Threat intelligence platforms for small business buyers
Asked as “threat intelligence platform”, and as “cyber threat intelligence feed and platform”, on behalf of a small B2B company. 47 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing · first-choice share
19%
Contested · MISP 17%
19NordStellar17MISP09AlienVault OTX55others
19% of first choices, contested.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
Show the two products at 0%, ordered by negative rate
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to head
NordStellar vs MISPNordStellar vs Rapid7 Threat CommandNordStellar vs SOCRadar Extended Threat Intelligence
Head-to-head pages are published for mid-market buyers, so these open on mid-market figures, not small business.All twenty-eight head-to-head pages: the top eight products, each against each
NordStellar vs Recorded Future Intelligence CloudNordStellar vs OpenCTINordStellar vs Cyble VisionNordStellar vs AlienVault OTXMISP vs Rapid7 Threat CommandMISP vs SOCRadar Extended Threat IntelligenceMISP vs Recorded Future Intelligence CloudMISP vs OpenCTIMISP vs Cyble VisionMISP vs AlienVault OTXRapid7 Threat Command vs SOCRadar Extended Threat IntelligenceRapid7 Threat Command vs Recorded Future Intelligence CloudRapid7 Threat Command vs OpenCTIRapid7 Threat Command vs Cyble VisionRapid7 Threat Command vs AlienVault OTXSOCRadar Extended Threat Intelligence vs Recorded Future Intelligence CloudSOCRadar Extended Threat Intelligence vs OpenCTISOCRadar Extended Threat Intelligence vs Cyble VisionSOCRadar Extended Threat Intelligence vs AlienVault OTXRecorded Future Intelligence Cloud vs OpenCTIRecorded Future Intelligence Cloud vs Cyble VisionRecorded Future Intelligence Cloud vs AlienVault OTXOpenCTI vs Cyble VisionOpenCTI vs AlienVault OTXCyble Vision vs AlienVault OTX
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
12Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative30%
Key
01NordStellar19%
NordStellar19%02MISP17%
MISP17%03AlienVault OTX9%
AlienVault OTX9%04VirusTotal4%
VirusTotal4%05CrowdStrike Falcon4%
CrowdStrike Falcon4%06OpenCTI4%
OpenCTI4%07ThreatConnect4%
ThreatConnect4%08SOCRadar Extended Threat Intelligence2%
SOCRadar Extended Threat Intelligence2%09Abuse.ch2%
Abuse.ch2%10Recorded Future Intelligence Cloud2%
Recorded Future Intelligence Cloud2%11GreyNoise0%
GreyNoise0%12Anomali ThreatStream0%
Anomali ThreatStream0%What they warned about
One of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.20, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Recorded Future Intelligence Cloud67%
22 of 33 labels negative · 10 of 12 models · 12 hard negative
“purchasing a traditional, enterprise-grade Threat Intelligence Platform (TIP) like Recorded Future, Mandiant (Google Cloud), or ThreatConnect is almost always a mistake” Gemini 3.5 Flash, direct prompt
Anomali ThreatStream65%
15 of 23 labels negative · 8 of 12 models · 8 hard negative
“Avoid "Big" TIPs initially: Traditional heavyweights like Recorded Future, Anomali, or ThreatConnect are powerful but expensive and complex.” Qwen 3.7 Flash, comparative prompt
ThreatConnect68%
15 of 22 labels negative · 7 of 12 models · 9 hard negative
“Avoid "Big" TIPs initially: Traditional heavyweights like Recorded Future, Anomali, or ThreatConnect are powerful but expensive and complex.” Qwen 3.7 Flash, comparative prompt
Mandiant Threat Intelligence89%
8 of 9 labels negative · 6 of 12 models · 4 hard negative
“Premium pricing (e.g., $60K–$1.5M/year ...); geared toward large-scale analysis, not lean teams.” Grok 4.20, negative prompt
What they cite
Twelve of the twelve models returned a source list in this edition: four return the pages they cited and eight the search results they consulted.
