# Best Threat Intelligence Software - Page 6 *By [Brandon Summers-Miller](https://research.g2.com/insights/author/brandon-summers-miller)* Threat intelligence software provides organizations with information related to the newest forms of cyber threats like zero-day attacks, new forms of malware, and exploits. Companies use these tools to keep their security standards up to date and fit to address new threats as they emerge. These tools can improve security performance by providing information on threats to their specific networks, infrastructure, and endpoint devices. Threat intelligence software provides information about hazards and how they function, their capabilities, and remediation techniques. IT administrators and security professionals use the delivered data to better protect their systems from emerging threats and plan for possible vulnerabilities. The tools alert users as new threats emerge and provide information detailing best practices for resolution. Many products, like [security information and event management (SIEM) software](https://www.g2.com/categories/security-information-and-event-management-siem) and [vulnerability management software](https://www.g2.com/categories/vulnerability-management), can integrate with or provide similar information as threat intelligence products. Additionally, these products continue to integrate with artificial intelligence (AI) to better tailor this complex suite of data for specific organizations’ needs. These newer capabilities can include being able to generate threat reports based on newly aggregated threat intelligence data. This data directly pertains to the organization where the software is deployed. The newer capabilities also help in creating threat detection rules based on observed patterns in malicious actors’ behaviors. To qualify for inclusion in the Threat Intelligence category, a product must: - Provide information on emerging threats and vulnerabilities - Detail remediation practices for common and emerging threats - Analyze global threats on different types of networks and devices - Cater threat information to specific IT solutions ## How Many Threat Intelligence Software Products Does G2 Track? **Total Products under this Category:** 187 ### Category Stats (May 2026) - **Average Rating**: 4.58/5 (↑0.01 vs Apr 2026) - **New Reviews This Quarter**: 117 - **Buyer Segments**: Mid-Market 55% │ Enterprise 29% │ Small-Business 16% - **Top Trending Product**: Seerist (+0.25) *Last updated: May 18, 2026* ## How Does G2 Rank Threat Intelligence Software Products? **Why You Can Trust G2's Software Rankings:** - 30 Analysts and Data Experts - 4,600+ Authentic Reviews - 187+ Products - Unbiased Rankings G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category. ## Top Threat Intelligence Software at a Glance | # | Product | Rating | Best For | What Users Say | |---|---------|--------|----------|----------------| | 1 | [CrowdStrike Falcon Endpoint Protection Platform](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews) | 4.6/5.0 (385 reviews) | Endpoint threat detection and response | "[Top-Notch Security with Easy Deployment](https://www.g2.com/survey_responses/crowdstrike-falcon-endpoint-protection-platform-review-12651719)" | | 2 | [Recorded Future](https://www.g2.com/products/recorded-future/reviews) | 4.6/5.0 (224 reviews) | External threat intelligence investigation | "[Real-Time, Actionable Threat Intelligence with Seamless Security Tool Compatibility](https://www.g2.com/survey_responses/recorded-future-review-12733983)" | | 3 | [CloudSEK](https://www.g2.com/products/cloudsek/reviews) | 4.8/5.0 (133 reviews) | Digital risk and brand threat monitoring | "[Comprehensive threat intelligence with an intuitive interface and top-tier support](https://www.g2.com/survey_responses/cloudsek-review-12721015)" | | 4 | [Cyble](https://www.g2.com/products/cyble/reviews) | 4.8/5.0 (141 reviews) | Dark web and brand exposure intelligence | "[Comprehensive Threat Monitoring with Actionable Alerts](https://www.g2.com/survey_responses/cyble-review-12116483)" | | 5 | [SOCRadar Extended Threat Intelligence](https://www.g2.com/products/socradar-extended-threat-intelligence/reviews) | 4.7/5.0 (102 reviews) | Attack surface and dark web risk visibility | "[Broad, Cost-Effective Threat Intelligence with Smooth Onboarding and Easy Integrations](https://www.g2.com/survey_responses/socradar-extended-threat-intelligence-review-12839690)" | | 6 | [GreyNoise](https://www.g2.com/products/greynoise/reviews) | 4.8/5.0 (128 reviews) | Internet scanning noise reduction | "[Strong IP intelligence with easy integrations into existing tools](https://www.g2.com/survey_responses/greynoise-review-12725962)" | | 7 | [ZeroFox](https://www.g2.com/products/zerofox/reviews) | 4.4/5.0 (133 reviews) | External brand impersonation protection | "[ZeroFox Fills the Gap Traditional Security Tools Miss](https://www.g2.com/survey_responses/zerofox-review-11891542)" | | 8 | [Cloudflare Application Security and Performance](https://www.g2.com/products/cloudflare-application-security-and-performance/reviews) | 4.5/5.0 (578 reviews) | Application protection with performance controls | "[Cloudflare Application Security and Performence: Reliable, Fast, and Secure Platform](https://www.g2.com/survey_responses/cloudflare-application-security-and-performance-review-12852761)" | | 9 | [CTM360](https://www.g2.com/products/ctm360-ctm360/reviews) | 4.7/5.0 (117 reviews) | External attack surface and takedown operations | "[Exceptional Cyber Threat Intelligence Platform That Delivers Actionable Security Insights](https://www.g2.com/survey_responses/ctm360-review-11298228)" | | 10 | [Falcon Security and IT operations](https://www.g2.com/products/falcon-security-and-it-operations/reviews) | 4.6/5.0 (21 reviews) | Endpoint security and IT operations visibility | "[Visibility, Traceability and Remediation for Vulnerability and