Threat intelligence vendors
We list 80 companies active in threat intelligence, and 21 of them have it as their main focus. 6 are public, 11 are owned by another company and 63 are private. Most are based in the United States (44). The oldest, NETSCOUT, was founded in 1984. By revenue from annual reports, the largest company here is Palo Alto Networks ($11.5bn in FY2026).
By countryUnited States 44
Featured
Featured listings are promoted placements, shown here and labelled.
| Company | Based in | Founded | Size | Ownership | Revenue |
|---|---|---|---|---|---|
FeaturedPCA Cyber Security PCA Cyber Security provides embedded product security services and PCA CERVUS, a device-centric vulnerability monitoring and threat intelligence platform driven from product SBOMs. | Budapest, Hungary | 2019 | 11-50 staff | Private |
Companies focused on threat intelligence
21 companies| Company | Based in | Founded | Size | Ownership | Revenue |
|---|---|---|---|---|---|
Anomali Anomali provides a threat intelligence platform and security analytics, built around its ThreatStream intelligence management product. | United States | 2013 | Private | ||
AtlasCyber Provides agentic threat intelligence and validation for critical infrastructure security teams. | Merrimack, United States | Private | |||
Babel Street Risk intelligence platform that gathers multilingual online data and uses AI agents for threat, identity and vendor risk investigations by government and enterprise. | Reston, United States | Private | |||
Criminal IP Criminal IP provides threat intelligence solutions for uncovering exposed assets and detecting malicious infrastructure. | Torrance, South Korea | 2017 | Private | ||
Cyber Intelligence House Provides dark web intelligence and cyber exposure monitoring to managed security service providers. | Singapore, Singapore | 2015 | Private | ||
Cyble Cyble provides AI-native threat intelligence and cybersecurity platforms for enterprises and governments. | Cupertino, United States | 2020 | Private | ||
Cyware Cyware provides a platform for threat intelligence management, security orchestration, and collective defense. | Jersey City, United States | Private | |||
DomainTools DomainTools provides DNS-focused threat intelligence and domain security data to detect and mitigate malicious domains. | Seattle, United States | Private | |||
EclecticIQ EclecticIQ provides a threat intelligence platform aimed at government and large enterprise analysts, with an emphasis on analyst-led workflows. | Netherlands | Private | |||
GreyNoise Intelligence GreyNoise Intelligence provides real-time network threat intelligence. | Washington, D.C., United States | 2017 | Private | ||
Group-IB Group-IB provides cybersecurity products and services to prevent digital crime. | Singapore, Singapore | 2003 | Private | ||
Intel 471 Intel 471 provides cyber threat intelligence focused on adversary tracking, malware intelligence and underground marketplace coverage. | United States | Owned by Thoma Bravo | |||
Protos AI Protos AI provides managed adversary risk intelligence by collecting and analysing threat signals for organisations. | Singapore, Singapore | Owned by Protos Labs | |||
Silobreaker Silobreaker provides a software platform that gathers and analyses security and risk intelligence for organisations. | London, United Kingdom | 2005 | Private | ||
Team Cymru Team Cymru provides global threat intelligence from internet traffic for proactive defence. | Lake Mary, United States | Private | |||
TRM Labs TRM Labs provides blockchain intelligence and AI tools to help investigate and disrupt criminal networks. | San Francisco, United States | 2018 | Private | ||
VirusTotal VirusTotal is a cybersecurity company that provides a free online service to analyse files and URLs for malicious content. | Málaga, Spain | 2004 | Owned by Google Cloud Platform | ||
VulnCheck VulnCheck sells a cyber threat intelligence platform built around exploit and vulnerability data. | Lexington, United States | 2021 | Private | ||
J Joe Security Joe Security provides automated and analyst-driven malware and phishing analysis through its Joe Sandbox platform. | Switzerland | Private | |||
KELA KELA provides cyber threat intelligence and external threat exposure management from underground sources. | Tel Aviv, Israel | Private | |||
Recorded Future Recorded Future provides a threat intelligence platform that indexes open, dark and technical sources. Acquired by Mastercard for $2.65bn. | United States | 2008 | Owned by Mastercard |
Also active in threat intelligence
58 companies| Company | Based in | Founded | Size | Ownership | Revenue |
|---|---|---|---|---|---|
Palo Alto Networks Palo Alto Networks provides cybersecurity platforms and services to protect organizations from cyber threats. | Santa Clara, United States | 2005 | 13,900 staff | Public, PANW | $11.5bn (FY2026) |