Sites the answers cite
63 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 946 links across 205 sites, every framing counted. Ranked by the number of answers carrying the site or page.
vendor site · G236 answers · 37 citations · 11 models
36 answers · 36 citations · 9 models
vendor site · UpGuard34 answers · 37 citations · 11 models
vendor site · SourceForge31 answers · 35 citations · 10 models
26 answers · 26 citations · 10 models
vendor site · Vectra24 answers · 24 citations · 8 models
vendor site · Cyware21 answers · 31 citations · 8 models
20 answers · 27 citations · 9 models
18 answers · 22 citations · 9 models
18 answers · 18 citations · 7 models
14 answers · 20 citations · 7 models
vendor site · G214 answers · 18 citations · 9 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
36 answers · 9 models
36 answers · 11 models
33 answers · 11 models
27 answers · 9 models
26 answers · 10 models
24 answers · 8 models
19 answers · 9 models
18 answers · 7 models
14 answers · 6 models
12 answers · 8 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best threat intelligence platform”, “threat intelligence platform”, “threat intelligence platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| NordStellar nordlayer.com | 19% | 24 | 110 | 0 | 136,857 | $985 | 120 | |
| MISP misp-project.org | 17% | 98 | 1,600 | 91 | 1,202 | 2 | ||
| AlienVault OTX alienvault.com AlienVault OTX 9%, AlienVault Open Threat Exchange 2% | 11% | 40 | 880 | 6 | 11,662 | |||
| Amazon parent site Amazon GuardDuty 6% | 6% | 17 | 151,000,000 | 1,380,939 | ||||
| VirusTotal virustotal.com | 4% | 28 | 246,000 | 493 | 476,788 | |||
| CrowdStrike parent site CrowdStrike Falcon 4% | 4% | 201 | 74,000 | 5,130 | ||||
| OpenCTI filigran.io | 4% | 72 | 1,900 | 94 | 1,947 | 0 | ||
| LevelBlue Open Threat Exchange level.io | 4% | 6 | 11,746 | $170 | 2 | |||
| Open Threat Exchange | 4% | |||||||
| ThreatConnect threatconnect.com | 4% | 111 | 1,000 | 24 | 1,436 | 0 |
Google's top ten for the three searches hold 16 sites; 2 of them are among the sites the models cited here (cyware.com, reddit.com). The first result for “best threat intelligence platform” is reddit.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best threat intelligence platform for a small B2B company?”Paraphrase“Which cyber threat intelligence feed and platform would you recommend to a small business that sells to other businesses?”Comparative“What are the top threat intelligence platforms for a small team and how do they differ?”Budget-constrained“What is the best threat intelligence platform for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a threat intelligence platform. What should we look at?”Negative“Which threat intelligence platforms should a small business avoid or be cautious about?”
Claude Haiku 4.5no first choiceOpen Threat Exchange, SpamhausChangedCloud SEK, SOCRadar Extended Threat Intelligenceagainst: Recorded Future Intelligence CloudOpen Threat Exchangeno first choiceagainst: Cisco Talos, IBM Threat Intelligence
Two alternatives
CrowdStrike Falcon, Cyble VisionTwo alternatives
GreyNoise, Stellar CyberGPT-5.4 miniRecorded Future Intelligence CloudThreatConnectChangedOpenCTIMISPno first choiceagainst: OpenCTI
Five alternatives
CloudSEK, Cyble Vision, GreyNoise, SOCRadar Extended Threat Intelligence, ZeroFox IntelligenceFour alternatives
CrowdStrike, Mandiant Threat Intelligence, OpenCTI, Recorded Future Intelligence CloudThree alternatives
Anomali ThreatStream, MISP, ThreatConnectTwo alternatives
IntelFinder, Microsoft Defender XDRGemini 3.5 FlashCrowdStrike Falcon, Huntressagainst: Mandiant Threat Intelligence, Recorded Future Intelligence Cloud, ThreatConnectLevelBlue Open Threat ExchangeChangedagainst: MISP, OpenCTILevelBlue Open Threat Exchangeagainst: Google Threat Intelligence, Recorded Future Intelligence CloudLevelBlue Open Threat Exchangeagainst: Anomali ThreatStream, Recorded Future Intelligence CloudFlare, SpyCloudagainst: Anomali ThreatStream, Recorded Future Intelligence Cloud, ThreatConnectagainst: Anomali ThreatStream, Cyware Intel Exchange, MISP, OpenCTI, Palo Alto Networks Cortex XSOAR, Recorded Future Intelligence Cloud, ThreatConnect, ThreatQuotient
Five alternatives
Flare, GreyNoise, LevelBlue Open Threat Exchange, SOCRadar Extended Threat Intelligence, SentinelOne Singularity ControlEight alternatives
Abuse.ch, CISA’s AIS, CrowdStrike Falcon Go, GreyNoise, MS-ISAC, Microsoft Defender for Cloud, PhishTank, SpamhausFour alternatives