Threat Protection all in one solution](https://www.g2.com/survey_responses/falcon-security-and-it-operations-review-12029947)" | ## Which Threat Intelligence Software Is Best for Your Use Case? - **Leader:** [CrowdStrike Falcon Endpoint Protection Platform](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews) - **Highest Performer:** [GreyNoise](https://www.g2.com/products/greynoise/reviews) - **Easiest to Use:** [CloudSEK](https://www.g2.com/products/cloudsek/reviews) - **Top Trending:** [Doppel](https://www.g2.com/products/doppel/reviews) - **Best Free Software:** [CrowdStrike Falcon Endpoint Protection Platform](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews) ## Which Type of Threat Intelligence Software Tools Are You Looking For? - [Threat Intelligence Software](https://www.g2.com/categories/threat-intelligence) *(current)* - [Dark Web Monitoring Tools](https://www.g2.com/categories/dark-web-monitoring) - [ Attack Surface Management Software](https://www.g2.com/categories/attack-surface-management) - [Digital Risk Protection (DRP) Platforms](https://www.g2.com/categories/digital-risk-protection-drp-platforms) --- **Sponsored** ### Pure Signal™ Scout Scout Ultimate is a web-based threat intelligence tool for security analysts of all experience levels. With a simple GUI, graphical displays, tagged results, and easy to use searches, it helps quickly determine if suspicious IPs are malicious or compromised. It is the place to start investigations for single IPs, domains, or entire CIDR ranges related to malicious activity. [Visit website](https://www.g2.com/external_clickthroughs/record?secure%5Bad_program%5D=paid_promo&secure%5Bad_slot%5D=category_product_list&secure%5Bcategory_id%5D=1080&secure%5Bmedium%5D=sponsored&secure%5Bprioritized%5D=false&secure%5Bproduct_id%5D=1328369&secure%5Bresource_id%5D=1080&secure%5Bresource_type%5D=Category&secure%5Bsource_type%5D=category_page&secure%5Bsource_url%5D=https%3A%2F%2Fwww.g2.com%2Fcategories%2Fthreat-intelligence&secure%5Btoken%5D=75febe432fae31c81e82b71eb53dbca9af9d66a64ce62b6ede28e0e6adfdb833&secure%5Burl%5D=https%3A%2F%2Fwww.team-cymru.com%2Fpure-signal-scout&secure%5Burl_type%5D=paid_promos) --- ## Buyer Guide: Key Questions for Choosing Threat Intelligence Software Software ### What does Threat Intelligence Software do? When people ask me about threat intelligence software, I usually explain it as tools that help security teams detect, understand, prioritize, and respond to external cyber risks. But in practice, I see threat intelligence software as something bigger: it gives teams a clearer way to monitor threat feeds, dark web activity, exposed credentials, phishing risks, attack surfaces, brand abuse, vulnerabilities, and risk signals. Instead of reacting only after an incident grows, teams can use real-time alerts, dashboards, and actionable context to identify relevant threats earlier and respond with more confidence. ### Why do businesses use Threat Intelligence Software? From the G2 reviewer patterns I evaluated, businesses use Threat Intelligence Software because external threats are hard to track across dark web sources, domains, IPs, leaked credentials, phishing sites, and exposed assets. Users mention alert overload, limited visibility, false positives, and manual investigation work as common challenges. Common benefits include: - Earlier detection of credential leaks, phishing domains, and brand impersonation. - Clearer visibility into external attack surfaces and exposed assets. - More actionable threat context for SOC and security teams. - Faster investigation through dashboards, reports, and enriched indicators. - Better prioritization of risks, alerts, vulnerabilities, and incidents. - Support for takedown, remediation, and response workflows. ### Who uses Threat Intelligence Software primarily? After I evaluated G2 reviewer roles, I found that Threat Intelligence Software supports several security-focused groups. - **SOC analysts** use alerts, indicators, and context to investigate threats. - **Security administrators** manage configuration, workflows, and platform access. - **Threat intelligence teams** track adversaries, infrastructure, and emerging risks. - **Incident response teams** use intelligence to validate and contain threats. - **Risk and compliance teams** use reports to understand exposure and posture. - **Consultants** support client investigations, assessments, and security programs. - **Security leaders** review risk trends and operational effectiveness. ### What types of Threat Intelligence Software should I consider? From the way reviewers describe the category, buyers should compare several types: - **Threat feed platforms** that provide indicators, reputation data, and enrichment. - **Digital risk protection tools** for brand abuse, phishing, impersonation, and takedown. - **Dark web intelligence platforms** for leaked credentials, actor activity, and underground sources. - **External attack surface platforms** for exposed assets, domains, services, and vulnerabilities. - **SOC-integrated tools** that connect intelligence to SIEM, SOAR, and incident workflows. - **Open-source or community intelligence platforms** for shared indicators and research. ### What are the core features to look for in Threat Intelligence Software? When I break down G2 reviews for this category, I look closely at the themes users repeatedly mention: - Real-time alerts with severity and prioritization that help security teams focus on the most urgent threats first. - Dark web, credential leak, phishing, and brand protection coverage that help teams monitor external risks before they escalate. - External attack surface discovery and vulnerability context that help identify exposed assets and understand where the organization may be at risk. - Indicator enrichment for IPs, domains, URLs, files, and threat actors that help analysts investigate suspicious activity