Threat intelligence platforms for small business buyers
Asked as “threat intelligence platform”, and as “cyber threat intelligence feed and platform”, on behalf of a small B2B company. 59 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
19%
Contested · SOCRadar Extended Threat Intelligence 10%
19MISP10SOCRadar Extended Threat Intelligence08NordStellar63others
19% of first choices, contested.
Since October 2026▲+1Since October 2026: 18% → 19%, +1 point. Inside the 11-point floor: within noise.MISP held the lead, +1 point on 18%, inside the 11-point floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
MISP19%Contested▲+1Since October 2026: 18% → 19%, +1 point. Inside the 11-point floor: within noise.This pageMid-marketMISP21%Contested▲+9Since October 2026: 12% → 21%, +9 points. Inside the 11-point floor: within noise.Standing →Enterprise
Recorded Future Intelligence Cloud62%Clear leader▼−11Since October 2026: 73% → 62%, −11 points. Past the 11-point floor: movement.Standing →
MISP19%Contested▲+1Since October 2026: 18% → 19%, +1 point. Inside the 11-point floor: within noise.This pageMid-marketMISP21%Contested▲+9Since October 2026: 12% → 21%, +9 points. Inside the 11-point floor: within noise.Standing →EnterpriseRecorded Future Intelligence Cloud62%Clear leader▼−11Since October 2026: 73% → 62%, −11 points. Past the 11-point floor: movement.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026
01MISP19%21%48accepted challenger▲+1Since October 2026: 18% → 19%, +1 point. Inside the 11-point floor: within noise.18% → 19%
MISP19%21%48accepted challenger▲+1Since October 2026: 18% → 19%, +1 point. Inside the 11-point floor: within noise.18% → 19%02
SOCRadar Extended Threat Intelligence10%0%17accepted challenger▲+1Since October 2026: 9% → 10%, +1 point. Inside the 11-point floor: within noise.9% → 10%
SOCRadar Extended Threat Intelligence10%0%17accepted challenger▲+1Since October 2026: 9% → 10%, +1 point. Inside the 11-point floor: within noise.9% → 10%03
NordStellar8%6%17accepted challenger▼−4Since October 2026: 12% → 8%, −4 points. Inside the 11-point floor: within noise.12% → 8%
NordStellar8%6%17accepted challenger▼−4Since October 2026: 12% → 8%, −4 points. Inside the 11-point floor: within noise.12% → 8%04
VirusTotal7%0%23accepted challenger▲+5Since October 2026: 2% → 7%, +5 points. Inside the 11-point floor: within noise.2% → 7%
VirusTotal7%0%23accepted challenger▲+5Since October 2026: 2% → 7%, +5 points. Inside the 11-point floor: within noise.2% → 7%05
AlienVault OTX7%4%23accepted challenger▼−7Since October 2026: 14% → 7%, −7 points. Inside the 11-point floor: within noise.14% → 7%
AlienVault OTX7%4%23accepted challenger▼−7Since October 2026: 14% → 7%, −7 points. Inside the 11-point floor: within noise.14% → 7%06
OpenCTI7%35%31criticized challenger▲+5Since October 2026: 2% → 7%, +5 points. Inside the 11-point floor: within noise.2% → 7%
OpenCTI7%35%31criticized challenger▲+5Since October 2026: 2% → 7%, +5 points. Inside the 11-point floor: within noise.2% → 7%07
Cyble Vision5%0%11accepted challenger▲+5Since October 2026: 0% → 5%, +5 points. Inside the 11-point floor: within noise.0% → 5%
Cyble Vision5%0%11accepted challenger▲+5Since October 2026: 0% → 5%, +5 points. Inside the 11-point floor: within noise.0% → 5%08
GreyNoise3%0%14accepted challenger▼−1Since October 2026: 4% → 3%, −1 point. Inside the 11-point floor: within noise.4% → 3%
GreyNoise3%0%14accepted challenger▼−1Since October 2026: 4% → 3%, −1 point. Inside the 11-point floor: within noise.4% → 3%09
Anomali ThreatStream3%50%32criticized challenger▲+1Since October 2026: 2% → 3%, +1 point. Inside the 11-point floor: within noise.2% → 3%
Anomali ThreatStream3%50%32criticized challenger▲+1Since October 2026: 2% → 3%, +1 point. Inside the 11-point floor: within noise.2% → 3%10
Flare2%10%10accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%
Flare2%10%10accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%11