Flare, MISP, OpenCTI, SOCRadar Extended Threat IntelligenceFour alternatives
GreyNoise, MISP, OpenCTI, PulsediveSeven alternatives
CrowdStrike, Expel, HaveIBeenPwned, Huntress, Microsoft Defender Threat Intelligence, Red Canary, SentinelOne SingularityPerplexity SonarNordStellaragainst: Cyble VisionMISPChangedFlare, GreyNoiseagainst: Anomali ThreatStream, ThreatConnectAmazon GuardDutyagainst: NordStellarno first choiceagainst: Anomali ThreatStream, FireEye iSight, Flashpoint Ignite, Mandiant Threat Intelligence, NetWitness, Recorded Future Intelligence Cloud, Splunk Intelligence Management
Two alternatives
CloudSEK, GreyNoiseSeven alternatives
Abuse.ch, AlienVault OTX, CISA AIS, Flare, GreyNoise Block, VMRay's ThreatFeed, VirusTotal communityFive alternatives
AlienVault OTX, CloudSEK, Falcon Adversary Intelligence, MISP, VirusTotalTwo alternatives
GreyNoise, VirusTotalGrok 4.20VirusTotalagainst: CrowdStrike FalconAlienVault Open Threat ExchangeChangedagainst: Recorded Future Intelligence CloudNordStellaragainst: CrowdStrike Falcon Intelligence, Recorded Future Intelligence Cloud, ThreatConnectAlienVault OTXagainst: Recorded Future Intelligence Cloudno first choiceagainst: Anomali ThreatStream, CrowdStrike, EclecticIQ, Flashpoint Ignite, Mandiant Threat Intelligence, Recorded Future Intelligence Cloud, ThreatConnect
Three alternatives
Amazon GuardDuty, GreyNoise, NordStellarFour alternatives
CISA Cyber Hygiene Services, CrowdStrike Falcon Go, GreyNoise Block, MISPFour alternatives
GreyNoise, MISP, OpenCTI, SOCRadar Extended Threat IntelligenceThree alternatives
MISP, OpenCTI, VirusTotalMistral SmallNordStellarNordStellarHeldNordStellaragainst: Mandiant Threat Intelligence, Recorded Future Intelligence CloudAmazon GuardDutyagainst: Deepinfo, NordStellarno first choicenothing named
Three alternatives
Blocklist.de, GreyNoise, VirusTotalFive alternatives
Check Point Exposure Management, CloudSEK, GreyNoise, MISP, OpenCTISix alternatives
Abuse.ch, AlienVault OTX, CISA AIS, GreyNoise, MISP, VirusTotalDeepSeek V4 FlashCrowdStrike Falcon, NordStellaragainst: Anomali ThreatStream, Palo Alto Networks Cortex XSOAR, Recorded Future Intelligence Cloud, ThreatConnectAbuse.ch, AlienVault OTXChangedagainst: MISP, Mandiant Threat Intelligence, Recorded Future Intelligence Cloud, ThreatConnectAlienVault OTX, MISP, OpenCTI, VirusTotalagainst: Anomali ThreatStream, Mandiant Threat Intelligence, Recorded Future Intelligence Cloud, ThreatConnectMISP, OpenCTIMISP, OpenCTIagainst: Anomali ThreatStream, Flashpoint Ignite, Mandiant Threat Intelligence, Recorded Future Intelligence Cloud, ThreatConnect
Three alternatives
CrowdSec, GreyNoise, Microsoft Defender Threat IntelligenceTwo alternatives
CrowdStrike Falcon, NordStellarSeven alternatives
Abuse.ch, CrowdStrike Falcon Intelligence, Cyble Vision, GreyNoise, Microsoft Defender Threat Intelligence, NordStellar, SOCRadar Extended Threat IntelligenceSix alternatives
Abuse.ch, AlienVault OTX, CISA AIS, CloudSEK, GreyNoise, NordStellarOne alternative
CISA Automated Indicator SharingLlama 4 MaverickNordStellarFalconFeedsChangedNordStellarAmazon GuardDuty, Deepinfono first choicenothing named
Two alternatives
CrowdStrike Falcon, PyrraThree alternatives
Anomali ThreatStream, Bitsight, MISPTwo alternatives
CloudSEK, GreyNoiseOne alternative
NordStellarQwen 3.7 FlashNordStellarAlienVault OTXChangedFlare, NordStellaragainst: Anomali ThreatStream, MISP, OpenCTI, Recorded Future Intelligence Cloud, ThreatConnectMISP, Maltiverseno first choiceagainst: Anomali ThreatStream, Cyware Intel Exchange, Flashpoint Ignite, IBM X-Force Exchange, OpenCTI, Recorded Future Intelligence Cloud, ThreatConnect
Five alternatives
Amazon GuardDuty, CrowdStrike Falcon, ISMalicious, Microsoft Defender for Cloud, VirusTotalTwo alternatives
Abuse.ch, Anomali ThreatStreamThree alternatives
CrowdStrike Falcon Intelligence, Cyberint, Microsoft Defender Threat IntelligenceTwo alternatives
AlienVault Open Threat Exchange, Microsoft Defender XDRKimi K2SOCRadar Extended Threat Intelligenceagainst: Anomali ThreatStream, CrowdStrike Falcon Intelligence, Google Threat Intelligence, Recorded Future Intelligence Cloud, ThreatConnectMISP, VirusTotalChangedMISP, NordStellarAlienVault OTXagainst: GreyNoiseno first choiceagainst: Anomali ThreatStream, CrowdStrike Falcon Intelligence, Cyble Vision, Darktrace, Google Threat Intelligence, Mandiant Threat Intelligence, Recorded Future Intelligence Cloud