with more context. - Dashboards, reporting, and search tools that help teams track threats, support investigations, and communicate findings clearly. - Integrations with SIEM, SOAR, APIs, and security tools that help connect threat intelligence to existing detection and response workflows. - Takedown, remediation, and case management support that help teams move from identifying threats to resolving them. - Low false-positive rates and alert tuning controls that help reduce noise and improve trust in the platform. - Responsive support and onboarding guidance that help teams configure feeds, alerts, and workflows more effectively. ### What trends are shaping Threat Intelligence Software right now? From the G2 review patterns I evaluated, several trends stand out: - **AI-assisted intelligence** is speeding up analysis as teams use summaries, alerts, and automated context to understand threats faster. - **Actionable context is becoming more important than raw feeds** as buyers look for intelligence that helps teams prioritize and respond, not just collect more data. - **External attack surface and digital risk protection are converging** as platforms combine asset exposure, brand risk, phishing, credential leaks, and threat monitoring. - **Dark web and credential leak visibility** remain core expectations as teams look for earlier warning signs of compromised accounts or exposed business data. - **SOC workflow integrations** are becoming essential as security teams connect intelligence with SIEM, SOAR, ticketing, and incident response tools. - **Alert quality and usability** are shaping satisfaction as buyers scrutinize false positives, interface clarity, pricing, and how easy it is to act on findings. ### How should I choose Threat Intelligence Software? For me, the strongest Threat Intelligence Software fit depends on your exposure profile, investigation process, and response maturity. G2 reviewers praise products with relevant alerts, broad source coverage, clean dashboards, useful integrations, and strong support. I would also examine concerns around false positives, setup effort, learning curve, takedown speed, customization, and cost before making a final choice. --- ## What Are the Top-Rated Threat Intelligence Software Products in 2026? ### 1. [Cavalier](https://www.g2.com/products/cavalier/reviews) **Product Description:** Cavalier™ by Hudson Rock is a cutting-edge cyber intelligence platform designed to give organizations unprecedented visibility into compromised credentials and infected endpoints affecting employees, customers, and third-party vendors. At its core, Cavalier relies on one of the world’s most comprehensive databases of data stolen by infostealer malware, a fast-growing threat vector behind ransomware attacks, account takeovers, and corporate breaches. Unlike traditional dark web monitoring tools that only surface leaked credentials after they appear in dumps or marketplaces, Cavalier provides real-time intelligence on compromised identities and machines as soon as they are exfiltrated. This proactive approach allows security teams to identify which accounts, corporate assets, or partners are at risk before adversaries can exploit them. Cavalier is built for versatility and scale. Security and threat intelligence teams use it to continuously monitor digital exposure, cyber insurance providers rely on its data to assess policyholder risks, Managed Security Service Providers integrate it to enhance client protection, and third-party risk management platforms enrich their scoring models with Cavalier’s unique intelligence. The platform delivers actionable insights through both an intuitive interface and robust APIs, making it easy to integrate into existing SOC workflows, SIEMs, or other security solutions. With coverage that spans millions of infected endpoints worldwide, Cavalier equips organizations with the context and foresight needed to reduce breach risk, improve incident response, and strengthen resilience against today’s most persistent cyber threats. In short, Cavalier is the go-to solution for organizations seeking to prevent account takeovers, ransomware, and supply chain attacks before they happen. ### 2. [Criminal IP ASM](https://www.g2.com/products/criminal-ip-asm/reviews) **Product Description:** Criminal IP Attack Surface Management solution that helps you proactively understand your cyber space's security posture by automatically detecting and monitoring all your cyber assets, while leveraging the OSINT, AI and ML capabilities of the Criminal IP search engine in accurately assessing the risks and vulnerabilities associated with each asset on daily basis. With a single domain registration, gain true visibility into your attack surface. -Get detailed information on the risks and vulnerabilities that target your assets (IPs/Domains) with free access to the Criminal IP search engine. ### 3. [Cyber Exposure Platform](https://www.g2.com/products/cyber-exposure-platform/reviews) **Product Description:** Cyber Intelligence House empowers Managed Security Service Providers (MSSPs), Cyber Insurers and cybersecurity consultancies with advanced Cyber Exposure and Threat Intelligence capabilities. Our data and technology provides real-time insights into threats originating from the dark web, deep web, data breaches, social channels and infostealer logs, helping our partners protect and serve their clients by identifying and addressing external risks before they impact critical assets. We specialize in detecting compromised credentials, exposed sensitive data, marketplaces and emerging cybercriminal activities targeting organizations. By offering continuous monitoring and external threat assessments, we enable MSSPs to proactively enhance their clients' security postures and build evidence-based risk roadmaps. ### 4. [CybersecTools](https://www.g2.com/products/cybersectools/reviews) **Product Description:** CybersecTools