ThreatConnect2%73%30criticized challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%
ThreatConnect2%73%30criticized challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%Show the five products at 0%, ordered by negative rate
15
Mandiant Threat Intelligence Lab in the set0%82%11criticized challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%
Mandiant Threat Intelligence Lab in the set0%82%11criticized challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%16Recorded Future Intelligence Cloud0%73%59criticized challenger▼−4Since October 2026: 4% → 0%, −4 points. Inside the 11-point floor: within noise.4% → 0%
Recorded Future Intelligence Cloud0%73%59criticized challenger▼−4Since October 2026: 4% → 0%, −4 points. Inside the 11-point floor: within noise.4% → 0%14
CrowdStrike Falcon Intelligence0%38%21criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
CrowdStrike Falcon Intelligence0%38%21criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%13
CrowdStrike Falcon0%20%10accepted challenger▼−4Since October 2026: 4% → 0%, −4 points. Inside the 11-point floor: within noise.4% → 0%
CrowdStrike Falcon0%20%10accepted challenger▼−4Since October 2026: 4% → 0%, −4 points. Inside the 11-point floor: within noise.4% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Mandiant Threat Intelligence is made by Google, whose model Gemini 3.5 Flash is in the set. On the four share prompts that model made it the first choice zero times of 4; the other thirteen models zero times of 52. Lab treatment is defined on the method page; the row is marked, not excluded.
Head to headHead-to-head pages are published for mid-market buyers, so these open on mid-market figures, not small business.
All twenty-eight head-to-head pages: the top eight products, each against each
MISP vs SOCRadar Extended Threat IntelligenceMISP vs CrowdStrike Falcon IntelligenceMISP vs Recorded Future Intelligence CloudMISP vs AlienVault OTXOpenCTI vs Anomali ThreatStreamOpenCTI vs Rapid7 Threat CommandOpenCTI vs SOCRadar Extended Threat IntelligenceOpenCTI vs CrowdStrike Falcon IntelligenceOpenCTI vs Recorded Future Intelligence CloudOpenCTI vs AlienVault OTXAnomali ThreatStream vs Rapid7 Threat CommandAnomali ThreatStream vs SOCRadar Extended Threat IntelligenceAnomali ThreatStream vs CrowdStrike Falcon IntelligenceAnomali ThreatStream vs Recorded Future Intelligence CloudAnomali ThreatStream vs AlienVault OTXRapid7 Threat Command vs SOCRadar Extended Threat IntelligenceRapid7 Threat Command vs CrowdStrike Falcon IntelligenceRapid7 Threat Command vs Recorded Future Intelligence CloudRapid7 Threat Command vs AlienVault OTXSOCRadar Extended Threat Intelligence vs CrowdStrike Falcon IntelligenceSOCRadar Extended Threat Intelligence vs Recorded Future Intelligence CloudSOCRadar Extended Threat Intelligence vs AlienVault OTXCrowdStrike Falcon Intelligence vs Recorded Future Intelligence CloudCrowdStrike Falcon Intelligence vs AlienVault OTXRecorded Future Intelligence Cloud vs AlienVault OTX
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
0102030405060708091011
1213141516Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative30%
Key
01MISP19%
MISP19%02SOCRadar Extended Threat Intelligence10%
SOCRadar Extended Threat Intelligence10%03NordStellar8%
NordStellar8%04VirusTotal7%
VirusTotal7%05AlienVault OTX7%
AlienVault OTX7%06OpenCTI7%
OpenCTI7%07Cyble Vision5%
Cyble Vision5%08GreyNoise3%
GreyNoise3%09Anomali ThreatStream3%
Anomali ThreatStream3%10Flare2%
Flare2%11ThreatConnect2%
ThreatConnect2%12Amazon GuardDuty0%
Amazon GuardDuty0%13CrowdStrike Falcon0%
CrowdStrike Falcon0%14CrowdStrike Falcon Intelligence0%
CrowdStrike Falcon Intelligence0%15Mandiant Threat Intelligence0%
Mandiant Threat Intelligence0%16Recorded Future Intelligence Cloud0%
Recorded Future Intelligence Cloud0%What they warned about
Zero of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.20, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Recorded Future Intelligence Cloud73%
