Gane Index
All indexesEvery index and its categoriesGTMMarketing, sales, customer and revenue operations softwareITSecurity, IT operations, cloud, developer and data softwareHRHR, payroll, recruiting, performance and learning softwareFinanceAccounting, planning, spend, billing and treasury software
Claim your listing
September 2026 Edition, published · The permanent record of that edition, superseded since. The current standing is on the category page →
Index › IT › Security operations › Threat intel · September 2026 Edition

Threat intelligence platforms

Asked as “threat intelligence platform”, and as “cyber threat intelligence feed and platform”, on behalf of a mid-market B2B company. 47 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing · first-choice share
13%
NordStellar
Contested · MISP 11%
13NordStellar11MISP11Rapid7 Threat Command66others

13% of first choices, contested.

ShowinginAll 136 categories in the September 2026 Edition →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small businessNordStellar19%ContestedStanding →Mid-marketNordStellar13%ContestedThis pageEnterpriseRecorded Future Intelligence Cloud61%Clear leaderStanding →

The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01NordStellar13%0%13accepted challenger
02MISP11%8%24accepted challenger
03Rapid7 Threat Command11%0%11accepted challenger
04SOCRadar Extended Threat Intelligence11%0%11accepted challenger
05Recorded Future Intelligence Cloud9%41%46criticized challenger
06OpenCTI6%9%23accepted challenger
07Cyble Vision6%0%12accepted challenger
08AlienVault OTX4%15%13accepted challenger
09ThreatConnect4%36%28criticized challenger
10Anomali ThreatStream2%19%27accepted challenger
Show the five products at 0%, ordered by negative rate
15Mandiant Threat Intelligence Lab in the set0%62%16criticized challenger
14Google Threat Intelligence Lab in the set0%18%11accepted challenger
11CrowdStrike Falcon Intelligence0%15%20accepted challenger
13Flashpoint Ignite0%0%11accepted challenger
12Abuse.ch0%0%10accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.

Google Threat Intelligence is made by Google, whose model Gemini 3.5 Flash is in the set. On the four share prompts that model made it the first choice zero times of 4; the other eleven models zero times of 44. Mandiant Threat Intelligence is made by Google, whose model Gemini 3.5 Flash is in the set. On the four share prompts that model made it the first choice zero times of 4; the other eleven models zero times of 44. Lab treatment is defined on the method page; the row is marked, not excluded.

Head to head
NordStellar vs MISPNordStellar vs Rapid7 Threat CommandNordStellar vs SOCRadar Extended Threat Intelligence
All twenty-eight head-to-head pages: the top eight products, each against each
NordStellar vs Recorded Future Intelligence CloudNordStellar vs OpenCTINordStellar vs Cyble VisionNordStellar vs AlienVault OTXMISP vs Rapid7 Threat CommandMISP vs SOCRadar Extended Threat IntelligenceMISP vs Recorded Future Intelligence CloudMISP vs OpenCTIMISP vs Cyble VisionMISP vs AlienVault OTXRapid7 Threat Command vs SOCRadar Extended Threat IntelligenceRapid7 Threat Command vs Recorded Future Intelligence CloudRapid7 Threat Command vs OpenCTIRapid7 Threat Command vs Cyble VisionRapid7 Threat Command vs AlienVault OTXSOCRadar Extended Threat Intelligence vs Recorded Future Intelligence CloudSOCRadar Extended Threat Intelligence vs OpenCTISOCRadar Extended Threat Intelligence vs Cyble VisionSOCRadar Extended Threat Intelligence vs AlienVault OTXRecorded Future Intelligence Cloud vs OpenCTIRecorded Future Intelligence Cloud vs Cyble VisionRecorded Future Intelligence Cloud vs AlienVault OTXOpenCTI vs Cyble VisionOpenCTI vs AlienVault OTXCyble Vision vs AlienVault OTX