is the largest discovery platform for cybersecurity products, giving enterprise security teams a single place to explore the entire cybersecurity market. The platform tracks over 9,000 products and 3,200 vendors, helping CISOs and security buyers compare solutions, find alternatives, and evaluate products before making purchasing decisions. For security startups and scaleups, CybersecTools provides a channel to get discovered and gain visibility with the audience of security buyers actively researching tools, shortening the path from awareness to evaluation in a crowded market.” ### 5. [Cyber Threat Intelligence Feed](https://www.g2.com/products/cyber-threat-intelligence-feed/reviews) **Product Description:** Cyber Threat Intelligence Feed delivers continuous up-to-the-minute information and context about cyberattacks that threaten an organization's safety. It enables comprehensive monitoring, detection, and response to online threats, providing a multi-source database that supports cyberdefence mechanisms. The CTI Feed covers all major attack vectors like malicious URLs, phishing URLs, spam, bot IPs, social media, and websites. ### 6. [Darkweb Tracker](https://www.g2.com/products/darkweb-tracker/reviews) **Product Description:** Darkweb Tracker is an advanced deep and dark web intelligence platform developed by StealthMole. Leveraging cutting-edge AI technology and open-source intelligence (OSINT) techniques, it systematically collects, categorizes, and analyzes data from both open and concealed online sources. This empowers users to efficiently access, interpret, and derive critical insights from vast amounts of information. ### 7. [Dataminr Pulse for Cyber Risk](https://www.g2.com/products/dataminr-pulse-for-cyber-risk/reviews) **Product Description:** Dataminr Pulse for Cyber Risk is an AI-driven solution designed to enhance organizational resilience by providing real-time detection of external cyber events, risks, and threats. By analyzing over one million public data sources, it delivers actionable intelligence across four critical areas: digital risk, third-party risk, vulnerability intelligence, and cyber-physical risk. This comprehensive approach enables security teams to proactively identify and mitigate potential threats, ensuring the protection of digital assets and the continuity of business operations. ### 8. [DynaRisk](https://www.g2.com/products/dynarisk/reviews) **Product Description:** DynaRisk's Breach Defence software empowers small to medium sized businesses to be safer online. Cyber attacks are constant and are always evolving. 60% of SMEs can go out of business within 6 months of suffering a cyber attack. SMEs need simple yet comprehensive cyber risk management solutions to manage complex cyber risks. This is why DynaRisk has developed Breach Defence to give SMEs the tools they need to defend against cyber attacks. ### 9. [EclecticIQ Platform](https://www.g2.com/products/eclecticiq-platform/reviews) **Product Description:** EclecticIQ Platform re-imagines intelligence, hunting and response, by delivering intelligence-led solutions to Threat Intelligence, Endpoint Security and Security Operations challenges. ### 10. [Falconfeedsio](https://www.g2.com/products/falconfeedsio/reviews) **Product Description:** Falcon Feeds.io is a cutting-edge, cloud-native SaaS platform that specializes in cyber threat intelligence. It vigilantly monitors and delivers the latest security incidents and insights on threat actors from around the globe, around the clock. Our expansive coverage includes the surface web, Tor networks, and Telegram channels. With Falcon Feeds.io, you can: Continuous Monitoring: Keep a watchful eye on threat actors, ransomware attacks, DDoS attacks, and other security incidents around the clock. Comprehensive Analysis: Stay informed about the most affected geographies, industries, organizations, and domains in real-time. Unrestricted Access: Gain unlimited access to our extensive threat feed database to empower your security measures. Customizable Alerts: Configure alerts tailored to new threats related to specific threat actors, incident categories, countries, industries, organizations, and domains. Seamless Integration: Utilize our robust API and Webhook integration for a smooth and streamlined security workflow. Real-Time Notifications: Get instant notifications through Slack, Microsoft Teams, and email, ensuring you never miss a critical update. ### 11. [Horizon®](https://www.g2.com/products/shadowdragon-horizon/reviews) **Product Description:** Horizon® is an open source intelligence and data analysis platform that enables organizations to collect, analyze, and operationalize publicly available online information to support investigations, security operations, and risk management. The platform is designed to help users identify relevant digital signals, monitor online activity, and derive actionable insights from large volumes of open source data. Horizon® supports a wide range of investigative and intelligence workflows by providing tools to search across surface web sources, analyze online entities, and identify connections between people, organizations, and digital infrastructure. It is used by security teams, investigators, analysts, and risk professionals who require timely access to structured and unstructured online information. Common use cases include threat intelligence, investigations, fraud detection, insider risk analysis, and situational awareness. The platform enables users to conduct targeted searches, track changes over time, and organize findings within a centralized environment. Horizon® is built to support both proactive monitoring and reactive investigations, allowing teams to respond to emerging risks and incidents more efficiently. It integrates data collection with analysis and reporting workflows, helping users move from raw information to informed decision making. Horizon® is