43 of 59 labels negative · 14 of 14 models · 15 hard negative
“expensive enterprise Threat Intelligence Platforms (TIPs) like Recorded Future or ThreatConnect are usually unnecessary and cost-prohibitive” Gemini 3.5 Flash, budget prompt
Anomali ThreatStream50%
16 of 32 labels negative · 10 of 14 models · 6 hard negative
“Anomali ThreatStream is described in the same set as "powerful but expensive, complex, and often overkill for small businesses"” Muse Glimmer 30B, negative prompt
ThreatConnect73%
22 of 30 labels negative · 9 of 14 models · 10 hard negative
“flagged as an enterprise-grade platform with a high negative rate (57% negative labels), noted for being expensive and complex for small business needs” Mistral Small, negative prompt
Mandiant Threat Intelligence82%
9 of 11 labels negative · 7 of 14 models · 4 hard negative
“High-Cost Enterprise TIPs ... should be avoided or approached with extreme caution.” Gemini 3.5 Flash, negative prompt
What they cite
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.
Sites the answers cite
76 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 797 links across 193 sites, every framing counted. Ranked by the number of answers carrying the site or page. 55 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
33 answers · 35 citations · 11 models
29 answers · 35 citations · 10 models
24 answers · 24 citations · 11 models
vendor site · G223 answers · 45 citations · 10 models
vendor site · Cyble20 answers · 21 citations · 9 models
vendor site · Vectra19 answers · 19 citations · 7 models
17 answers · 18 citations · 7 models
vendor site · UpGuard16 answers · 16 citations · 8 models
publisher (Gane)15 answers · 23 citations · 8 models
vendor site · Consilien14 answers · 14 citations · 8 models
vendor site · Cyware11 answers · 13 citations · 8 models
11 answers · 13 citations · 5 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
32 answers · 11 models
24 answers · 11 models
23 answers · 10 models
19 answers · 9 models
19 answers · 7 models
15 answers · 8 models
14 answers · 7 models
13 answers · 8 models
13 answers · 8 models
11 answers · 5 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best threat intelligence platform”, “threat intelligence platform”, “threat intelligence platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| MISP misp-project.org | 19% | 98 | 1,600 | 91 | 1,202 | 2 | ||
| AlienVault OTX alienvault.com AlienVault OTX 7%, AlienVault Open Threat Exchange 5% | 12% | 40 | 880 | 6 | 11,662 | |||
| SOCRadar Extended Threat Intelligence socradar.io | 10% | 132 | 20 | 0 | 19,499 | 0 | ||
| NordStellar nordlayer.com | 8% | 24 | 110 | 0 | 136,857 | $985 | 120 | |
| VirusTotal virustotal.com | 7% | 28 | 246,000 | 493 | 476,788 | |||
| OpenCTI filigran.io | 7% | 72 | 1,900 | 94 | 1,947 | 0 | ||
| Cyble Vision cyble.com | 5% | 91 | 30 | 1 | 20,856 | 11 | ||
| Microsoft Defender microsoft.com Microsoft Defender for Cloud 3%, Microsoft 2% | 5% | 659 | 2,240,000 | 403,136 | 145,358,109 company | $12,455 | 103 | |
| GreyNoise greynoise.io | 3% | 22 | 1,900 | 41 | 1,797 | 9 | ||
| OpenCTI Community Edition opencti.io | 3% | 3 | 661 |
Google's top ten for the three searches hold 16 sites; 3 of them are among the sites the models cited here (cyware.com, misp-project.org, reddit.com). The first result for “best threat intelligence platform” is reddit.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best threat intelligence platform for a small B2B company?”Paraphrase“Which cyber threat intelligence feed and platform would you recommend to a small business that sells to other businesses?”Comparative“What are the top threat intelligence platforms for a small team and how do they differ?”Budget-constrained“What is the best threat intelligence platform for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a threat intelligence platform. What should we look at?”Negative“Which threat intelligence platforms should a small business avoid or be cautious about?”
