Group-IB Threat Intelligence Platform

Paid#3 of 32 in Threat Intelligence Platforms

Group-IB Threat Intelligence Platform: A broad cloud platform for actor research, dark-web monitoring, leaks, and intelligence operations. Ranked #3 of 32 in Threat Intelligence Platforms by our editors (9.0/10); pricing: Pricing on request; best for teams focused on actors, leaks, and dark web risk.

9.0/10★★★★☆Editor score

Visit Group-IB

Group-IB Threat Intelligence Platform9.0 Visit Group-IB

At a glance

• Editor score
  9.0 / 10
• Pricing
  Pricing on request
• Best for
  Teams focused on actors, leaks, and dark web risk
• Indicator enrichment
  Yes
• Founded
  2003 · Singapore
• Facts checked
  20 Sep 2026

• Where it wins

  • Graph investigations connect actors, infrastructure, tools, and related intelligence.
  • Monitors dark web activity, compromised credentials, leaks, phishing, and malicious sites.
  • Supports SIEM, SOAR, TIP, STIX, TAXII, API, and threat-hunting workflows.

• Where it doesn't

  • Pricing requires contact with sales rather than a listed plan structure.
  • Its broad feature set may exceed the needs of teams seeking one focused capability.
  • Cloud deployment may not fit organizations requiring another deployment model.

Our verdict on Group-IB Threat Intelligence Platform

Group-IB Threat Intelligence Platform is a cloud-based cyber threat intelligence solution for security teams, threat intelligence analysts, and enterprise organizations. It brings together open-source, dark-web, malware, vulnerability, and human intelligence in a single environment. The platform is built for teams investigating threat actors and infrastructure, monitoring compromised data, analyzing malicious activity, and turning intelligence into alerts, reports, and operational actions. Its 2003 founding year also gives the product a long operating history in this category.

The strongest fit is for organizations that need breadth across actor research, exposure monitoring, and technical investigation. Graph-based analysis links threat actors, infrastructure, and tools, while attribution and MITRE ATT&CK mapping add structure to investigations. Dark-web and underground monitoring, compromised credential and data-leak detection, phishing and malicious-site monitoring, malware analysis and detonation workflows, and vulnerability intelligence with exploit correlation cover distinct intelligence priorities. Customizable threat-hunting rules, AI-assisted research and reporting, and indicator enrichment support ongoing analysis rather than one-off lookups.

Integration is a central part of the platform's operating model. It provides API access and connects with Splunk ES, Microsoft Sentinel, IBM Security QRadar SIEM, Cortex XSOAR, MISP, OpenCTI, Anomali ThreatStream, and ThreatConnect. STIX and TAXII support also helps fit the product into established intelligence-sharing and security-operations workflows. Group-IB describes pricing as modular and states that it does not charge per user, integration, or API call, while the commercial model is contact sales. Choose it when actor-focused intelligence, dark-web visibility, leak detection, and connected investigation matter together. Teams seeking a narrowly scoped monitoring tool or a non-cloud deployment should consider alternatives.

Your product? Our editors can test Group-IB Threat Intelligence Platform in depth and publish a review, labelled as paid · from $149/mo →

Group-IB Threat Intelligence Platform pricing

Group-IB Threat Intelligence Platform fact sheet

Group-IB Threat Intelligence Platform integrations

Group-IB Threat Intelligence Platform lists 8 integrations on its own site.

• Splunk ES
• Microsoft Sentinel
• IBM Security QRadar SIEM
• Cortex XSOAR
• MISP
• OpenCTI
• Anomali ThreatStream
• ThreatConnect

See all Group-IB Threat Intelligence Platform integrations →

Alternatives to Group-IB Threat Intelligence Platform

• Anomali PlatformA broad enterprise TIP combining intelligence operations, telemetry, cases, automation, and AI.9.3
• RFRecorded Future Intelligence CloudA broad intelligence platform for teams that need risk context across security workflows.9.2
• MISPA capable free TIP for teams prepared to operate and extend their own platform.8.8

See all Group-IB Threat Intelligence Platform alternatives →

Group-IB Threat Intelligence Platform vs the competition

• Group-IB Threat Intelligence Platform vs Anomali Platform
• RFGroup-IB Threat Intelligence Platform vs Recorded Future Intelligence Cloud
• Group-IB Threat Intelligence Platform vs MISP
• Group-IB Threat Intelligence Platform vs ThreatQ
• Group-IB Threat Intelligence Platform vs Cyware Intelligence Exchange
• Group-IB Threat Intelligence Platform vs EclecticIQ Platform

Compare Group-IB Threat Intelligence Platform with any tool side by side →

Featured on iTechGuides

Group-IB Threat Intelligence Platform is listed in our Threat Intelligence Platforms directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/group-ib-threat-intelligence-platform/"><img src="https://www.itechguides.com/best/badge/group-ib-threat-intelligence-platform.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update