I like that SOCRadar Extended Threat Intelligence helps in discovering internet-facing assets, shadow IT, exposed services, and vulnerabilities. It is great for identifying employee or customer credentials exposed in breaches. I appreciate how it can assess vendors' security postures and monitor partner incidents. The initial setup is very simple and easy. Also, I really find it useful for finding lookalike domain targeting and typo-squatting monitoring. Review collected by and hosted on G2.com.

finding lookalike domain targeting the organization typo-squatting monitoring Review collected by and hosted on G2.com.

Visibility to areas that i would otherwise have a challenge, especially on the ISP side which hosts some services. The interface is easy to navigate and has darknet integration feeds that allow for quick check on data leaks. The response is fast, no lag and the summary reports are on point. Analysis of incidences and the general intelligence of the data does provide for actionable insights . Review collected by and hosted on G2.com.

So far so good. No negatives. Enjoying the new look and the dark mode is cool. Review collected by and hosted on G2.com.

What I like most about SOCRadar is its ability to provide comprehensive visibility into the external attack surface and deliver actionable threat intelligence. Review collected by and hosted on G2.com.

In the user interface, the alert listing section displays only 5 alerts at a time. When I want to view 50 alerts, I have to scroll to the bottom of the list and select 50 from there. Placing this option at the top would make the interface much more practical to use. Review collected by and hosted on G2.com.

I like how SOCRadar Extended Threat Intelligence helps us improve external attack surface visibility and detects threats proactively. The discovery of exposed devices over the dark web and the identification of IOCs are particularly valuable. It provides IOCs relevant to our environment and compromised employee credentials for appropriate actions, helping us address threats proactively. Plus, the initial setup was very easy. Review collected by and hosted on G2.com.

None Review collected by and hosted on G2.com.

What I like best about SOCRadar Extended Threat Intelligence is its Digital Risk Protection capability combined with a well-designed, intuitive UI.

The platform provides fast and effective detection of data leaks, impersonating domains, and exposed assets such as GitHub repositories, which we actively use in daily operations. The structured interface and AI-powered summaries also help us quickly understand threat context and prioritize actions without spending excessive time on raw data. Review collected by and hosted on G2.com.

The area I use the least right now is Supply Chain Intelligence. It’s not that the feature is bad, but it doesn’t fully meet our expectations yet.

- The news and updates related to third-party vendors sometimes appear later compared to other common information channels.

- Since we work with many vendors and clients, having this capability does help to some extent, but there’s still room for improvement.

- What I’m really looking for is deeper visibility into critical CVEs and major security findings related to third-party products, so our team can quickly assess the impact and patch in time. At the moment, this information feels limited compared to what we expected. Review collected by and hosted on G2.com.

new version improved with AI for alerts is the most important feature for me, saving time and gain quality. Review collected by and hosted on G2.com.

In the alerts, we have all the devices listed as if they were a single company, but we have different countries around the world, and the alerts arrive "mixing" all of this into a single alert. Because of this, we cannot process the alert for a discovered device individually, for example. Review collected by and hosted on G2.com.

Alerts concerning credential leaks, especially those related to credentials stolen by stealers, are particularly relevant and truly useful. They allow us to react quickly by changing the passwords of compromised accounts, thereby minimizing the risk of intrusion as much as possible. Review collected by and hosted on G2.com.

The product remains expensive and, due to a cost that exceeds my budget, I cannot enjoy all its features. Review collected by and hosted on G2.com.

The best part of SOCRadar Extended Threat Intelligence is its unified approach, which merges External Attack Surface Management (EASM), Digital Risk Protection, and Cyber Threat Intelligence into a single, automated dashboard.

It is particularly valued for its "hacker-mindset" visibility, providing real-time alerts on dark web leaks and brand impersonation while using AI agents to automate complex response tasks like takedowns. Review collected by and hosted on G2.com.

SOCRadar can suffer from high false-positive rates and alert noise, which often requires significant manual effort from security teams to fine-tune and filter.

Additionally, its credit-based pricing for takedowns can make budgeting unpredictable, as active response measures for brand protection often incur extra costs beyond the base subscription Review collected by and hosted on G2.com.

SOCRadar Threat Intelligence is a powerful tool for performing security controls across our assets, and it has been a real time-saver for our day-to-day operations. Review collected by and hosted on G2.com.

Extended Thread Intelligence has so many sections. If the tabs could be made more compact, it would be more effective and easier to use. Review collected by and hosted on G2.com.

I aligned this with my client's PIR, and I found the detection to be very good. Additionally, the user interface is quite friendly, and easy to implement, the CS is really fast too. Review collected by and hosted on G2.com.

The detection of new vulnerabilities in vuln intelligence is not particularly fast. I understand that there are challenges, especially when a new CVE is involved and the product vendor has not yet published mitigation steps or made the CVE public, sometimes sharing details only with their clients. There are also cases where discussions about a vulnerability appear on social media before any official information is released. In such situations, it would be helpful to use an admiralty code to indicate the reliability of the information.

For example, if details about a vulnerability or exploit are posted by a new account on a forum but are being widely discussed by many people and security vendors, the appropriate admiralty code would be F4. Review collected by and hosted on G2.com.