Claude Haiku 4.5NordStellarno first choiceChangedAlienVault OTXSOCRadar Extended Threat Intelligenceno first choiceagainst: CrowdStrike Falcon, Recorded Future Intelligence Cloud
Five alternatives
Aikido, AlienVault OTX, CloudSEK, FalconFeeds, ThreatConnectThree alternatives
OpenCTI, Stellar Cyber, ZeroFox IntelligenceFour alternatives
OpenCTI, Stellar Cyber, Talos, YetiGPT-5.4 miniGreyNoiseagainst: Microsoft Defender Threat IntelligenceFeedly Threat IntelligenceChangedagainst: Recorded Future Intelligence CloudRecorded Future Intelligence CloudOpenCTIagainst: Recorded Future Intelligence Cloudno first choiceagainst: CrowdStrike Falcon Intelligence, Recorded Future Intelligence Cloud
Two alternatives
Recorded Future Intelligence Cloud, ZeroFox IntelligenceOne alternative
CrowdStrike threat intelligence feedsSix alternatives
CrowdStrike Falcon, Cyble Vision, Flashpoint Ignite, GreyNoise, SOCRadar Extended Threat Intelligence, ZeroFox IntelligenceTwo alternatives
GreyNoise, MISPGemini 3.5 FlashFlareagainst: Anomali ThreatStream, ThreatConnectMicrosoft Defender for CloudChangedagainst: MISP, OpenCTI, Recorded Future Intelligence Cloud, ThreatConnectMISPagainst: Recorded Future Intelligence Cloud, ThreatConnectLevelBlue Open Threat Exchange, OpenCTIagainst: Recorded Future Intelligence Cloud, ThreatConnectno first choiceagainst: Anomali ThreatStream, Recorded Future Intelligence Cloud, ThreatConnectagainst: Anomali ThreatStream, MISP, Mandiant Threat Intelligence, OpenCTI, Recorded Future Intelligence Cloud, ThreatConnect, ThreatQuotient
Ten alternatives
CrowdStrike Falcon, Feedly Threat Intelligence, GitGuardian, Have I Been Pwned, Huntress, MISP, Microsoft Defender for Endpoint, Microsoft Sentinel, OpenCTI, SOCRadar Extended Threat IntelligenceNine alternatives
AlienVault OTX, Blackpoint Cyber, CISA Known Exploited Vulnerabilities (KEV) Catalog, Canarytokens, CrowdStrike Falcon, GreyNoise, Have I Been Pwned, Huntress, abuse.ch feedsFive alternatives
AlienVault OTX, Feedly Threat Intelligence, Flare, OpenCTI, SOCRadar Extended Threat IntelligenceThree alternatives
CISA Known Exploited Vulnerabilities (KEV) Catalog, MISP, MS-ISACEleven alternatives
Censys, CrowdStrike Falcon, Feedly Threat Intelligence, Flare, GreyNoise, MISP, Microsoft Defender XDR, OpenCTI, SentinelOne Singularity, Shodan, VirusTotalPerplexity SonarCyble Visionagainst: Recorded Future Intelligence CloudCISA's Known Exploited Vulnerabilities (KEV) CatalogChangedMISPagainst: Recorded Future Intelligence CloudSOCRadar Extended Threat Intelligenceagainst: MISPno first choiceagainst: Anomali ThreatStream, CrowdStrike Falcon Intelligence, Intel 471, MISP, OpenCTI, Palo Alto Networks Unit 42 intelligence, Recorded Future Intelligence Cloud, ThreatConnect
Five alternatives
Amazon GuardDuty, Falcon Adversary Intelligence, Flare, Microsoft Sentinel, VirusTotalThree alternatives
CISA Automated Indicator Sharing, Flare, Microsoft SentinelSix alternatives
Anomali ThreatStream, CrowdStrike Falcon Intelligence, Flashpoint Ignite, Google Threat Intelligence, OpenCTI, ThreatConnectThree alternatives
Amazon GuardDuty, GreyNoise, VirusTotalGrok 4.20Cyble Visionagainst: Google Threat Intelligence, ThreatConnectAlienVault Open Threat Exchange, MISPChangedagainst: Anomali ThreatStreamAnomali ThreatStreamagainst: CrowdStrike Falcon Intelligence, Flashpoint Ignite, Mandiant Threat Intelligence, Recorded Future Intelligence CloudAlienVault OTXagainst: CrowdStrike Falcon Intelligence, Rapid7 Threat Command, Recorded Future Intelligence Cloud, ThreatConnectMicrosoftagainst: Mandiant Threat Intelligence, Recorded Future Intelligence Cloud, ThreatConnectagainst: Anomali ThreatStream, CrowdStrike Falcon Intelligence, Flashpoint Ignite, Google Threat Intelligence, OpenCTI, Recorded Future Intelligence Cloud, ThreatConnect
