, automation, and AI.
- Case management
- STIX/TAXII support
- Report management
9.3/10★★★★★Visit Anomali -
Best forOrganizations prioritizing commercial intelligence depth
A broad intelligence platform for teams that need risk context across security workflows.
- STIX/TAXII support
- Report management
- Workflow automation
9.2/10★★★★★Visit site -
Best forTeams focused on actors, leaks, and dark web risk
A broad cloud platform for actor research, dark-web monitoring, leaks, and intelligence operations.
- STIX/TAXII support
- Report management
- Workflow automation
9.0/10★★★★☆Visit Group-IB -
Best forBudget-conscious teams building their own TIP
A capable free TIP for teams prepared to operate and extend their own platform.
8.8/10★★★★☆Visit MISP -
Best forSecurity operations teams needing prioritization
A broad threat intelligence platform for prioritizing and operationalizing security data.
- Case management
- STIX/TAXII support
- Report management
8.8/10★★★★☆Visit ThreatQ -
Best forTeams automating intelligence distribution
A broad intelligence operations platform for automating collection, analysis, and distribution.
- Case management
- STIX/TAXII support
- Report management
8.7/10★★★★☆Visit Cyware -
Best forAnalysts needing rich intelligence workflows
A broad CTI workspace combining collection, analysis, investigations, reporting, and automation.
- Case management
- STIX/TAXII support
- Report management
8.6/10★★★★☆Visit EclecticIQ -
Best forResearch teams needing primary-source intelligence
Deep primary-source intelligence with investigations, scoring, alerts, reports, and integrations.
- Case management
- STIX/TAXII support
- Report management
8.5/10★★★★☆Visit Flashpoint -
Best forTeams wanting lookup, malware, and dark-web tools
A broad cloud platform for IOC analysis, malware research, and external threat monitoring.
- Report management
- Workflow automation
- Indicator enrichment
8.4/10★★★★☆Visit AhnLab TIP -
Best forTeams wanting accessible broad CTI coverage
Broad CTI coverage with free access, paid tiers, and security-operations integrations.
- Case management
- STIX/TAXII support
- Report management
8.3/10★★★★☆Visit SOCRadar -
Best forOrganizations combining CTI with exposure management
Broad CTI and exposure intelligence for organizations managing external risk.
- STIX/TAXII support
- Report management
- Workflow automation
8.2/10★★★★☆Contact Bitsight -
Best forTeams focused on external and dark-web exposure
A broad exposure-monitoring platform for teams investigating external and dark-web risk.
- STIX/TAXII support
- Workflow automation
- Indicator enrichment
8.1/10★★★★☆Visit Cyble Vision -
Best forUsers needing free indicator lookup and analysis
A strong free option for indicator lookup, enrichment, and malware analysis.
- STIX/TAXII support
- Report management
- Indicator enrichment
7.9/10★★★★☆Visit Kaspersky -
Best forDomain and brand-change monitoring
A focused monitoring suite for tracking brand, domain, registrant, IP, and nameserver changes.
7.9/10★★★★☆Visit DomainTools -
Best forGoogle Cloud teams managing application secrets
A Google Cloud service for managing application secrets, not threat intelligence operations.
7.9/10★★★★☆Visit Google Cloud -
Best forTeams wanting an open, extensible TIP
A broad, extensible TIP with a free self-hosted edition and enterprise deployment options.
- Case management
- STIX/TAXII support
- Report management
7.9/10★★★★☆Visit OpenCTI -
Best forSelf-hosted security operations environments
A broad self-hosted TIP for teams connecting security data, threat analysis and response.
- Case management
- STIX/TAXII support
- Report management
7.9/10★★★★☆View Security Vision -
Best forFree community indicator sharing
A free community for sharing Pulses and researching indicators of compromise.
- Report management
- Indicator enrichment
7.8/10★★★★☆Visit OTX -
Best forTeams needing cases and playbook orchestration
A case-focused threat intelligence platform with graph analysis and playbook orchestration.
- Case management
- STIX/TAXII support
- Report management
7.8/10★★★★☆Visit ThreatConnect -
Best forSelf-hosted teams needing intelligence fusion
A self-hosted platform for fusing intelligence, prioritizing risk, and automating response.