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative30%
Key
01NordStellar13%
02MISP11%
03Rapid7 Threat Command11%
04SOCRadar Extended Threat Intelligence11%
05Recorded Future Intelligence Cloud9%
06OpenCTI6%
07Cyble Vision6%
08AlienVault OTX4%
09ThreatConnect4%
10Anomali ThreatStream2%
11CrowdStrike Falcon Intelligence0%
12Abuse.ch0%
13Flashpoint Ignite0%
14Google Threat Intelligence0%
15Mandiant Threat Intelligence0%

What they warned about

Two of twelve models held their first choice under the paraphrase. GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.20, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2 and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Recorded Future Intelligence Cloud
41%
19 of 46 labels negative · 8 of 12 models · 2 hard negative
“Verdict: Avoid if you have a limited budget or require high-volume, automated ingestion into many disparate tools.” GLM 4.7 FlashX, negative prompt
Mandiant Threat Intelligence
62%
10 of 16 labels negative · 7 of 12 models · 1 hard negative
“overkill and pricey for most B2B mid-markets” DeepSeek V4 Flash, paraphrase prompt
ThreatConnect
36%
10 of 28 labels negative · 6 of 12 models · 1 hard negative
“Avoid enterprise-heavy like Anomali/ThreatConnect unless growing fast.” Grok 4.20, direct prompt
Anomali ThreatStream
19%
5 of 27 labels negative · 4 of 12 models · 1 hard negative
“Avoid enterprise-heavy like Anomali/ThreatConnect unless growing fast.” Grok 4.20, direct prompt

What they cite

Twelve of the twelve models returned a source list in this edition: four return the pages they cited and eight the search results they consulted.

Sites the answers cite

62 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 952 links across 250 sites, every framing counted. Ranked by the number of answers carrying the site or page.

upguard.com
vendor site · UpGuard38 answers · 46 citations · 11 models
analyticsinsight.net
37 answers · 64 citations · 10 models
cyware.com
vendor site · Cyware27 answers · 37 citations · 10 models
learn.g2.com
vendor site · G225 answers · 26 citations · 12 models
b2breviews.com
25 answers · 25 citations · 9 models
esecurityplanet.com
21 answers · 21 citations · 8 models
underdefense.com
vendor site · UnderDefense17 answers · 18 citations · 10 models
stellarcyber.ai
vendor site · Stellar Cyber16 answers · 23 citations · 6 models
expertinsights.com
15 answers · 18 citations · 9 models
shadowdragon.io
vendor site · ShadowDragon15 answers · 15 citations · 6 models
cyble.com
vendor site · Cyble14 answers · 15 citations · 6 models
devopsschool.com
14 answers · 14 citations · 10 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

upguard.com/blog/best-threat-intelligence-platforms-and-vendors
38 answers · 11 models
analyticsinsight.net/cybersecurity/10-best-threat-intelligence-platforms-in…
25 answers · 10 models
b2breviews.com/threat-intelligence-platforms
25 answers · 9 models
learn.g2.com/best-threat-intelligence-tools
25 answers · 12 models
analyticsinsight.net/cybersecurity/best-threat-intelligence-platforms
22 answers · 10 models
cyware.com/blog/top-threat-intelligence-platforms-and-solutions
19 answers · 9 models
esecurityplanet.com/products/threat-intelligence-platforms
18 answers · 8 models
shadowdragon.io/resources/best-threat-intelligence-platforms
15 answers · 6 models
devopsschool.com/blog/top-10-threat-intelligence-tools-globally
14 answers · 10 models
underdefense.com/blog/threat-detection-tools
14 answers · 10 models

Search against answers

Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best threat intelligence platform”, “threat intelligence platform”, “threat intelligence platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
Company and productsShareOwn site citedName searches, GoogleAI search demand, est.Organic visitsPaid search a month, est.Google ads, last 30 daysBest Google position
NordStellar nordlayer.com13%241100136,857$985120
MISP misp-project.org11%981,600911,2022
Rapid7 parent site
Rapid7 Threat Command 11%		11%5114,800798
SOCRadar Extended Threat Intelligence socradar.io11%13220019,4990
Recorded Future Intelligence Cloud recordedfuture.com9%163210150,27822
OpenCTI filigran.io6%721,900941,9470
Cyble Vision cyble.com6%9130120,85611
Flare flare.io6%6249,50097,65612,1286
AlienVault OTX alienvault.com
AlienVault OTX 4%, AlienVault Open Threat Exchange 2%		6%40880611,662
ThreatConnect threatconnect.com4%1111,000241,4360

Google's top ten for the three searches hold 16 sites; 3 of them are among the sites the models cited here (cyware.com, shadowdragon.io, stellarcyber.ai). The first result for “best threat intelligence platform” is reddit.com.