Five alternatives
Anomali ThreatStream, CrowdStrike Falcon X, Falcon Adversary Intelligence, Flare, Recorded Future Intelligence CloudThree alternatives
CrowdStrike Falcon X, FBI InfraGard, Recorded Future Intelligence CloudFour alternatives
AlienVault OTX, MISP, Rapid7 Threat Command, ThreatConnectTwo alternatives
NordStellar, VirusTotalThree alternatives
CrowdStrike, MISP, Rapid7 Threat CommandMistral SmallAlienVault OTX, MISPAlienVault OTX, CISA AIS, MISP, VirusTotalChangedVirusTotalagainst: Anomali ThreatStream, Rapid7 Threat Command, Recorded Future Intelligence CloudMISPno first choiceagainst: Anomali ThreatStream, Mandiant Threat Intelligence, Recorded Future Intelligence Cloud, ThreatConnect
Four alternatives
CrowdStrike Falcon, GreyNoise, Recorded Future Intelligence Cloud, VirusTotalThree alternatives
Abuse.ch, Cyble Vision, FlareFour alternatives
Amazon GuardDuty, CrowdStrike Falcon Intelligence, GreyNoise, NordStellarThree alternatives
AlienVault OTX, Amazon GuardDuty, VirusTotalDeepSeek V4 FlashSOCRadar Extended Threat Intelligenceagainst: Flashpoint Ignite, Recorded Future Intelligence Cloud, ThreatConnectCrowdStrike Falcon GoChangedagainst: Recorded Future Intelligence CloudOpenCTIagainst: Recorded Future Intelligence Cloud, ThreatConnectAlienVault OTXagainst: FalconFeeds.io, NordStellar, Recorded Future Intelligence Cloud, ThreatConnectNordStellaragainst: MISP, OpenCTI, Palo Alto Networks Cortex XSOAR, Recorded Future Intelligence Cloud, ThreatConnectagainst: AlienVault OTX, Anomali ThreatStream, MISP, Recorded Future Intelligence Cloud, ThreatConnect
Four alternatives
CrowdStrike Falcon Intelligence, Flare, NordStellar, OpenCTITwo alternatives
AlienVault OTX, MISPThree alternatives
Anomali ThreatStream, CrowdStrike Falcon Intelligence, MISPFour alternatives
Abuse.ch, Feedly Threat Intelligence, MISP, VirusTotal communityFive alternatives
Brandefense, CrowdStrike Falcon Intelligence, Cyberint, Cyble Vision, SOCRadar Extended Threat IntelligenceLlama 4 MaverickCyble Visionagainst: Recorded Future Intelligence Cloudno first choiceChangedno first choiceVirusTotalno first choiceagainst: Recorded Future Intelligence Cloud
Three alternatives
CloudSEK, CrowdStrike Falcon Intelligence, VirusTotalThree alternatives
AlienVault OTX, GreyNoise, SOCRadar Extended Threat IntelligenceQwen 3.7 FlashNordStellaragainst: Recorded Future Intelligence CloudGreyNoiseChangedOpenCTIagainst: Cisco UmbrellaCyberint, MISP, SOCRadar Extended Threat Intelligenceagainst: CrowdStrike Falcon Intelligence, Recorded Future Intelligence Cloudno first choiceagainst: Anomali ThreatStream, CrowdStrike Falcon Intelligence, Recorded Future Intelligence Cloudagainst: IBM QRadar, Recorded Future Intelligence Cloud, Splunk Enterprise Security, ThreatConnect
Two alternatives
CrowdStrike Falcon Intelligence, VirusTotalThree alternatives
AlienVault OTX, CISA KEV, Cyble VisionSix alternatives
CrowdStrike Falcon Intelligence, GreyNoise, Have I Been Pwned, MISP, NordStellar, OTXTwo alternatives
AlienVault OTX, VirusTotalTwo alternatives
Microsoft Defender, SentinelOne SingularityKimi K2NordStellaragainst: IBM X-Force Exchange, MISP, Recorded Future Intelligence CloudMicrosoft Defender for CloudChangedMISP, OpenCTIagainst: Anomali ThreatStream, Recorded Future Intelligence CloudMISPAnomali ThreatStream, ThreatConnectagainst: Anomali ThreatStream, Flashpoint Ignite, IBM X-Force Exchange, Mandiant Threat Intelligence, Recorded Future Intelligence Cloud, ThreatConnect
Five alternatives
Blue Lantern Security, CrowdStrike Falcon Go, ISMalicious, IntelFinder, OpenCTIThree alternatives
AlienVault Open Threat Exchange, ISMalicious, MISPOne alternative
NordStellarFour alternatives