- Report management
- Workflow automation
- Indicator enrichment
7.7/10★★★★☆Visit DAS-Security -
Best forDevelopers building enrichment pipelines
A self-hosted, modular platform for developers building enrichment pipelines.
- Case management
- Report management
- Workflow automation
7.7/10★★★★☆Visit IntelOwl -
Best forSmall teams needing free IOC investigations
A broad free toolkit for IOC investigation, monitoring, reporting, and case work.
- Case management
- Report management
- Workflow automation
7.6/10★★★★☆Visit ThreatForge -
Best forSelf-hosted teams aggregating public feeds
A broad public-feed and enrichment workspace for self-hosted CTI operations.
- STIX/TAXII support
- Report management
- Workflow automation
7.5/10★★★★☆Visit site -
Best forSelf-hosted teams organizing threat objects
A free, self-hosted workspace for linking, enriching, and automating threat intelligence.
- Workflow automation
- Indicator enrichment
7.4/10★★★★☆Visit Yeti Platform -
Best forTeams automating IOC enforcement
A focused TIP for automating indicator decisions across intelligence and network controls.
- STIX/TAXII support
- Workflow automation
- Indicator enrichment
7.3/10★★★★☆Visit Nirad Networks -
Best forTeams needing distributed IOC collection
A distributed CTI platform for collecting, enriching, scoring and sharing indicators.
- STIX/TAXII support
- Report management
- Workflow automation
7.2/10★★★★☆Visit SİBERAT -
Best forIntelligence requirements and hunt documentation
A focused workspace for intelligence requirements, threat hunts, monitoring, and reporting.
- STIX/TAXII support
- Report management
- Workflow automation
7.1/10★★★★☆Visit Threatnote -
Best forTeams needing broad external-threat monitoring
Broad external-threat monitoring with incident management, automation, and security integrations.
- Case management
- STIX/TAXII support
- Report management
6.9/10★★★☆☆Visit site -
Best forTeams focused on exposure and remediation
A cloud threat intelligence platform with strong exposure monitoring and remediation workflows.
- Case management
- STIX/TAXII support
- Report management
6.8/10★★★☆☆Visit Intel 471 -
Best forContinuous internet exposure monitoring
A focused exposure-monitoring service with continuous crawling, alerts, APIs, and event feeds.
6.7/10★★★☆☆Visit Shodan -
Best forFree domain and IP investigation
A focused free service for enriching domains and IPs with infrastructure and reputation context.
- Indicator enrichment
6.5/10★★★☆☆Visit site -
Best forUsers wanting free IBM-backed CTI research
A free IBM-backed CTI workspace with broad research, sharing and exchange features.
- Case management
- STIX/TAXII support
- Report management
6.3/10★★★☆☆Visit IBM X-Force
No tools match those filters.
Compare at a glance
| # | Tool | Paid from | Indicator enrichment | STIX/TAXII support | Report management | Workflow automation | Deployment | Score |
|---|---|---|---|---|---|---|---|---|
| 1 | Anomali Platform | Yes | Yes | Yes | Yes | Hybrid | 9.3 | |
| 2 | Recorded Future Intelligence Cloud | Yes | Yes | Yes | Yes | Cloud | 9.2 | |
| 3 | Group-IB Threat Intelligence Platform | Yes | Yes | Yes | Yes | Cloud | 9.0 | |
| 4 | MISP | Free | 8.8 | |||||
| 5 | ThreatQ | Yes | Yes | Yes | Yes | Hybrid | 8.8 | |
| 6 | Cyware Intelligence Exchange | Yes | Yes | Yes | Yes | Hybrid | 8.7 | |
| 7 | EclecticIQ Platform | Yes | Yes | Yes | Yes | Hybrid | 8.6 | |
| 8 | Flashpoint Ignite | Yes | Yes | Yes | Yes | Cloud | 8.5 | |
| 9 | AhnLab TIP | Yes | Yes | Yes | Cloud | 8.4 | ||