How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHide
ModelDirect“What is the best threat intelligence platform for a mid-market B2B company?”Paraphrase“Which cyber threat intelligence feed and platform would you recommend to a mid-sized B2B company?”Comparative“What are the top threat intelligence platforms and how do they differ?”Budget-constrained“What is the best threat intelligence platform for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a threat intelligence platform. What should we look at?”Negative“Which threat intelligence platforms should I avoid or be cautious about?”
Claude Haiku 4.5Cyble Vision
Three alternativesRecorded Future Intelligence Cloud, SOCRadar Extended Threat Intelligence, ThreatConnect
Cyble VisionHeld
Two alternativesCloudSEK, SOCRadar Extended Threat Intelligence
Recorded Future Intelligence Cloud
Four alternativesCrowdStrike Falcon Intelligence, Cyble Vision, Flare, Flashpoint Ignite
MISP
Five alternativesCisco Talos, CrowdSec, Microsoft Defender Threat Intelligence, Open Threat Exchange, OpenCTI
no first choicenothing named
GPT-5.4 miniRecorded Future Intelligence Cloud
Six alternativesAnomali ThreatStream, CrowdStrike Falcon Intelligence, Cyware Intel Exchange, SOCRadar Extended Threat Intelligence, ThreatConnect, ZeroFox Intelligence
Feedly Threat IntelligenceChanged
Five alternativesCyware CTIX, Recorded Future Intelligence Cloud, SOCRadar Extended Threat Intelligence, ThreatConnect, ZeroFox Intelligence
ThreatConnect
Four alternativesAnomali ThreatStream, MISP, OpenCTI, Recorded Future Intelligence Cloud
MISP
Two alternativesAlienVault OTX, OpenCTI
no first choiceagainst: Stellar Cyber, ThreatConnect, ThreatQ
Gemini 3.5 FlashSOCRadar Extended Threat Intelligence
Five alternativesFeedly Threat Intelligence, Flare, MISP, OpenCTI, Rapid7 Threat Command
against: Mandiant Threat Intelligence, Recorded Future Intelligence CloudFlare, SOCRadar Extended Threat IntelligenceChanged
Four alternativesCrowdStrike Falcon Intelligence, MISP, Microsoft Defender Threat Intelligence, OpenCTI
against: Google Threat Intelligence, Recorded Future Intelligence CloudRecorded Future Intelligence Cloud
Five alternativesAnomali ThreatStream, Cyware Intel Exchange, OpenCTI, ThreatConnect, ThreatQuotient
OpenCTI
Four alternativesFeedly Threat Intelligence, GreyNoise, LevelBlue Open Threat Exchange, MISP
no first choiceagainst: Anomali ThreatStream, ThreatConnect, ThreatQuotientagainst: AlienVault OTX, Anomali ThreatStream, MISP, OpenCTI, Recorded Future Intelligence Cloud, ThreatConnect
Perplexity SonarCyble Vision, SOCRadar Extended Threat Intelligence
Two alternativesFlare, Rapid7 Threat Command
against: ManageEngine Log360ThreatConnectChanged
Three alternativesAbuse.ch, Anomali ThreatStream, Recorded Future Intelligence Cloud
Recorded Future Intelligence Cloud
Seven alternativesAnomali ThreatStream, CloudSEK XVigil, CrowdStrike Falcon Intelligence, Cyble Vision, Flashpoint Ignite, Google Threat Intelligence, ThreatConnect
AlienVault OTX, VirusTotal
Three alternativesCloudSEK, GreyNoise, NordStellar
against: Mandiant Threat Intelligence, Recorded Future Intelligence Cloudno first choiceagainst: Cloudflare Cloudforce One, Microsoft-native intelligence
Grok 4.20NordStellar
Two alternativesFlare, Rapid7 Threat Command
against: Anomali ThreatStream, CrowdStrike Falcon Intelligence, Recorded Future Intelligence Cloud, ThreatConnect, VirusTotalAlienVault Open Threat ExchangeChanged
Two alternativesMISP, NordStellar
against: CrowdStrike Falcon Intelligence, Recorded Future Intelligence Cloud, ThreatConnectRecorded Future Intelligence Cloud
Six alternativesAnomali ThreatStream, CrowdStrike Falcon Intelligence, Google Threat Intelligence, Mandiant Threat Intelligence, Microsoft Defender Threat Intelligence, ThreatConnect
AlienVault OTX
Two alternativesMISP, OpenCTI
against: Recorded Future Intelligence Cloud, ThreatConnectno first choice
Five alternativesCloudSEK, CrowdStrike Falcon, Cyware Intel Exchange, Flashpoint Ignite, Recorded Future Intelligence Cloud
against: Mandiant Threat Intelligenceagainst: 360 Netlab, Kaspersky, Mandiant Threat Intelligence, QiAnXin, Recorded Future Intelligence Cloud, ThreatConnect
Mistral SmallNordStellar, Rapid7 Threat Command
Two alternativesCrowdStrike Falcon, UpGuard
ESET Threat Intelligence Feed, NordStellar, Rapid7 Threat CommandChanged
Two alternativesCrowdStrike Falcon, Recorded Future Intelligence Cloud
no first choiceAmazon GuardDuty, GreyNoise
