ThreatConnect Platform
ThreatConnect Platform brings threat intelligence operations, security operations, and cyber risk management teams together for collaborative cyber defense.
What ThreatConnect Platform is
ThreatConnect Platform brings threat intelligence operations, security operations, and cyber risk management teams together for collaborative cyber defense. It aggregates threat data, analyzes it with the CAL analytics engine, and supports prioritization and response through Playbooks. Case management and Workflow features help manage intelligence work and security operations. The platform incorporates machine learning and AI-powered threat intelligence and cyber risk quantification. Pre-built AI agents can answer questions about data, generate threat models, draft intelligence reports, and guide intelligence requirements. Integrations span SIEM, endpoint and network security, malware analysis, XDR, email security, ITSM, vulnerability management, cloud, identity, and collaboration tools. Deployment options include cloud and on-premises, with orchestration for multi-cloud or hybrid environments. On-premises customers provide hardware and are responsible for physical security. REST APIs and Security Labels are available; labels let users designate sensitive information and control sharing with partners or Communities. Pricing depends on organizational needs and is available on request.
Good
- Aggregates and analyzes threat data.
- Playbooks support prioritization and response.
- Includes case management and Workflow features.
- Supports cloud and on-premises deployment.
- Security Labels control sensitive information sharing.
Watch out
- Pricing is available only on request.
- On-premises customers provide hardware.
- On-premises customers handle physical security.
Who it suits
ThreatConnect suits organizations coordinating threat intelligence, security operations, and cyber risk management. Teams considering on-premises deployment should account for supplying hardware and managing its physical security.
Verdict
ThreatConnect combines threat intelligence analysis, security workflows, and cyber risk capabilities with cloud and on-premises deployment options. Organizations should request pricing and account for the hardware and physical security responsibilities of on-premises use.
Plans and prices
From ThreatConnect Platform's own pricing page, checked 5 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| ThreatConnect Platform | Priced on request | Pricing depends on organizational needs; contact ThreatConnect for pricing |
The facts
Each one read from ThreatConnect Platform's own pages, with the date it was checked.
What it does
- AI agents
- ThreatConnect 8.0 introduced pre-built AI agents for answering questions about data, generating threat models, drafting intelligence reports, and guiding intelligence requirements.checked 5 Oct 2026
- AI and risk
- The platform incorporates ML- and AI-powered threat intelligence and cyber risk quantification to help teams orchestrate and automate processes.checked 5 Oct 2026
- API
- ThreatConnect provides REST APIs, and public-cloud, dedicated-cloud, and on-premises instances expose the API at the instance URL followed by /api.checked 5 Oct 2026
- Customer base
- ThreatConnect states that more than 200 enterprises and thousands of security professionals rely on the platform.checked 5 Oct 2026
- Deployment
- ThreatConnect is available in cloud and on-premises deployments, with multi-environment orchestration for multi-cloud or hybrid environments.checked 5 Oct 2026
- Integrations
- ThreatConnect supports integrations across SIEM, endpoint and network security, malware analysis, XDR, email security, ITSM, vulnerability management, cloud, identity, and collaboration tools.checked 5 Oct 2026
- On-premises responsibility
- For on-premises deployments, the customer supplies the hardware and is responsible for physical security.checked 5 Oct 2026
- Purpose
- ThreatConnect brings threat intelligence operations, security operations, and cyber risk management teams together for collaborative cyber defense.checked 5 Oct 2026
- Security controls
- Security Labels let users designate sensitive information and control what is shared with partners or between Communities.checked 5 Oct 2026
- Support
- ThreatConnect’s Knowledge Base directs users to contact its Support team at [email protected] for help with questions or issues.checked 5 Oct 2026
- Threat intelligence
- The platform aggregates threat data, analyzes it with the CAL analytics engine, and supports prioritization and response using Playbooks.checked 5 Oct 2026
- Workflow and cases
- The platform includes case management and Workflow features for managing threat intelligence and conducting security operations.checked 5 Oct 2026
Alternatives to ThreatConnect Platform
- 1
Sumo Logic
Free planWebAPILinuxmacOS7.6Free plan - 2
OpenSOAR
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 3
Tines
Free planWebAPILinuxSelf-hosted7.2Free plan - 4
Shuffle
Free planWebAPILinuxSelf-hosted6.3Free plan - 5
Tracecat
Free planWebAPISelf-hosted6.3Free plan - 6
5.9