Three alternatives
GreyNoise, MISP, PulsediveFour alternatives
Amazon GuardDuty, Deepinfo, NordStellar, OpenCTIFour alternatives
Anomali ThreatStream, OpenCTI, Recorded Future Intelligence Cloud, ThreatConnectTwo alternatives
MISP, VirusTotalThree alternatives
Breachsense, Flare, SOCRadar Extended Threat IntelligenceGLM 4.7 FlashXNordStellarNordStellar, ThreatConnectChangedNordStellarMISPno first choiceagainst: Anomali ThreatStream, Flashpoint Ignite, Recorded Future Intelligence Cloud
Five alternatives
CrowdStrike Falcon, Cyble Vision, Deepinfo, GreyNoise, SOCRadar Extended Threat IntelligenceNine alternatives
AlienVault OTX, CISA AIS, CrowdSec, CrowdStrike Falcon Intelligence, Cyble Vision, GreyNoise, MISP, Recorded Future Intelligence Cloud, abuse.ch PhishTankSix alternatives
CrowdStrike Falcon Intelligence, CyberCure Advanced Cyber Threat Intelligence, Cyberint, Recorded Future Intelligence Cloud, SOCRadar Extended Threat Intelligence, ZeroFox IntelligenceEight alternatives
Abuse.ch, AlienVault OTX, CISA Known Exploited Vulnerabilities, Criminal IP, MalwareBazaar, ManageEngine Endpoint Central, Shodan, VirusTotalMiniMax M2.5NordStellaragainst: CrowdStrike Falcon, Recorded Future Intelligence Cloudno first choiceChangedGreyNoiseMISPagainst: ThreatConnectno first choiceagainst: Anomali ThreatStream, OpenCTI, ThreatConnect
Two alternatives
Rapid7 Threat Command, ZeroFox IntelligenceThree alternatives
CloudSEK, NordStellar, Recorded Future Intelligence CloudFour alternatives
Abuse.ch, AlienVault OTX, CISA AIS, VirusTotalBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Seventy-two rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 13:26 | no | 0 | 4 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 10:42 | yes | 2 | 7 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 09:55 | yes | 18 | 23 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-09-17 12:12 | yes | 20 | 4 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 11:55 | yes | 42 | 23 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 12:13 | yes | 12 | 7 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-09-17 13:51 | yes | 25 | 47 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 10:51 | yes | 5 | 3 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 14:06 | yes | 9 | 22 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 10:48 | yes | 29 | 43 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 13:49 | yes | 13 | 116 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 11:17 | yes | 11 | 26 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 13:30 | yes | 17 | 9 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 10:56 | no | 0 | 7 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 14:00 | yes | 14 | 27 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-09-17 12:37 | yes | 18 | 6 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 09:54 | yes | 39 | 17 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 10:36 | yes | 10 | 7 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 09:37 | yes | 17 | 16 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 14:13 | yes | 5 | 3 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 09:59 | no | 0 | 44 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 14:02 | yes | 14 | 21 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 09:44 | yes | 13 | 114 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 09:36 | yes | 5 | 88 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 09:36 | yes | 16 | 13 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 10:41 | yes | 4 | 12 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 13:03 | yes | 21 | 30 s |
| Comparative | Perplexity Sonar | sonar | 2026-09-17 10:34 | yes | 20 | 8 s |