Two alternativesCloudSEK, NordStellar
against: Deepinfono first choiceagainst: Kaspersky, Mandiant Threat Intelligence, Recorded Future Intelligence Cloud
DeepSeek V4 FlashNordStellar, Rapid7 Threat Command
One alternativeCyble Vision
against: Recorded Future Intelligence CloudFlareChanged
Four alternativesAbuse.ch, AlienVault OTX, GreyNoise Block, NordStellar
against: CrowdStrike Falcon Intelligence, Mandiant Threat Intelligence, Recorded Future Intelligence CloudRecorded Future Intelligence Cloud
Eight alternativesAnomali ThreatStream, CrowdStrike Falcon Intelligence, Google Threat Intelligence, MISP, Microsoft Defender Threat Intelligence, OpenCTI, Palo Alto Networks Cortex XSOAR, ThreatConnect
against: Cyware Intel ExchangeOpenCTI
Four alternativesAbuse.ch, AlienVault OTX, CloudMISP, MISP
against: Anomali ThreatStream, Deepinfo, Mandiant Threat Intelligence, Recorded Future Intelligence Cloud, ThreatConnectno first choiceagainst: DigitalMint, Farnsworth Intelligence, Koi Security, MISP, Mandiant Threat Intelligence, OpenCTI, Recorded Future Intelligence Cloud, Sygnia
Llama 4 MaverickNordStellar
Two alternativesFlare, Rapid7 Threat Command
no first choiceChangedThreatSearch
Two alternativesCrowdStrike Falcon X, Recorded Future Intelligence Cloud
no first choiceno first choicenothing named
Qwen 3.7 FlashThreatConnect
Four alternativesGreyNoise, OpenCTI, Palo Alto Networks Cortex XSOAR, Recorded Future Intelligence Cloud
CrowdStrike FalconChanged
Three alternativesNordStellar, Recorded Future Intelligence Cloud, ThreatConnect
Recorded Future Intelligence Cloud
Four alternativesAnomali ThreatStream, CrowdStrike Falcon, Mandiant Threat Intelligence, ThreatConnect
Amazon GuardDuty
Five alternativesAbuse.ch, AlienVault OTX, Deepinfo, GreyNoise, MISP
no first choice
Three alternativesAnomali ThreatStream, CrowdStrike Falcon Intelligence, ThreatConnect
against: Recorded Future Intelligence Cloudagainst: AlienVault OTX, CrowdStrike, Emerging Threats, FireEye
Kimi K2Flare, SOCRadar Extended Threat Intelligence
Two alternativesNordStellar, Rapid7 Threat Command
against: Intel 471, Recorded Future Intelligence Cloud, ThreatConnectSOCRadar Extended Threat IntelligenceChanged
Two alternativesAnomali ThreatStream, MISP
against: Recorded Future Intelligence CloudRecorded Future Intelligence Cloud
Eight alternativesAnomali ThreatStream, CrowdStrike Falcon Intelligence, Cyble Vision, Flashpoint Ignite, Google Threat Intelligence, MISP, OpenCTI, ThreatConnect
MISP, OpenCTI
Five alternativesAbuse.ch, AlienVault OTX, CISA AIS, GreyNoise, VirusTotal
no first choiceagainst: Anomali ThreatStream, Mandiant Threat Intelligence, Palantir, Recorded Future Intelligence Cloud
GLM 4.7 FlashXRecorded Future Intelligence Cloud
Two alternativesFlare, Rapid7 Threat Command
Recorded Future Intelligence CloudHeld
Three alternativesCrowdStrike Falcon, ESET Threat Intelligence, Intel 471
Recorded Future Intelligence Cloud
Seven alternativesAnomali ThreatStream, CrowdStrike Falcon Intelligence, Cyble Vision, MISP / OpenCTI, Mandiant Threat Intelligence, ThreatConnect, ZeroFox Intelligence
MISP
Six alternativesAbuseIPDB, AlienVault Open Threat Exchange, IntelOwl, OpenCTI, VirusTotal Community API, Yeti
against: Mandiant Threat Intelligence, Recorded Future Intelligence Cloud, ThreatConnectno first choiceagainst: FortiSIEM, Palantir, Recorded Future Intelligence Cloud, Splunk Enterprise Security
MiniMax M2.5Anomali ThreatStream, Recorded Future Intelligence Cloud
Four alternativesAlienVault OTX, Intel 471, MISP, Microsoft Defender Threat Intelligence
NordStellar, Rapid7 Threat CommandChanged
Two alternativesAnomali ThreatStream, CrowdStrike Falcon Intelligence
no first choiceMISP
Seven alternativesAlienVault OTX, IBM X-Force Exchange, Microsoft Defender Threat Intelligence, OpenCTI, Recorded Future Intelligence Cloud, Shift5, TheHive
against: Cisco UmbrellaRapid7 Threat Command
Four alternativesAnomali ThreatStream, CrowdStrike Falcon Intelligence, Cyble Vision, Recorded Future Intelligence Cloud
against: Google Threat Intelligencenothing named
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:53yes119 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 11:22yes26 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:54yes2225 s
Direct recommendationPerplexity Sonarsonar2026-09-17 13:58yes205 s
