Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

ThreatQ review

#5 of 32 in Threat Intelligence Platforms

A broad threat intelligence platform for prioritizing and operationalizing security data.

8.8/10Editor score
Visit ThreatQ
ThreatQ8.8 Visit ThreatQ

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

ThreatQ is a cyber threat intelligence platform for security teams that collect, prioritize, analyze, and operationalize intelligence. It brings together commercial, open-source, partner, internal, and structured or unstructured data, then supports normalization, correlation, contextual enrichment, scoring, and prioritization. Its audience is security operations teams that need a central intelligence layer for detection, investigation, and response rather than a standalone feed reader.

ThreatQ’s ecosystem fit is a central strength. It integrates with SIEM, EDR, NDR, sandboxes, ticketing systems, enrichment platforms, and detection and response platforms. APIs, SDKs, and custom connectors extend that reach, while STIX import and TAXII-based exchange support structured intelligence sharing. The Threat Library provides centralized management, and collaborative investigations add visualization, documentation, evidence, and timelines. Teams can also connect intelligence to data-driven detection and response workflow automation.

The platform is most suitable when an organization needs breadth across ingestion, intelligence management, investigation, and operational response. Its hybrid deployment model and broad integration surface favor teams with established security operations processes and integration requirements. Pricing uses a contact-sales model, and the published offering includes optional modules for investigations, intelligence exchange, and automation. Organizations seeking prioritization across many intelligence sources should consider ThreatQ; teams wanting a narrowly focused, self-service intelligence tool may prefer a simpler alternative.

ThreatQ pros and cons

  • Where it wins
    • Normalizes, enriches, scores, and prioritizes threat indicators
    • Connects with SIEM, EDR, NDR, sandboxes, and ticketing systems
    • Supports investigations, automation, STIX, TAXII, APIs, and custom connectors
  • Where it doesn't
    • Contact-sales pricing requires a direct buying conversation
    • The broad feature set may exceed narrower intelligence needs
    • Hybrid deployment may require coordination across environments

ThreatQ fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update