CrowdStrike CrowdStrike provides AI-native cybersecurity solutions to stop breaches. | Austin, United States | 2011 | 7,925 staff | Public, CRWD | $4.8bn (FY2026) |
Zscaler Zscaler provides a cloud-native zero trust cybersecurity platform that securely connects users, devices, and applications. | San Jose, United States | 2007 | Public, ZS | $3.4bn (FY2026) | |
Check Point Check Point Software provides cyber security solutions including network, cloud, and AI security. | Tel Aviv, Israel | 1993 | Public, CHKP | $2.7bn (FY2025) | |
NETSCOUT NETSCOUT provides real-time network visibility, observability, cybersecurity, and DDoS protection solutions. | Westford, United States | 1984 | Public, NTCT | $859.5m (FY2026) | |
K Kaspersky Kaspersky develops antivirus and internet security software for home users and businesses. | Moscow, Russia | 1997 | 3,600 staff | Private | |
Argos Security GmbH Argos Security GmbH is a German cyber defence provider with an AI-supported centre in Munich. | Munich, Germany | 1999 | 100 staff | Owned by Sophora Unternehmerkapital | |
Securin Vulnerability intelligence-driven penetration testing firm providing contextual security assessments informed by threat actor exploitation data and ransomware tracking. | Albuquerque, United States | 2009 | 51-200 staff | Private | |
360 Privacy Removes personal data from data brokers and monitors the deep and dark web for clients. | Nashville, United States | 2019 | Private | ||
Arctic Wolf Arctic Wolf provides managed security operations, threat detection and incident response services to organisations. | Eden Prairie, United States | 2012 | Private | ||
Arsen Security Arsen provides a platform for cybersecurity awareness and social engineering simulation. | Paris, France | 2021 | Private | ||
asvin Software and services for cyber risk analysis, secure software updates and UNECE R155 and R156 compliance. | Stuttgart, Germany | 2018 | Private | ||
Bitsight Bitsight provides a cyber risk intelligence platform. | Back Bay, United States | 2011 | Private | ||
Black Kite Black Kite provides an AI-native third-party cyber risk management platform for monitoring and assessing vendor risks. | Boston, United States | 2016 | Private | ||
Censys Censys maps internet infrastructure and provides intelligence for security operations and exposure management. | Ann Arbor, United States | 2017 | Private | ||
Conifers.ai Conifers provides an agentic AI platform for security operations centres to investigate and respond to threats. | Dallas, United States | 2024 | Private | ||
Corelight Corelight provides network detection and response solutions for cybersecurity teams. | San Francisco, United States | 2013 | Private | ||
Corero Network Security Corero Network Security provides automatic DDoS protection for businesses and service providers. | London, United Kingdom | Public, CNS | |||
CVETodo CVETodo prioritises software vulnerabilities using exploitability, exposure and threat intelligence for security teams. | Tauranga, New Zealand | Private | |||
CybelAngel CybelAngel provides external threat intelligence and attack surface management services to protect enterprise data and assets. | Clichy, France | 2013 | Private | ||
Decurity Decurity is a web3 security firm based in Dubai. | Dubai, United Arab Emirates | 2022 | Private | ||
Fivecast Open source intelligence software that collects and analyses online data to detect threats and hidden networks for national security, law enforcement and financial crime teams. | Adelaide, Australia | Private | |||
GoGoByte Beijing firm selling TARA and test software, vehicle test hardware, penetration testing and R155 compliance advice. | Beijing, China | Private | |||
Guardsi Cybersecurity Guardsi Cybersecurity is a Brazilian firm that has specialised in penetration testing and offensive security since 2015. | Uberlândia, Brazil | 2015 | Private | ||
Guardsquare Guardsquare provides mobile app security through code hardening, testing, and threat monitoring. | Leuven, Belgium | 2014 | Private | ||
Infoblox Infoblox provides networking and security software for DNS, DHCP and IP address management. | Santa Clara, United States | Private | |||
Intelligence X Intelligence X operates a search engine and data archive for open source intelligence. | Prague, Czech Republic | 2018 | Private | ||
Lumu Lumu provides network detection and response to identify and stop cyber threats in real time. | Doral, United States | Private | |||
Netcraft Netcraft detects, disrupts and takes down phishing, fraud and other cybercrime threats for brands. | London, United Kingdom | Private | |||
NordLayer Provides a network security platform for businesses to secure connections and stay compliant. | New York, United States | Private | |||
Nucleus Security Nucleus Security provides a platform to automate vulnerability and exposure management for enterprises and government agencies. | Sarasota, United States | 2019 | Private | ||