Anomali ThreatStream, NordStellar, OpenCTI, OpenThreatTwo alternatives
MISP, OpenCTIGLM 4.7 FlashXSOCRadar Extended Threat IntelligenceAlienVault Open Threat Exchange, Anomali ThreatStreamChangedagainst: Recorded Future Intelligence CloudRecorded Future Intelligence Cloudagainst: Flashpoint IgniteOpenCTI Community Edition, VirusTotalagainst: Flareno first choiceagainst: Flashpoint Ignite, Intel 471, KELA, Mandiant Threat Intelligence, Recorded Future Intelligence Cloud, ZeroFox Intelligence
Three alternatives
CrowdStrike Falcon Intelligence, Microsoft Defender for Cloud, NordStellarTwo alternatives
Arctic Wolf, CrowdStrike Managed DetectionTwo alternatives
Bitsight, ZeroFox IntelligenceThree alternatives
Amazon GuardDuty, ESET Threat Intelligence, ISMaliciousMiniMax M2.5OpenCTIAlienVault Open Threat ExchangeChangedIBM X-Force Exchangeagainst: Anomali ThreatStream, CrowdStrike Falcon Intelligence, Rapid7 Threat Command, Recorded Future Intelligence CloudMISP, OpenCTI, VirusTotalno first choiceagainst: Anomali ThreatStream, IBM X-Force Exchange, RSA, Recorded Future Intelligence Cloud
Four alternatives
AlertMedia, Mandiant Threat Intelligence, Recorded Future Intelligence Cloud, VirusTotalFour alternatives
CrowdStrike Falcon X, Feedly Threat Intelligence, MISP, Recorded Future Intelligence CloudThree alternatives
Cyble Vision, MISP, ThreatConnectThree alternatives
Amazon GuardDuty, NordStellar, Recorded Future Intelligence CloudGPT-6 LunaMISPagainst: Microsoft Defender Threat Intelligence, OpenCTICISA's Known Exploited Vulnerabilities (KEV) Catalog and cybersecurity advisoriesChangedagainst: OpenCTIMISPagainst: Recorded Future Intelligence CloudMISPagainst: OpenCTIno first choiceagainst: MISP, OpenCTIagainst: Anomali ThreatStream, MISP, Mandiant Threat Intelligence, OpenCTI, Recorded Future Intelligence Cloud, ThreatConnect
One alternative
SOCRadar CTI EssentialOne alternative
Microsoft Defender for CloudThree alternatives
Anomali ThreatStream, OpenCTI, ThreatConnectOne alternative
PulsediveMuse Glimmer 30BNordStellar, SOCRadar Extended Threat Intelligenceagainst: Recorded Future Intelligence CloudAlienVault Open Threat Exchange, OTX, MISPChangedagainst: CrowdStrike, Mandiant Threat Intelligence, Recorded Future Intelligence CloudNordStellar, SOCRadar Extended Threat Intelligenceagainst: Check Point Exposure Management, Recorded Future Intelligence Cloud, ThreatConnectMISP, OpenCTI Community Editionno first choiceagainst: MISP, OpenCTIagainst: Anomali ThreatStream, CrowdStrike Falcon, IBM X-Force Exchange, Mandiant Threat Intelligence, Palo Alto Networks Cortex XSOAR, Recorded Future Intelligence Cloud, ThreatConnect
Three alternatives
Amazon GuardDuty, GreyNoise, MISPSix alternatives
CISA Automated Indicator Sharing AIS / CISA KEV Catalog, Feedly Threat Intelligence, MalwareBazaar, OpenCTI, ThreatFox, abuse.ch URLhausFour alternatives
Anomali ThreatStream, CrowdStrike Falcon Intelligence, Flare, Rapid7 Threat CommandThree alternatives
ISMalicious, NordStellar, SOCRadar Extended Threat IntelligenceOne alternative
CISA Automated Indicator SharingBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:26 | yes | 9 | 8 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 17:43 | yes | 3 | 5 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 14:21 | yes | 9 | 24 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-11-01 18:05 | yes | 10 | 4 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:14 | yes | 5 | 11 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 11:33 | yes | 5 | 5 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 09:41 | yes | 23 | 21 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 10:32 | yes | 5 | 3 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 15:43 | yes | 5 | 28 