Direct recommendationGrok 4.20spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version)2026-09-17 12:28yes3919 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 12:51yes88 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 14:12yes1017 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 09:39yes52 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:08no038 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:11yes1743 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 10:09yes2672 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:25no040 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:39yes1610 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:34yes58 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:25yes923 s
ParaphrasePerplexity Sonarsonar2026-09-17 11:02yes205 s
ParaphraseGrok 4.20spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version)2026-09-17 09:59yes4116 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 11:39yes106 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:21yes2527 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:27yes54 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:20yes1288 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:10yes2846 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 10:00yes1098 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:50yes836 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:38yes910 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:03yes411 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:53yes1527 s
ComparativePerplexity Sonarsonar2026-09-17 12:08yes209 s
ComparativeGrok 4.20spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version)2026-09-17 10:27yes2312 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 10:11yes58 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 14:12yes1524 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:14yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:11yes1037 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:12yes1028 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:33yes15189 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:55yes777 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:11yes188 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 11:14no03 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:07yes1117 s
Budget constrainedPerplexity Sonarsonar2026-09-17 10:45yes205 s
Budget constrainedGrok 4.20spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version)2026-09-17 09:23yes2913 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 12:18yes55 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:19yes2020 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:44yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:08yes541 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 14:08yes1048 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 14:06yes3540 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:14no066 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:57no06 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:15no09 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:33yes1026 s
Scale constrainedPerplexity Sonarsonar2026-09-17 12:35yes2011 s
Scale constrainedGrok 4.20spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version)2026-09-17 09:32yes1411 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 11:28no07 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:32yes1725 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:06yes54 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:12yes1043 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:52yes1049 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:28no061 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:05yes525 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:55yes3011 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 11:46yes55 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:05yes1926 s
Negative framingPerplexity Sonarsonar2026-09-17 10:17yes206 s
Negative framingGrok 4.20spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version)2026-09-17 14:02yes4522 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 13:16yes56 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:47yes2848 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 09:47yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:00no050 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:37yes3038 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:35yes2973 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:38no036 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