Opportify Opportify provides risk intelligence and fraud prevention tools. | Claymont, United States | 2024 | Private | ||
OSINT Industries OSINT Industries provides open-source intelligence tools for online investigations. | London, United Kingdom | Private | |||
Quantara AI Quantara AI provides an AI-native platform for cyber risk quantification and prioritization. | Eagle, United States | Private | |||
ReliaQuest ReliaQuest provides an AI security operations platform for enterprises to detect and respond to threats. | Tampa, United States | Private | |||
Report URI Report URI is a client-side security platform that monitors and controls what runs in users' browsers. | Clitheroe, United Kingdom | 2017 | Private | ||
ReversingLabs ReversingLabs provides software supply chain security and threat intelligence to verify and secure enterprise software. | Cambridge, United States | Private | |||
RiskRecon by Mastercard RiskRecon provides cybersecurity ratings and assessments to help organisations manage third-party and supply chain risk. | Murray, United States | Private | |||
Securonix Securonix provides a cloud-native platform for security operations, combining SIEM, UEBA, SOAR and threat intelligence. | San Mateo, United States | 2008 | Private | ||
Sekoia Sekoia provides an AI-driven security operations platform for detecting, investigating and responding to cyber threats. | Rennes, France | 2022 | Private | ||
Social Links OSINT and social media investigation software, including SL Crimewall, an API and a Maltego integration, used by law enforcement and corporate security teams. | New York, United States | Private | |||
Splunk Splunk provides a data platform for security, observability, and AI. | San Jose, United States | 2004 | Owned by Cisco | ||
SpyCloud SpyCloud is a cybersecurity company that specialises in identity threat protection. | Austin, United States | 2016 | Private | ||
Y Yarix Italian Var Group security firm that absorbed Munich automotive consultancy CYRES and offers a vehicle SOC service. | Treviso, Italy | Owned by Var Group | |||
ARPSyndicate Builds internet-scale intelligence datasets and security products for vulnerability, subdomain, and physical reconnaissance. | New Delhi, India | Private | |||
Check Point Exposure Management (formerly Cyberint) Provides a platform for managing external and internal cyber risk exposure. | Tel Aviv, Israel | Private | |||
Doppel Doppel provides an AI-powered platform for social engineering defense and digital risk protection. | San Francisco, United States | 2022 | Private | ||
E-C.O.P (Thailand) Limited Provides managed security services and security operations centre services in Thailand. | Thailand | 2007 | Private | ||
HACK KAP HACK KAP provides manual penetration testing, dark-web intelligence, and hacking labs for businesses worldwide. | Colombo, Sri Lanka | 2022 | Private | ||
Kyndryl Managed security operations, threat intelligence and incident response services delivered from global security operations centres by an IT infrastructure services provider. | New York, United States | Private | |||
Maltego Maltego provides a platform for open source intelligence and cyber investigations. | Germany | 2017 | Owned by Charlesbank Capital Partners | ||
M Mandiant Mandiant provides threat intelligence and incident response, now sold as Google Threat Intelligence alongside VirusTotal within Google Cloud. | United States | 2004 | Part of Google | ||
P Primary Target Browser-based tool that automates threat analysis and risk assessment, mainly for vehicle makers and their suppliers. | Ismaning, Germany | Private | |||
Proofpoint Proofpoint provides cybersecurity solutions to protect people, data, and AI across email, cloud, and collaboration tools. | Sunnyvale, United States | 2002 | Owned by Thoma Bravo | ||
securagen.ai Builds cryptographic validation, information intelligence, regulatory assurance and sovereign AI products for defence and government. | Athens, Greece | 2025 | Private | ||
ShadowDragon ShadowDragon provides an OSINT software platform for investigators to collect and analyse public data. | Hoover, United States | 2016 | Private | ||
Upstream Security Upstream Security provides a cybersecurity and intelligence platform for physical AI, vehicles, and smart mobility. | Birmingham, United States | 2017 | Private | ||
ZeroFox ZeroFox provides external cybersecurity services to discover, validate, and disrupt digital threats. | Baltimore, United States | 2013 | Owned by Haveli |
Recent deals in threat intelligence
All threat intelligence dealsAcquisitions come from SecurityWeek's monthly M&A round-ups from 2021 onwards, from Cybersecurity Ventures' quarterly M&A reports for 2020, and a few from Wikipedia lists. These are dated to the month. A few deals added from the news are dated to the day. Smaller deals may be missing. Amounts are in US dollars.