Best Threat Intelligence Platforms for Cloud - Page 8
View:
Compare the Top Threat Intelligence Platforms for Cloud as of May 2026 - Page 8
Sort By:
-
1
Reveelium
ITrust.fr
3 out of 4 companies are subject to computer attacks or hacking. However, 90% are equipped with essential security equipment that does not detect these malicious attacks. APTs, malicious behaviors, viruses, crypto lockers, override existing security defenses and no current tool can detect these attacks. Yet these attacks leave footprints of their passage. Finding these malicious traces on a large amount of data and exploiting these signals is impossible with current tools. Reveelium correlates and aggregates all types of logs from an information system and detects attacks or malicious activity in progress. An essential tool in the fight against cyber-malware Reveelium SIEM can be used alone or complemented by Ikare, Reveelium UEBA or ITrust’s Acsia EDR, to provide a true next-generation security center (SOC). Have the practices of its teams monitored by a third party and obtain an objective opinion on its level of safety. -
2
CloudSEK
CloudSEK
The leading AI-powered Digital Risk Monitoring platform that detects 3rd party data leaks instantly. XVigil first gathers millions of data units from online sources. This raw data is filtered for noise, false positives, and anomalies, using a powerful AI engine. After which it is indexed, parsed, checked against the historical data lake, and mapped to clients’ assets. Duplicates and familiar threats are discarded, and the remaining relevant threats are rated based on severity, and sent to customers as alerts. Monitors your internet exposed infrastructure, curates a list of all asset-inventory and then periodically monitors misconfigurations, and potential data leakages. XVigil spans the internet to actively detect external threats as regards your organization, classify them based on their severity, and provide real-time alerts. Backed by 5 years of extensive research and development, CloudSEK’s ‘XVigil’ is a SaaS-based easy-to-use platform. -
3
Group-IB Unified Risk Platform
Group-IB
The Unified Risk Platform strengthens security by identifying the risks your organization faces. The platform automatically configures your Group-IB defenses with the precise insights required to stop attacks by threat actors, thereby making it less likely that an attack will be successful. Group-IB's platform monitors threat actors at all times in order to detect advanced attacks and techniques. The Unified Risk Platform quickly and accurately identifies early warning signs before attacks develop, fraud occurs or your brand is damaged, which reduces the risk of undesirable consequences. The Unified Risk Platform counters threat actors with insight into their modus operandi. The platform leverages a variety of solutions and techniques to stop attacks that target your infrastructure, endpoints, brand and customers, reducing the risk that an attack will cause disruption or recur. -
4
Deep Instinct
Deep Instinct
Deep Instinct is the first and only company to apply end-to-end deep learning to cybersecurity. Unlike detection and response-based solutions, which wait for the attack before reacting, Deep Instinct’s solution works preemptively. By taking a preventative approach, files and vectors are automatically analyzed prior to execution, keeping customers protected in zero time. This is critical in a threat landscape, where real time is too late. With the aim of eradicating cyber threats from the enterprise, Deep Instinct protects against the most evasive known and unknown cyberattacks with unmatched accuracy, achieving highest detection rates and minimal false positives in tests regularly performed by third parties. Providing protection across endpoints, networks, servers, and mobile devices, the lightweight solution can be applied to most OSs and protects against both file-based and fileless attacks. -
5
Cortex XSOAR
Palo Alto Networks
Orchestrate. Automate. Innovate. The industry’s most comprehensive security orchestration, automation and response platform with native threat intelligence management and a built-in marketplace. Transform your security operations with scalable, automated processes for any security use case. Get up to a 95% reduction in the volume of alerts requiring human review. Cortex XSOAR ingests alerts across sources and executes automated workflows/playbooks to speed up incident response. Cortex XSOAR case management facilitates standardized response for high-quantity attacks while helping your teams adapt to sophisticated one-off attacks. Cortex XSOAR playbooks are complemented by real-time collaboration capabilities that let security teams rapidly iterate to solve emergent threats. Cortex XSOAR offers a new approach to threat intelligence management that unifies threat intelligence aggregation, scoring and sharing with proven playbook-driven automation. -
