MISP
7.9#1 in threat intelligence platformsFrom €7.31 a yearFree planWebAPILinuxSelf-hosted
VisitMISP vs ThreatForge
ThreatForge
6.1#10 in threat intelligence platformsFree planFree planWebAPISelf-hosted
VisitWhat both publish
| Fact | MISP | ThreatForge |
|---|---|---|
| Deployment | MISP can run on-premises, in the cloud or as a SaaS deployment. | The README documents Docker Compose deployment, a web UI served by the API and interactive API documentation. |
| Intended users | The project says MISP is designed for incident analysts, security and ICT professionals, and malware reversers. | It is described as helping security analysts, SOC teams, fraud teams and researchers organize indicators, enrich observables, monitor brand abuse and prioritize risk. |
| Purpose | MISP is an open source platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat information for incident and malware analysis. | ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation. |
| Security | MISP supports signing and encrypting notifications with GnuPG or S/MIME, and signing and validating shared information. | The web UI uses JWT sessions in httpOnly and SameSite=Strict cookies, Argon2id password handling when available, and web security headers and login rate limiting. |
MISP plans
- MISP softwareFree
- MISP coreFree
- Yearly support contract€7.31 a year
- Sustainability support€10.97 a year
- Support contract with sustainability support€18.28 a year
- On-site closed training—
ThreatForge plans
- Community EditionFree
- Enterprise EditionPriced on request
Pick MISP if…
MISP is suited to incident analysts, security and ICT professionals, and malware reversers who need to manage and exchange threat information. Its API, streaming channels, and sharing controls may also fit teams automating intelligence workflows.
Pick ThreatForge if…
ThreatForge is intended for security analysts, SOC and fraud teams, and researchers who need to organize indicators, enrich observables, monitor brand abuse, or prioritize risk.