Best Threat Intelligence Platforms in 2026

In short: OpenAEV is ranked #1 of 31 as of 4 October 2026, ahead of IBM X-Force Exchange and ThreatForge. The best-ranked option with a free plan is IBM X-Force Exchange. The lowest first paid tier on this page is SOCRadar Extended Threat Intelligence Platform at $379.17/mo.

Security teams use threat intelligence platforms to organize information about threats and support related response work. Compared on indicator enrichment, STIX/TAXII support, report management, and case management, the entries offer details on how intelligence and investigations can be handled. Deployment and workflow automation are useful operational points to weigh, while free-plan availability and paid-from pricing add cost context. OpenAEV, IBM X-Force Exchange, and ThreatForge are among the options shown. Compare how each platform’s listed capabilities fit the way your team gathers, enriches, documents, and acts on threat intelligence.

31 threat intelligence platforms ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.

31ranked
3free plans on this page
$379.17/molowest paid tier
4 Oct 2026last checked
Input list Threat Intelligence Platforms 25 channels on this page · 138 of 200 spec lines stated by the makers
Ch Tool Free planPaid fromIndicator enrichmentSTIX/TAXII supportReport managementWorkflow automationCase managementDeployment Spec sheet Score
01 OpenAEV Free planYesPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementYesDeploymenthybrid 7/8spec lines stated 7.4
02 IBM X-Force Exchange Free planYesPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementYesDeploymentcloud 7/8spec lines stated 7.3
03 ThreatForge Free planYesPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportnot statedReport managementYesWorkflow automationYesCase managementYesDeploymentself-hosted 6/8spec lines stated 7.2
04 Security Vision TIP Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementYesDeploymentself-hosted 6/8spec lines stated 7.0
05 SOCRadar Extended Threat Intelligence Platform Free planYesPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementYesDeploymentcloud 7/8spec lines stated 7.0
06 Group-IB Attack Surface Management Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementnot statedDeploymentcloud 5/8spec lines stated 6.7
07 Flashpoint Ignite Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementYesDeploymentcloud 6/8spec lines stated 6.6
08 Anomali Platform Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementYesDeploymenthybrid 6/8spec lines stated 6.4
09 Intel 471 Verity471 Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementYesDeploymentcloud 6/8spec lines stated 6.4
10 AhnLab V3 Internet Security Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportnot statedReport managementYesWorkflow automationYesCase managementnot statedDeploymentcloud 4/8spec lines stated 6.3
11 Bitsight External Attack Surface Management Free planNoPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementnot statedDeploymentcloud 6/8spec lines stated 6.3
12 EclecticIQ Platform Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementYesDeploymenthybrid 6/8spec lines stated 6.3
13 Pulse Intelligence Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementnot statedDeploymentself-hosted 5/8spec lines stated 6.3
14 OODA Intelligence Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementYesDeploymentcloud 6/8spec lines stated 5.9
15 ThreatQ Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementYesDeploymenthybrid 6/8spec lines stated 5.9
16 Cyble Vision Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementnot statedWorkflow automationYesCase managementnot statedDeploymentcloud 4/8spec lines stated 5.8
17 Cyware Intelligence Exchange Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementYesDeploymenthybrid 6/8spec lines stated 5.8
18 Kaspersky Threat Intelligence Portal Free planYesPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationnot statedCase managementnot statedDeploymentcloud 5/8spec lines stated 5.8
19 SİBERAT Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementNoDeploymenthybrid 6/8spec lines stated 5.8
20 ThreatConnect Platform Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementYesDeploymenthybrid 6/8spec lines stated 5.8
21 IntelOwl Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportnot statedReport managementYesWorkflow automationYesCase managementYesDeploymentself-hosted 5/8spec lines stated 5.7
22 Nirad TIP Free plannot statedPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementnot statedWorkflow automationYesCase managementnot statedDeploymenthybrid 4/8spec lines stated 5.7
23 Open Threat Exchange Free planYesPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportnot statedReport managementYesWorkflow automationnot statedCase managementnot statedDeploymentcloud 4/8spec lines stated 5.7
24 Recorded Future Intelligence Cloud Free planNoPaid fromnot statedIndicator enrichmentYesSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementnot statedDeploymentcloud 6/8spec lines stated 5.7
25 Threatnote Free plannot statedPaid fromnot statedIndicator enrichmentnot statedSTIX/TAXII supportYesReport managementYesWorkflow automationYesCase managementnot statedDeploymentnot stated 3/8spec lines stated 5.7

Is your tool on this list?

Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.

Questions about this list

Which threat intelligence platform is ranked first on Specifiction?

OpenAEV is ranked #1 of 31 with a score of 7.4. IBM X-Force Exchange is second and ThreatForge third.

How many of these have a free plan?

3 of the 25 on this page publish a free plan on their own pricing pages.

Which is the cheapest paid option?

On this page, SOCRadar Extended Threat Intelligence Platform has the lowest first paid tier we found: $379.17/mo.

How is this list ranked?

Ranked on what each maker publishes, the fullest spec sheet first: how deeply the product is documented, the platforms it runs on, a free tier or trial to test it, and its standing. Paid placements never change a rank.

More in IT & Infrastructure

All IT & infrastructure lists