used across multiple industries, including enterprise security, government, financial services, and compliance driven organizations. It supports collaboration among teams by enabling shared access to findings and consistent investigative processes. The platform is designed to scale with organizational needs and accommodate both routine monitoring and complex investigative requirements. Key capabilities of Horizon® include: - Open source data collection and search across online environments - Entity analysis to identify relationships and digital footprints - Monitoring and alerting to track changes and emerging activity - Investigation workflows for organizing, analyzing, and reporting findings - Support for security, intelligence, and risk management use cases By combining data collection, analysis, and operational workflows in a single platform, Horizon® helps organizations better understand online activity and manage digital risk using publicly available information. ### 12. [IDARK360](https://www.g2.com/products/idark360/reviews) **Product Description:** IDARK360 is an advanced platform offering 360-degree protection against modern cyber risks, focusing on four key areas: Dark Web Discovery and Monitoring: Accurate identification of your stolen data trading (credentials, IP, customer data) for early threat neutralization. Brand Identity Protection: Immediate monitoring for impersonation and phishing, with rapid removal of fraudulent content to safeguard your reputation. Security Controls Governance: Continuous and precise assessment of compliance with global controls (NIST, NCA) and gap management via a unified dashboard. Cyber Awareness and Culture Building: Employee Training: Providing simulated and realistic training programs to enhance employee vigilance. Phishing Simulation: Periodically testing the effectiveness of the human defence layer and identifying individual and collective weaknesses. Transforming Employees into a Defence Line: Reducing human errors that cause a significant percentage of breaches. ### 13. [Infoblox Threat Defense](https://www.g2.com/products/infoblox-threat-defense/reviews) **Average Rating:** 4.8/5.0 **Total Reviews:** 5 **Product Description:** Infoblox Threat Defense provides preemptive security using a combination of predictive threat intelligence and ML- based algorithmic detections to stop threats before they reach users, devices or cloud workloads. ### What Do G2 Reviewers Say About Infoblox Threat Defense? *AI-generated summary from verified user reviews* **Pros:** - Users value the **instant threat detection** of Infoblox Threat Defense, ensuring robust security without performance impact. - Users commend **instant threat detection** in Infoblox Threat Defense, ensuring robust protection without compromising system speed. - Users value the **instant threat detection and protection** provided by Infoblox Threat Defense, enhancing overall network security. - Users appreciate the **automation capabilities** of Infoblox Threat Defense, enhancing security through advanced analytics and machine learning. - Users value the **cloud integration and advanced analytics** of Infoblox Threat Defense for enhanced DNS security. **Cons:** - Users find the **complex setup** of Infoblox Threat Defense to be challenging, requiring significant effort to configure properly. - Users note that Infoblox Threat Defense can be **expensive** compared to other options, impacting overall affordability. #### What Are Recent G2 Reviews of Infoblox Threat Defense? **"[BloxOne Threat Defense](https://www.g2.com/survey_responses/infoblox-threat-defense-review-8915153)"** **Rating:** 5.0/5.0 stars *— Som Dutt S.* [Read full review](https://www.g2.com/survey_responses/infoblox-threat-defense-review-8915153) --- **"[Tough Security Solution with Some Setup Challenges](https://www.g2.com/survey_responses/infoblox-threat-defense-review-10169597)"** **Rating:** 5.0/5.0 stars *— Akshay B.* [Read full review](https://www.g2.com/survey_responses/infoblox-threat-defense-review-10169597) --- #### What Are G2 Users Discussing About Infoblox Threat Defense? - [What is BloxOne Threat Defense used for?](https://www.g2.com/discussions/what-is-bloxone-threat-defense-used-for) ### 14. [Infrawatch](https://www.g2.com/products/infrawatch/reviews) **Product Description:** Infrawatch scans the global public IPv4 and IPv6 ranges for malicious infrastructure. Identify malicious hosts before they are operationalised by an adversary. Discover, block, and explore residential proxy networks, VPNs, command-and-control (C2) servers, and more - all in real-time and attributed to a service. ### 15. [InSights](https://www.g2.com/products/inquest-insights/reviews) **Product Description:** Harness InQuest’s unique perspective and insight to find threats months before the competition. Our Threat Intelligence team gathers and analyzes unique data sources from open source industry feeds, as well as InQuest proprietary data sets, to provide you with leading edge and highly-trusted indicators of compromise so you can stay ahead of emerging threats and reduce dwell times. ### 16. [isMalicious](https://www.g2.com/products/ismalicious/reviews) **Product Description:** isMalicious is a real-time threat intelligence platform that helps security teams and developers detect malicious IPs, domains, and URLs. It aggregates data from 600+ curated intelligence sources into a database of 500M+ threat records, delivering sub-100ms API responses for production-grade security decisions. Unlike file-focused scanners, isMalicious is purpose-built for IP and domain reputation checking at scale. The unified REST API covers IPs, domains, URLs, email addresses, and file hashes through a single endpoint. Features include a Streaming API for real-time threat feeds (\<5s latency), webhooks for event-driven alerting, built-in monitoring with watchlists, and bulk processing for batch