17.9
Correlates threat indicators and lets teams control sharing by group or individual attribute.
Free planOpen sourceWebAPILinux
Best Threat Intelligence Platforms in 2026
MISP leads this chart of 32 (7.9/10, free plan). Pulse Intelligence is next (6.8/10, free plan), and Google Cloud Secret Manager is the next highest-placed with a free plan (6.5/10). Threat intelligence platforms gather and structure threat indicators. The right fit depends on where you can deploy one and which workflow tools your team needs. Look at how each option enriches indicators, exchanges STIX/TAXII data, manages reports and cases, automates tasks, and can be deployed. If phone access is important, verify Android support; listed platforms include web, API, self-hosted, Linux, Windows,…
26.8
Pulse Intelligence is a free, open-source threat intelligence workspace that organizations host themselves.
Free planWebAPILinux
36.5
Free planWeb
- 4
Kaspersky Threat Intelligence Portal
Web portal for IOC enrichment, malware analysis, threat tracking, and incident response.
Free planWebAPI6.5Free plan - 5
SOCRadar Extended Threat Intelligence Platform
SOCRadar Extended Threat Intelligence Platform (XTI) combines threat intelligence with external attack surface management, brand protection, and dark web monitoring.
WebAPI6.5From $4,550 a year - 6
IBM X-Force Exchange
Research threats, organize intelligence in collections, and share findings with peers.
Free planWebAPI6.3Free plan - 7
Shodan Monitor
Continuously scans monitored IP ranges, domains, or queries and sends real-time alerts.
WebAPILinux6.3From $69 a month - 8
Security Vision TIP
Analyzes and enriches threat data, with connectors for SIEM, firewall, proxy, and email events.
WebAPILinuxSelf-hosted6.2 - 9
IntelOwl
Enrich files and observables from multiple sources through an API and web interface.
Free planWebAPILinuxSelf-hosted6.1Free plan - 10
ThreatForge
Enriches indicators, scores risk, and supports brand-abuse monitoring and investigations.
Free planWebAPISelf-hosted6.1Free plan - 11
Threat Intelligence Platform
Threat Intelligence Platform combines threat intelligence feeds with in-house databases to analyze threat hosts and attack infrastructure in real time.
Free planWebAPI5.9Free plan - 12
Flashpoint Ignite
Searches large collections of threat data and provides alerts, reports, and visual analysis.
WebAPI5.8 - 13
Cyble Vision
Cyble Vision is a cloud threat intelligence platform for monitoring cyber, brand, third-party, and physical security risks.
WebAPI5.7 - 14
DAS-Security ATIP
Covers indicators, vulnerabilities, threat groups, and their TTP attack matrices.
WebAPISelf-hosted5.7 - 15
OODA Intelligence
WebAPI5.7 - 16
Nirad TIP
Nirad TIP is a threat intelligence platform focused on threat actors targeting India.
WebAPISelf-hosted5.6 - 17
Threatnote
Web service for intelligence requirements, threat hunting, exposure tracking, and brand impersonation alerts.
Web5.6 - 18
Anomali Platform
Combines security telemetry with threat intelligence, asset context, and incident history.
WebAPI5.5 - 19
DomainTools Monitors
Tracks IP, domain, and registrant changes and sends alerts through email and a dashboard.
WebAPI5.4 - 20
EclecticIQ Platform
Supports the threat intelligence lifecycle and normalizes data into STIX 2.1 and EIQ-JSON.
WebAPIExtensionSelf-hosted5.4 - 21
Recorded Future Intelligence Cloud
Connects internal telemetry with external sources to identify and prioritize threats.
WebAPIExtension5.4 - 22
ThreatQ
WebAPILinuxSelf-hosted5.4 - 23
Yeti
Manages forensic artifacts, rules, queries, and threat context for DFIR workflows.
WebAPISelf-hosted5.4 - 245.3
- 25
SİBERAT
SİBERAT AX is a self-hosted security operations platform for IT and operational technology.
Self-hosted5.3
Choosing well
What environments should it support?
Match the platform to your team's setup: options listed here include web, API, self-hosted, Linux, Windows, and browser extensions.
If phone use matters, verify Android availability with the maker rather than inferring it from web or API access.
Can I start with a free plan or trial?
Check the pricing model before setup. A free plan can support an initial evaluation, while a free trial gives time-limited access to a paid service.
Read the provider's pricing note to distinguish a free plan, a trial and pricing supplied on request.
How does it enrich and share indicators?
Compare indicator enrichment and STIX/TAXII support to the formats and context your team needs.
These capabilities affect how threat data is expanded, exchanged and connected to other systems.
Does it handle reports, cases and workflows?
Consider how the platform records and responds to findings, including report tools, case handling, and workflow automation.
Review these functions together so reports can move into assigned cases and repeatable actions.
What deployment model fits the team?
Select web, API, self-hosted or another listed deployment based on where your data and integrations must run.
Self-hosted options can suit teams that need local operation, while web and API access support hosted or connected workflows.
Questions people ask
Do threat intelligence platforms have Android apps?
Check the maker's platform details for Android support. A web or API listing does not confirm an Android app.
Which threat intelligence platform has a free plan?
MISP, Pulse Intelligence, Kaspersky Threat Intelligence Portal, and IBM X-Force Exchange are among the listings marked as having a free plan.
What is STIX/TAXII support used for?
STIX/TAXII support helps exchange threat intelligence in established formats between compatible tools and services.
Can I run a threat intelligence platform on my own infrastructure?
Self-hosted deployment appears among the options in this category; consult each entry to see which deployment choices it lists.
What should I compare besides price?
Assess indicator enrichment, STIX/TAXII support, report and case management, workflow automation, and deployment options.