| 10 | SOCRadar Extended Threat Intelligence Platform | Yes | Yes | Yes | Yes | Cloud | 8.3 | |
| 11 | Bitsight Cyber Threat Intelligence | Yes | Yes | Yes | Yes | Cloud | 8.2 | |
| 12 | Cyble Vision | Yes | Yes | Yes | Cloud | 8.1 | ||
| 13 | Kaspersky Threat Intelligence Portal | Yes | Yes | Yes | Cloud | 7.9 | ||
| 14 | DomainTools Monitors | 7.9 | ||||||
| 15 | Google Cloud Secret Manager | $0.03/unit/mo | 7.9 | |||||
| 16 | OpenCTI | Yes | Yes | Yes | Yes | Hybrid | 7.9 | |
| 17 | Security Vision TIP | Yes | Yes | Yes | Yes | Self-hosted | 7.9 | |
| 18 | Open Threat Exchange | Free | Yes | Yes | Cloud | 7.8 | ||
| 19 | ThreatConnect Platform | Yes | Yes | Yes | Yes | Hybrid | 7.8 | |
| 20 | DAS-Security ATIP | Yes | Yes | Yes | Self-hosted | 7.7 | ||
| 21 | IntelOwl | Free | Yes | Yes | Yes | Self-hosted | 7.7 | |
| 22 | ThreatForge | Free | Yes | Yes | Yes | Self-hosted | 7.6 | |
| 23 | Pulse Intelligence | Free | Yes | Yes | Yes | Yes | Self-hosted | 7.5 |
| 24 | Yeti | Free | Yes | Yes | Self-hosted | 7.4 | ||
| 25 | Nirad TIP | Yes | Yes | Yes | Hybrid | 7.3 | ||
| 26 | SİBERAT | Yes | Yes | Yes | Yes | Hybrid | 7.2 | |
| 27 | Threatnote | Yes | Yes | Yes | 7.1 | |||
| 28 | OODA Intelligence | Yes | Yes | Yes | Yes | Cloud | 6.9 | |
| 29 | Intel 471 Verity471 | Yes | Yes | Yes | Yes | Cloud | 6.8 | |
| 30 | Shodan Monitor | $69/mo | 6.7 | |||||
| 31 | Threat Intelligence Platform | Yes | Cloud | 6.5 | ||||
| 32 | IBM X-Force Exchange | Yes | Yes | Yes | Yes | Cloud | 6.3 |
Head-to-head All 28 comparisons →
- Anomali Platform vs Recorded Future Intelligence Cloud
- Anomali Platform vs Group-IB Threat Intelligence Platform
- Anomali Platform vs MISP
- Anomali Platform vs ThreatQ
- Anomali Platform vs Cyware Intelligence Exchange
- Anomali Platform vs EclecticIQ Platform
- Anomali Platform vs Flashpoint Ignite
- Recorded Future Intelligence Cloud vs Group-IB Threat Intelligence Platform
- Recorded Future Intelligence Cloud vs MISP
Explore other topics All topics →
- AI Tools 303 directories · 8,269 tools ranked AI Writing Tools · AI Video Generators · Text-to-Speech Software
- Web Hosting & Domains 275 directories · 6,107 tools ranked Shared Web Hosting · Managed Cloud Hosting · Dedicated Server Hosting
- Productivity 157 directories · 4,948 tools ranked Note-Taking Apps · Calendar Apps · Project Management Software
- Marketing 135 directories · 3,977 tools ranked SEO Tools · Influencer Marketing Platforms · Email Marketing Software
- Sales & CRM 152 directories · 4,161 tools ranked Real Estate CRM Software · CRM Software · Proposal Software
- Customer Service 55 directories · 1,547 tools ranked Chatbot Builders · Knowledge Base Software · Call Center Software
How we rank threat intelligence platforms
Every tool on this page was researched by iTechGuides Editors from its official website — pricing pages, plan tables and product documentation. We rank on how well each one does this category's core job, what the free or entry plan includes, and where it falls short. Where we have enough verified facts, the score out of 10 is a rubric — job fit, value and how much we could verify — shown with its breakdown on every tool's page; a tool we have not verified enough to score yet shows its rank without a number. Scores are re-checked when a product changes its plans. Read the full editorial policy, or submit a tool we missed.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Last updated · How we research and update