operations. isMalicious offers official SDKs for Python, Node.js, Go, and Rust, plus an interactive API playground for testing. It integrates with any SIEM (Splunk, QRadar, Sentinel), SOAR platform, or custom application — no vendor lock-in. Enterprise plans with STIX/TAXII and dedicated infrastructure are available. ### 17. [Ivanti Neurons for VULN KB](https://www.g2.com/products/ivanti-neurons-for-vuln-kb/reviews) **Product Description:** Ivanti Neurons for Vulnerability Knowledge Base (VULN KB) arms security experts with authoritative vulnerability threat intelligence plus risk-based scoring of vulnerabilities. Its intelligence is derived from vulnerability findings ingested from over 100 independent sources plus manual findings from research and pen testing teams. Unlike CVSS, Ivanti’s risk scoring accounts for active threat context – including ties to ransomware. Additionally, risk scores are constantly updated based on real-world threat information to ensure security experts always have a current perspective of the cyber risks their organization faces. With Ivanti Neurons for VULN KB, users can create informed plans based on threat context to mitigate risk exposure without having to wait for scan findings. Ivanti Neurons for VULN KB provides immediate access to detailed information on all known CVEs and CWEs, even those CVEs coming from CVE Numbering Authorities (CNAs) before they are officially scored by the NVD. ### 18. [Jizô](https://www.g2.com/products/jizo/reviews) **Product Description:** Jizô is a network observability platform that enables decision-makers to anticipate, identify and block cyber-attacks, thanks to unique and innovative AI. Jizô has proved to be highly effective on a number of critical networks used by major companies and public authorities. Sesame\*it, the publisher of Jizô, is one of the Representative Vendors in the Gartner® Market Guide 2024 for Network Detection and Response Solutions. ### 19. [Kaspersky Threat Data Feeds](https://www.g2.com/products/kaspersky-threat-data-feeds/reviews) **Product Description:** Over 30 threat data feeds, tailored to diverse security needs across both IT and OT, provide information on known malware, phishing websites, the latest vulnerabilities, and exploits. Kaspersky Threat Data Feeds provide information on known malware, phishing websites, latest vulnerabilities, exploits, and more. Organizations can use this information to block malicious traffic, update their security software, and take other measures to protect themselves from cyberattacks. • Reinforces your security solutions, including SIEMs, NGFW, IPS / IDS, security proxy, etc., with continuously updated IoCs and actionable context • Improves detection quality, reduces false positives and protects the software development process thanks to actionable context • Integrates with security controls and TI platforms, including Kaspersky CyberTrace, for effective threat intelligence management and proactive cyber threat protection • Helps security teams quickly identify critical alerts from SIEM, NGFW, TI platforms, and prioritize them for incident response teams by automating the initial triage process ### 20. [KELA Threat Intelligence Platform](https://www.g2.com/products/kela-threat-intelligence-platform/reviews) **Product Description:** KELA’s Unified Threat Intelligence Platform is an all-in-one solution for Cyber Threat Intelligence (CTI), External Attack Surface Management (EASM), Digital Risk Protection Services (DRPS), and Third-Party Risk Management (TPRM), delivering real-time, actionable insights. The platform protects identities, brands, digital exposure, and the supply chain, seamlessly integrating into existing security controls and acting as the first line of defense against cyber threats from the cybercriminal underground. It monitors national risks, critical infrastructure, and supports dark web and cybercrime investigations, helping organizations close security gaps and stay ahead of evolving threats. KELA serves hundreds of customers, including enterprises, MSSPs, law enforcement agencies, CERTs, and government agencies worldwide ### 21. [LeakRadar](https://www.g2.com/products/leakradar/reviews) **Product Description:** LeakRadar is a comprehensive data breach monitoring platform designed to provide organizations with instant visibility into underground credential leaks. By indexing over 290 billion plain-text credentials from malware logs, combolists, database breaches, and dark-web dumps, LeakRadar enables users to detect and respond to compromised credentials before malicious actors can exploit them. Key Features and Functionality: - Plain-Text Credentials: Access passwords exactly as stolen, without hashes or redactions, facilitating accurate assessments of exposure. - Email and Domain Search: Quickly identify leaks associated with specific email addresses or entire company domains, streamlining the detection process. - Advanced Filters: Utilize detailed search parameters, including URL, username, and email domain, to refine results and focus on relevant data. - Extensive Database with Rapid Lookup: Query a vast repository of over 290 billion records in milliseconds, ensuring timely access to critical information. - API Integration: Seamlessly incorporate LeakRadar into Security Operations Centers (SOCs) through a straightforward REST API, enhancing existing security workflows. Primary Value and User Solutions: LeakRadar empowers security teams to proactively monitor and manage credential leaks, reducing the risk of unauthorized access and potential data breaches. By providing real-time alerts and comprehensive search capabilities, organizations can swiftly identify compromised accounts, enforce password resets, and implement multi-factor authentication, thereby strengthening their overall security posture. Additionally, LeakRadar's domain monitoring feature assists in mapping exposure across