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 19:26 | yes | 15 | 23 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 09:57 | yes | 23 | 79 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 13:16 | yes | 5 | 56 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-11-01 13:26 | yes | 4 | 14 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 16:52 | yes | 11 | 19 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 18:32 | no | 0 | 4 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 10:35 | yes | 3 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 10:36 | no | 0 | 16 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-11-01 17:11 | yes | 10 | 3 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 14:56 | yes | 5 | 11 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 12:35 | yes | 10 | 7 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 18:53 | yes | 25 | 42 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 11:39 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 10:39 | yes | 14 | 88 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 15:10 | yes | 25 | 54 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 18:19 | yes | 25 | 39 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 11:01 | yes | 5 | 18 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-11-01 13:05 | yes | 3 | 18 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 11:46 | yes | 14 | 27 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:54 | yes | 20 | 11 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 08:50 | yes | 2 | 7 s |
| Comparative | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 19:38 | yes | 13 | 31 s |
| Comparative | Perplexity Sonar | sonar | 2026-11-01 10:10 | yes | 10 | 5 s |
| Comparative | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:59 | yes | 5 | 16 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 17:05 | yes | 5 | 6 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 18:59 | yes | 24 | 49 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 12:36 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 09:59 | yes | 20 | 76 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 12:01 | yes | 15 | 38 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 16:15 | yes | 24 | 74 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 13:22 | yes | 10 | 22 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-11-01 13:59 | yes | 5 | 17 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 16:03 | yes | 14 | 35 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 19:36 | yes | 10 | 8 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 17:43 | yes | 4 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 09:15 | yes | 8 | 19 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-11-01 14:12 | yes | 10 | 4 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:45 | yes | 5 | 12 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 12:56 | yes | 5 | 5 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 15:11 | yes | 24 | 29 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 14:20 | yes | 5 | 3 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 12:06 | yes | 5 | 20 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 14:12 | yes | 10 | 15 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 09:56 | yes | 9 | 20 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 13:47 | yes | 5 | 15 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 18:48 | yes | 3 | 14 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 12:33 | yes | 14 | 19 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 16:24 | no | 0 | 7 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 12:25 | no | 0 | 6 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 12:05 | no | 0 | 19 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-11-01 15:28 | yes | 10 | 8 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:39 | yes | 5 | 15 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 09:00 | no | 0 | 7 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 14:58 | yes | 24 | 39 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 19:17 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 13:58 | no | 0 | 27 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 12:11 | yes | 15 | 20 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 09:39 | yes | 19 | 54 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 17:37 | yes | 5 | 37 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 19:01 | yes | 4 | 16 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 16:24 | yes | 12 | 25 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 09:38 | yes | 18 | 8 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 13:45 | yes | 2 | 5 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 11:04 | yes | 6 | 21 s |
| Negative framing | Perplexity Sonar | sonar | 2026-11-01 13:18 | yes | 10 | 5 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 15:47 | yes | 5 | 9 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 19:12 | yes | 5 | 5 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 18:00 | yes | 21 | 36 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 13:49 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 12:23 | yes | 5 | 26 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 16:52 | yes | 19 | 26 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 15:29 | yes | 22 | 56 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 19:15 | no | 0 | 30 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-11-01 16:19 | yes | 4 | 16 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 16:52 | yes | 11 | 19 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Anomali read as Anomali ThreatStream
Anomali (ThreatStream) read as Anomali ThreatStream
Cortex XSOAR read as Palo Alto Networks Cortex XSOAR
CrowdStrike Falcon Adversary Intelligence read as CrowdStrike Falcon Intelligence
Cyble read as Cyble Vision
Flare.io read as Flare
Flashpoint read as Flashpoint Ignite
Group-IB read as Group-IB Threat Intelligence
IBM X-Force read as IBM X-Force Exchange
Mandiant read as Mandiant Threat Intelligence
Mandiant (Google Cloud) read as Mandiant Threat Intelligence
Microsoft Defender TI read as Microsoft Defender Threat Intelligence
Microsoft Threat Intelligence read as Microsoft Defender Threat Intelligence
Palo Alto Cortex XSOAR read as Palo Alto Networks Cortex XSOAR
Palo Alto XSOAR read as Palo Alto Networks Cortex XSOAR
Rapid7 read as Rapid7 Threat Command
Recorded Future read as Recorded Future Intelligence Cloud
SOCRadar read as SOCRadar Extended Threat Intelligence
SentinelOne read as SentinelOne Singularity
Splunk Enterprise read as Splunk Enterprise Security
ZeroFox read as ZeroFox Intelligence
Unresolved, counted raw
AlienVault Open Threat Exchange, OTX
Blue Lantern Security
CISA AIS feeds
CISA Automated Indicator Sharing AIS / CISA KEV Catalog
CISA's Known Exploited Vulnerabilities (KEV) Catalog and cybersecurity advisories
CISA’s Known Exploited Vulnerabilities (KEV) Catalog
CrowdStrike Managed Detection
CrowdStrike threat intelligence feeds
Cymon
Datadog Threat Intelligence
Dehashed
ESET Threat Intel Feeds
Emerging Threats (EThreats)
FalconFeeds.io
IntelFinder
LevelBlue OTX Open Threat Exchange
Microsoft intelligence inside Defender XDR
OpenThreat
Palo Alto Networks Unit 42 intelligence
SOCRadar CTI Essential
Sekoia.io
Sophos MTR
Talos
URLScan.io
WatchGuard's Threat Detection and Response (TDR)
Discontinued, still offered
No shut-down product was recommended here.