Published November 9, 2026
A threat intelligence platform collects information about attackers, their infrastructure and their methods from many sources. It removes duplicates, scores each item for confidence and relevance, and sends indicators and context to the security tools that act on them, such as a SIEM, a SOAR or an EDR. Some vendors sell the platform, some sell the intelligence, and some sell both.
Where the market stands
Mastercard agreed on September 12, 2024 to buy Recorded Future from Insight Partners for $2.65 billion. It completed the acquisition on December 20, 2024.
Securonix announced the acquisition of ThreatQuotient, the maker of the ThreatQ threat intelligence platform, on June 11, 2025. ThreatQuotient said in January 2026 that its brand remains available inside the Securonix Unified SIEM platform and as a standalone hosted product.
Dataminr signed a definitive agreement to acquire ThreatConnect on October 21, 2025. On March 23, 2026, its CEO said, "We acquired ThreatConnect," as Dataminr launched Dataminr for Cyber Defense, which it calls the first unified solution from that acquisition.
Infoblox completed its acquisition of Axur, a digital risk protection company, on May 5, 2026.
On August 1, 2026, Microsoft made the final phase of the Microsoft Defender Threat Intelligence convergence generally available in the Defender portal, at no additional cost. Microsoft said it would retire the standalone Defender Threat Intelligence pages from that date. Its APIs are now available to Defender XDR and Sentinel customers without a separate license.
Four kinds of product
This edition sorts products into four groups. Some vendors sit in more than one.
- Platforms that aggregate and distribute intelligence. Anomali says ThreatStream aggregates intelligence from hundreds of open, commercial and community sources, then normalizes, deduplicates and scores it. Cyware Intel Exchange normalizes incoming data to STIX 2.1. ThreatQ and ThreatConnect also sit here. Evaluate them with the sources you will actually connect.
- Intelligence providers. Recorded Future sells Cyber Operations, Digital Risk Protection, Third-Party Risk and Payment Fraud solutions. Google Threat Intelligence, launched on May 6, 2024, combines Mandiant's frontline research, the VirusTotal community and Google's own visibility, with Gemini for conversational search. Flashpoint Ignite collects from the surface, deep and dark web, including closed sources.
- Intelligence inside a security platform. CrowdStrike sells Adversary Intelligence, Adversary Intelligence Premium, Counter Adversary Elite and Adversary OverWatch on its Falcon platform. Microsoft's threat intelligence now sits inside Defender XDR and Sentinel.
- Open source. MISP is licensed under the GNU AGPLv3 and imports and exports STIX 1 and 2. OpenCTI Community Edition is licensed under Apache 2.0. Filigran sells an Enterprise Edition that adds playbooks, priority intelligence requirements, AI features and single sign-on.
Standards and sharing
STIX 2.1 and TAXII 2.1 became OASIS Standards on June 10, 2021. STIX is the format for cyber threat intelligence. TAXII is the protocol that carries it.
CISA's Automated Indicator Sharing (AIS) service exchanges machine-readable cyber threat indicators and defensive measures between public and private-sector organizations at no cost. Participants need a STIX/TAXII capability, either an open-source TAXII 2.1 client or a commercial product.
The Cybersecurity Information Sharing Act of 2015 gives liability and privacy protections to organizations that share indicators under its requirements. CISA says indicators shared under the Act remain covered, including those shared during the lapses from October 1 to November 12, 2025, and from January 31 to February 3, 2026. Public Law 119-103, signed on September 2, 2026, moved the Act's expiration date from September 30, 2026 to December 11, 2026.
If you share through an ISAC or AIS, check whether Congress has extended the Act past December 11, 2026, and ask counsel what applies during any lapse.
What the published prices show
Recorded Future and Anomali publish list prices on AWS Marketplace. These are list prices as published on October 17, 2026.
- Recorded Future. Each capability is priced as a separate unit on a 36-month contract. Threat Intelligence for up to 2 users costs $281,250. Vulnerability Intelligence for up to 4 users costs $168,750. Third-party monitoring of up to 100 companies costs $318,750. Workforce identity intelligence for up to 25,000 identities costs $262,500.
- Anomali. On 12-month contracts, ThreatStream Enterprise costs $150,000. ThreatStream AI Enterprise with 50 GB a day of indicator ingest costs $338,461. The Anomali Platform for 3,500 employees, 0.5 TB a day and 6 months of storage costs $520,000. Anomali states that fees are non-cancellable and non-refundable except as required by law.
- CrowdStrike. Falcon Enterprise costs $184.99 per device per year and includes Threat Intelligence & Hunting, which CrowdStrike describes as experts hunting continuously within the Falcon platform. Its threat intelligence page lists no prices for the intelligence offerings.
- Microsoft. Defender Threat Intelligence capabilities come with Defender XDR and Sentinel at no additional cost. Data that needed the premium Defender Threat Intelligence connector is now in the free Microsoft Threat Intelligence connector for Sentinel.
- VirusTotal. The Public API is free, limited to 500 requests a day and 4 a minute. It must not be used in commercial products or services, or in business workflows that do not contribute new files. The Premium API is licensed, and its limits are set by the licensed tier.
Price the analysts and engineers who will tune the feeds and maintain the integrations, not only the subscription.
What a deployment requires
Microsoft Defender Threat Intelligence customers need no migration. Microsoft says the API surface is unchanged. Microsoft's documentation places threat intelligence in the Defender portal under Overview and Intel explorer, with threat analytics reports available in Intel explorer. Check bookmarks, playbooks and enrichment jobs that point at the old pages.
OpenCTI's Enterprise Edition comes with every Filigran SaaS subscription. An on-premises deployment needs a signed Filigran Enterprise agreement.
For any platform, plan the rollout in this order:
- Write priority intelligence requirements: which adversaries, which assets and which decisions the intelligence must inform.
- Connect a small set of high-confidence sources, and set how long indicators stay active before they expire.
- Send indicators to the SIEM in monitoring mode first. Measure false positives against your own logs.
- Allow automated blocking only for indicators that have proven reliable, with a human approval step where it touches production.
Questions to settle first
Settle these before choosing a platform.
- Which decisions should the intelligence change: blocks, hunts, patch order or briefings to leadership?
- Do you need a platform to manage feeds you already buy, finished intelligence you cannot produce yourself, or both?
- What intelligence comes with the SIEM, EDR or XDR you already license?
- Who will tune feeds and retire stale indicators, and how many hours a week will it take?
- Do you share intelligence with an ISAC, AIS or partners, and in which formats?
- Can you export your enriched intelligence and analyst work if you change vendors?
Ask to contribute
Vendors in this market can ask to answer the six questions for State of Play 2026: Threat Intelligence Platforms. Use an email address on your company’s own domain: answers come from the company itself, not from an agency. We email a link to confirm the request.