| Comparative | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 10:21 | yes | 47 | 20 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 12:02 | yes | 9 | 8 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 10:00 | yes | 27 | 27 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 11:48 | yes | 5 | 3 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 09:34 | yes | 10 | 42 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 12:58 | yes | 14 | 49 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 13:32 | yes | 28 | 324 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 10:56 | yes | 22 | 53 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 13:47 | yes | 9 | 6 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 10:31 | yes | 4 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 14:12 | yes | 17 | 27 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-09-17 12:41 | yes | 20 | 5 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 14:09 | yes | 24 | 14 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 10:25 | yes | 5 | 4 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 13:13 | yes | 10 | 13 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 12:48 | yes | 5 | 3 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 11:18 | no | 0 | 31 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 11:37 | yes | 20 | 47 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 13:06 | yes | 14 | 145 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 11:58 | yes | 5 | 45 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 13:44 | no | 0 | 6 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 11:28 | no | 0 | 9 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 11:19 | no | 0 | 15 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-09-17 13:45 | yes | 20 | 13 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 10:56 | yes | 14 | 9 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 09:37 | no | 0 | 8 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 12:03 | yes | 17 | 29 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 11:25 | yes | 5 | 4 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 12:21 | no | 0 | 35 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 09:27 | yes | 18 | 29 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 14:06 | yes | 13 | 86 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 10:05 | yes | 5 | 16 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 12:49 | yes | 14 | 8 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 09:52 | yes | 5 | 6 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 13:02 | yes | 7 | 22 s |
| Negative framing | Perplexity Sonar | sonar | 2026-09-17 11:19 | yes | 20 | 6 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 13:43 | yes | 20 | 12 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 12:06 | yes | 5 | 6 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 12:02 | yes | 18 | 25 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 11:22 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 13:58 | yes | 9 | 49 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 11:13 | yes | 29 | 41 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 10:34 | yes | 18 | 150 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 10:09 | yes | 10 | 33 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Anomali read as Anomali ThreatStream
CrowdStrike Falcon Intelligence / Adversary Intelligence read as CrowdStrike Falcon Intelligence
Cyble read as Cyble Vision
Cyware read as Cyware Intel Exchange
Flare.io read as Flare
Flashpoint read as Flashpoint Ignite
Google Mandiant read as Google Threat Intelligence
Group-IB read as Group-IB Threat Intelligence
Mandiant read as Mandiant Threat Intelligence
Mandiant (Google Cloud) read as Mandiant Threat Intelligence
Mandiant (Google Threat Intelligence) read as Mandiant Threat Intelligence
Mandiant (Google) read as Mandiant Threat Intelligence
Mandiant Advantage read as Mandiant Threat Intelligence
Mandiant Enterprise read as Mandiant Threat Intelligence
Microsoft Defender TI read as Microsoft Defender Threat Intelligence
Microsoft Defender threat intel read as Microsoft Defender Threat Intelligence
Palo Alto Cortex XSOAR read as Palo Alto Networks Cortex XSOAR
Recorded Future read as Recorded Future Intelligence Cloud
Recorded Future (Intelligence Cloud) read as Recorded Future Intelligence Cloud
SOCRadar read as SOCRadar Extended Threat Intelligence
SentinelOne read as SentinelOne Singularity
Splunk read as Splunk Enterprise Security
ZeroFox read as ZeroFox Intelligence
Unresolved, counted raw
ActiveFence
CIRCL OSINT feed
CISA Cyber Hygiene Services
CISA Known Exploited Vulnerabilities (KEV)
CISA’s AIS
Cloud SEK
CyberCure Advanced Cyber Threat Intelligence
Falcon Intelligence
FireEye iSight
GreyNoise Community
HaveIBeenPwned
IBM Threat Intelligence
IntelFinder
Maltiverse
Microsoft built-ins
Pyrra
RiskIQ PassiveTotal
Splunk Intelligence Management
VMRay's ThreatFeed
abuse.ch PhishTank
whiteintel.io
Discontinued, still offered
No shut-down product was recommended here.