employees, third-party vendors, and customers, enabling a holistic approach to credential leak management. ### 22. [Liferaft](https://www.g2.com/products/liferaft/reviews) **Product Description:** Liferaft utilizes OSINT tools to provide a comprehensive and curated overview of active physical threats, information leaks, security exposures, and risks to your assets, operations, and people, all in one integrated OSINT platform. Liferaft ensures early risk detection, giving you a distinct advantage. Early detection allows security teams to stay ahead of issues that can disrupt your business or brand, damage property, or put your people at risk. The real-time detection and validation process identifies risks based on the current online environment and takes quick action to reduce them. Liferaft does this through methods such as automation and filtering posts through targeted keywords. From monitoring to investigation, to incident and case management, Liferaft has you covered! ### 23. [Lupovis Prowl](https://www.g2.com/products/lupovis-prowl/reviews) **Product Description:** Prowl analyzes and collects data on Internet-wide scans and attacks in real-time. We use this data to identify and classify malicious actors. By constantly monitoring the Internet, Prowl detects known and emerging threats and helps streamline SOC analysts' workflows to quickly identify and prioritize critical threats, while disregarding unnecessary or harmless activity. ### 24. [MAANG – AI-Powered Cyber Threat Management by SwiftSafe](https://www.g2.com/products/maang-ai-powered-cyber-threat-management-by-swiftsafe/reviews) **Product Description:** MAANG – AI-Powered Cyber Threat Management by SwiftSafe In today’s dynamic cyber threat landscape, organizations need more than reactive defenses—they require proactive, intelligent, and automated protection. That's where MAANG comes in. Developed by SwiftSafe, MAANG is a comprehensive, AI- and ML-enhanced cybersecurity platform designed to detect, analyze, and neutralize threats in real-time, making it an essential solution for businesses committed to robust, scalable cyber defense. What Sets MAANG Apart Real-Time Threat Intelligence: MAANG delivers real-time threat insights driven by machine learning to help you stay one step ahead of cyber adversaries. Advanced Threat Detection & Prediction: By leveraging AI-powered future threat alerts and deep threat modeling, MAANG not only detects current vulnerabilities but forecasts risks before they occur.&nbsp; Continuous, Agentless Monitoring: With non-intrusive monitoring, MAANG maintains visibility across your network and infrastructure without requiring endpoint agents. Customized for All Business Sizes: Whether you're a startup, SMB, or large enterprise, MAANG’s flexible architecture and tiered pricing ensure the right fit—and scale—for your organization. Core Features & Capabilities: Threat Analytics & AI-Driven Insights MAANG conducts deep threat analysis to surface vulnerabilities and abnormal behavior in real time. It learns from attack patterns to refine detection and improve accuracy. Prioritized Remediation Threat alerts are accompanied by clear, actionable guidance—highlighting what matters most and ensuring swift, effective mitigation of critical risks. Comprehensive Threat Reporting MAANG provides detailed, audit-ready threat reports that evolve with your environment, empowering both technical teams and decision-makers with meaningful insights.&nbsp; 24/7 Monitoring & Alerting Round-the-clock threat surveillance ensures vulnerabilities and incidents are identified and addressed swiftly, reducing the window for exploitation. Multi-Layered Security Stack Deep Infrastructure Scans: Identifies weaknesses and aligns with patch management workflows. Live Threat Probes: Constant scrutiny across servers, applications, and network layers. Intrusion Detection: Real-time traffic analysis and policy enforcement. Compliance Posturing: Expertly monitors data against standards like HIPAA, ISO 27001, and PCI DSS. Automated & Manual Reviews: Includes source code and database assessments, log tracking, and alert ownership workflows.&nbsp; Pricing Tiers Mid-Scale Plan: Priced at $10/month or $100/year, this tier offers enhanced cyber-risk detection, proactive AI threat alerts, and real-time threat intelligence. Custom Plan: Tailored to complex security requirements—offering advanced integration, compliance planning, and bespoke analytics. Contact SwiftSafe for personalized pricing.&nbsp; Additional Tiers: SoftwareSuggest references suggest optional tiers like Starter ($5/month), Business ($15/month), and Enterprise (custom), each offering incremental capabilities from basic threat detection to full compliance and dedicated support.&nbsp; Ideal For Startups & SMBs: Scalable AI defense that begins as basic threat intelligence and grows with your business needs. Enterprises: Mature organizations benefit from MAANG’s multi-layered protection, compliance alignment, and predictive threat intelligence. Security-Conscious Teams: Ideal wherever fast, intelligent response to threats is vital—across IT service providers, financial institutions, healthcare, retail, and more. How MAANG Works (4-Step Flow) Threat Analysis Aggregates and refines global threat data to uncover real threats within your infrastructure. Remediation Guidance Delivers prioritized, context-aware recommendations to neutralize threats efficiently. Detailed Reporting Generates evolving threat summaries—technical and executive level—tailored for decision-making. Continuous Monitoring Ensures your systems stay secure over time through persistent vigilance and adaptive protection.