ThreatForge review
A broad free toolkit for IOC investigation, monitoring, reporting, and case work.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
ThreatForge is an open-source cyber threat intelligence and digital risk protection platform for security analysts, SOC teams, fraud teams, and researchers. Its Community Edition covers IOC intake for IPs, domains, URLs, hashes, email addresses, and CVEs, then enriches observables with public threat-intelligence sources. Explainable risk scoring from 0 to 100, technical Markdown reports, investigation cases, evidence, notes, assignments, and audit trails give small teams a structured way to move from an indicator to a documented investigation. Web, API, and self-hosted deployment options broaden its fit, while Docker supports deployment of the Community Edition.
The strongest case for ThreatForge is breadth in a free open-source package. Alongside core investigation features, it includes brand monitoring, typosquatting detection, Certificate Transparency discovery, attack-surface intelligence, credential intelligence, and alerting through Telegram, webhooks, and SMTP. Integrations include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK, and EPSS/FIRST. Multi-tenant architecture and role-based access controls also give the product a useful foundation for teams handling separate environments or users. Teams looking for public-source enrichment and explainable investigation output should find the feature mix well aligned with day-to-day triage.
The main qualification is product maturity and edition structure. The public repository is a Community Preview rather than a stable 1.0 release, so organizations should account for that when evaluating operational adoption. A separate commercial Enterprise overlay adds premium capabilities, making edition selection part of the buying decision. ThreatForge suits small security, fraud, and research teams that want self-hosted or API-based IOC work without a paid Community Edition. Larger organizations requiring a mature release process, or teams whose workflow depends on integrations beyond the listed ecosystem, should compare alternatives before standardizing.
ThreatForge pros and cons
- Where it wins
- Free open-source IOC intake, enrichment, scoring, and reporting
- Cases include evidence, assignments, notes, and audit trails
- Brand monitoring, alerts, attack-surface, and credential intelligence
- Where it doesn't
- Community Preview is not a stable 1.0 release
- Some premium capabilities require the commercial Enterprise overlay
- Its published integration set centers on public sources and listed services
ThreatForge fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update