ShowHide
Category-scoped readings
Anomali read as Anomali ThreatStream
Anomali (ThreatStream) read as Anomali ThreatStream
Cisco read as Cisco Talos
CrowdStrike Adversary Intelligence read as CrowdStrike Falcon Intelligence
CrowdStrike Falcon Adversary Intelligence read as CrowdStrike Falcon Intelligence
CrowdStrike Falcon Intel read as CrowdStrike Falcon Intelligence
CrowdStrike Falcon Intel (Falcon X) read as CrowdStrike Falcon Intelligence
CrowdStrike Falcon Intelligence / Adversary Intelligence read as CrowdStrike Falcon Intelligence
CrowdStrike Threat Intel read as CrowdStrike Falcon Intelligence
Cyware read as Cyware Intel Exchange
Cyware (CTIX - Cyber Threat Intelligence Exchange) read as Cyware Intel Exchange
Feedly for Threat Intelligence read as Feedly Threat Intelligence
Flashpoint read as Flashpoint Ignite
Google Cloud Mandiant Threat Intelligence (Mandiant Advantage) read as Google Threat Intelligence
Google Mandiant read as Google Threat Intelligence
Google Mandiant Threat Intelligence read as Google Threat Intelligence
Google Threat Intelligence / Mandiant read as Google Threat Intelligence
Google/Mandiant read as Google Threat Intelligence
IBM X-Force read as IBM X-Force Exchange
Mandiant read as Mandiant Threat Intelligence
Mandiant (Google Cloud) read as Mandiant Threat Intelligence
Mandiant (Google) read as Mandiant Threat Intelligence
Mandiant Advantage read as Mandiant Threat Intelligence
Mandiant Advantage (Google Cloud) read as Mandiant Threat Intelligence
Mandiant Advantage (Threat Intelligence) read as Mandiant Threat Intelligence
Microsoft Defender for Threat Intelligence read as Microsoft Defender Threat Intelligence
Recorded Future read as Recorded Future Intelligence Cloud
Recorded Future (Community Edition) read as Recorded Future Intelligence Cloud
Recorded Future (Intelligence Cloud) read as Recorded Future Intelligence Cloud
SOCRadar read as SOCRadar Extended Threat Intelligence
Splunk Enterprise read as Splunk Enterprise Security
ZeroFox read as ZeroFox Intelligence
Unresolved, counted raw
360 Netlab
Anomali Limo
Bitsight CTI
CISA Automated Shared Threat Information
CYFIRMA DeCYFIR
Cisco Security Cloud – Threat Intelligence
CloudSEK Threat Intelligence
Cyware CTIX
DigitalMint
ESET Threat Intelligence Feed
Emerging Threats (ET)
Emerging Threats Open
EmergingThreats
Farnsworth Intelligence
KELA Cyber Intelligence Platform
Koi Security
MISP Community
Microsoft-native intelligence
OpenTAXII
QiAnXin
Shift5 (formerly ThreatQuotient)
Sygnia
ThreatConnect Community (Free)
ThreatConnect Intelligence Hub
ThreatQ
VMRay
VirusTotal Community API
Discontinued, still offered
No shut-down product was recommended here.

Also in security operations

The other categories of this function, with the leader in each.
← TPRMVuln management →