&nbsp; Benefits at a Glance: Proactive Threat Prediction Reduces risk by neutralizing threats before they occur Scalable Coverage Perfect for startups to enterprises—MAANG scales as you grow Compliance Alignment Helps meet regulations like HIPAA and ISO 27001 with ease Reduced False Positives AI augmented by strategic intelligence for precision Operational Resilience Fast detection and intuitive remediation keep downtime minimal Why MAANG is a Game-Changer MAANG transcends standard security tools by blending AI-powered intelligence, predictive analytics, and automated remediation, set within a continuous monitoring framework. It empowers organizations to move from reactive defense to proactive resilience—while staying compliant and engaged. Case testimonials reflect this impact: “MAANG excels in end-to-end protection for IT infrastructure…” — Jilani Pasha, CEO, C-Trace “AI-driven threat intelligence enhances our ability to tackle threats…” — Pablo Cabrera, CEO, Cabrera “Proactively neutralizes threats in VibesMalerafirma’s IT infrastructure…” — Kim Hagenow, CEO, Vibes “MAANG’s AI safeguards CellTracker’s cloud-based infrastructure…” — Dhamodhar P, CEO, CellTracker ### 25. [Mainframe Security Insights Platform](https://www.g2.com/products/mainframe-security-insights-platform/reviews) **Product Description:** Security Insights Platform helps ensure a trusted environment for your customers and employees by easily identifying and reducing risk from threats. It can quickly interpret and assess the security posture of your Mainframe. And, for risky findings, it helps develop remediation steps –all on an ongoing and ad hoc basis. ## What Is Threat Intelligence Software? [System Security Software](https://www.g2.com/categories/system-security) ## What Software Categories Are Similar to Threat Intelligence Software? - [Dark Web Monitoring Tools](https://www.g2.com/categories/dark-web-monitoring) - [ Attack Surface Management Software](https://www.g2.com/categories/attack-surface-management) - [Digital Risk Protection (DRP) Platforms](https://www.g2.com/categories/digital-risk-protection-drp-platforms) --- ## How Do You Choose the Right Threat Intelligence Software? ### What You Should Know About Threat Intelligence Software ### Threat Intelligence Software FAQs ### What are the best threat intelligence software options for small businesses? Here are some of the best threat intelligence software solutions designed to protect [small businesses](https://www.g2.com/categories/threat-intelligence/small-business): - [Microsoft Defender for Cloud](https://www.g2.com/products/microsoft-defender-for-cloud/reviews) provides small businesses with real-time threat detection and security recommendations across cloud environments. - [ThreatLocker](https://www.g2.com/products/threatlocker-inc-threatlocker/reviews) delivers application whitelisting and ringfencing controls, helping small teams prevent unauthorized access and malware execution. - [Cloudflare Application Security and Performance](https://www.g2.com/products/cloudflare-application-security-and-performance/reviews) combines threat protection with performance optimization, ideal for small businesses running web-based services. - [CrowdStrike Falcon Endpoint Protection Platform](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews) offers lightweight, cloud-delivered endpoint protection that detects threats quickly without overloading system resources. - [FortiGate NGFW](https://www.g2.com/products/fortigate-ngfw/reviews) delivers enterprise-grade firewall and threat intelligence capabilities in a scalable package suited for small business networks. ### What are the best-rated threat intelligence apps for IT teams? Here are some of the highest-rated threat intelligence apps tailored for IT teams managing complex environments: - [Recorded Future](https://www.g2.com/products/recorded-future/reviews) delivers real-time threat intelligence with deep web insights, helping IT teams proactively detect and prioritize risks. - [CrowdStrike Falcon Endpoint Protection Platform](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews) combines threat detection with automated response tools, enabling IT teams to secure endpoints at scale. - [Microsoft Defender for Cloud](https://www.g2.com/products/microsoft-defender-for-cloud/reviews) provides integrated threat detection and security posture management across multi-cloud and hybrid environments. - [Cyberint, a Check Point Company](https://www.g2.com/products/cyberint-a-check-point-company/reviews), offers external threat intelligence focused on digital risk protection, empowering IT teams to counter emerging threats beyond the firewall. - [ZeroFox](https://www.g2.com/products/zerofox/reviews) specializes in identifying external threats across social media, domains, and the dark web, equipping IT teams with actionable intelligence. ### What are the best-rated threat intelligence platforms for startups? Here are some of the most reliable threat intelligence platforms well-suited for agile and growing startups: - [Cloudflare Application Security and Performance](https://www.g2.com/products/cloudflare-application-security-and-performance/reviews) combines powerful DDoS protection and threat intelligence in a lightweight, cost-effective platform ideal for startups scaling web infrastructure. - [ThreatLocker](https://www.g2.com/products/threatlocker-inc-threatlocker/reviews) offers granular application control and real-time threat blocking, giving startups enterprise-grade security without complexity. - [CrowdStrike Falcon Endpoint Protection Platfor](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews) delivers scalable, cloud-native endpoint protection that’s easy for lean startup teams to deploy and manage. - [CloudSEK](https://www.g2.com/products/cloudsek/reviews) provides AI-driven threat detection and digital risk monitoring, helping startups stay ahead of emerging threats across assets and brand mentions. - [Censys Search](https://www.g2.com/products/censys-search/reviews) enables startups to continuously map and monitor their attack surface, offering visibility and threat data without heavy setup.