6
Sequretek Percept XDR
Sequretek
Cloud-based enterprise security platform offering automated threat detection and response using AI and big data across cloud and on-premise enterprise environments. Percept XDR ensures end-to-end security, threat detection and response while allowing enterprises to focus on their core business growth without the fear of compromise. Percept XDR helps to protect against phishing, ransomware, malware, vulnerability exploits, insider threats, web attacks and many more advanced attacks. Percept XDR has an ability to ingest data from various sources, uses AI and Big Data to detect threats. Its ability to ingest sensor telemetry, logs, and global threat intelligence feeds allows the AI detection engine to identify new use cases and anomalies, thereby detecting new and unknown threats. Percept XDR features SOAR-based automated response in line with the MITRE ATT&CK® framework. -
7
Cyware
Cyware
Cyware is the only company building Virtual Cyber Fusion Centers enabling end-to-end threat intelligence automation, sharing, and unprecedented threat response for organizations globally. Cyware offers a full-stack of innovative cyber fusion solutions for all-source strategic, tactical, technical and operational threat intelligence sharing & threat response automation. Cyware’s Enterprise Solutions are designed to promote secure collaboration, inculcate cyber resilience, enhance threat visibility and deliver needed control by providing organizations with automated context-rich analysis of threats for proactive response without losing the element of human judgment. Cyware solutions are pushing the boundaries of current security paradigms by utilizing advances in Machine Learning, Artificial Intelligence, Security Automation & Orchestration technologies to empower enterprises in adapting to the evolving threat landscape. -
8
CINS
CINSarmy
As our base of Sentinel IPS units has grown, we’ve come to realize the attack data we gather has significant value, both to our own customers and to the community at large. Collective Intelligence Network Security (CINS, pronounced “sins,” get it?) is our effort to use this information to significantly improve the security of our customers’ networks. We also provide this vital information to the InfoSec community free of charge. Our CINS system is constantly gathering attack data from each of our Sentinel units in the field. Using this data, we calculate a CINS Score for every IP address flagged by our system. Much like a FICO score, which shows you the quality of your credit, the CINS Score is designed to show you the quality – the trustworthiness – of an IP address. The IP address’ whois information, country of origin, the nature, frequency and breadth of its attacks across the Sentinel network are listed with the CINS Score. -
9
Cyjax
Cyjax
Our proprietary technologies are complemented by world-class analysts to process and contextualize thousands of sources. This analysis can be visualized via our platform, dashboards, and metrics. Our unique widget and dashboard tooling enable users to visualize and query data from thousands of threat feeds in one place. We cover all forms of mainstream social media, as well as instant messaging platforms and forums. Our operations team provides up-to-date intelligence on activity that could impact your organization. The SOCMINT team can be tasked with tracking and collating activity related to a specific topic of interest. The Cyjax Platform can work with almost any API endpoint architecture. Our platform supports JSON, STIX/TAXII and CEF formats out-the-box as well as a host of native integrations. A complete developer guide and control framework enables ad hoc integrations between platforms. -
10
CYR3CON PR1ORITY
CYR3CON
CYR3CON PR1ORITY approaches cybersecurity from the hacker’s world view, identifying real threats to client assets based on attacker behaviors. Rather than providing broad and non-specific risk management information, PR1ORITY intelligently sources the necessary data that, when analyzed, predicts the likelihood of an actual attack. With multiple options for integration, PR1ORITY gives clients the information they need to proactively manage threats. CYR3CON PR1ORITY predicts which vulnerabilities hackers will exploit through the use of artificial intelligence and real threat intelligence mined from hacker communities. CYR3CON PR1ORITY provides Contextual Prediction™ - the text of the hacker conversations that feed the vulnerability prioritization assessment. CYR3CON PR1ORITY is fueled by hacker community information. Allows defenders to focus on where the threat is going. -
11
CYR3CON FUS1ON
CYR3CON
FUS1ON considers multiple organizations (i.e. business units, franchises, MSSP clients, or cyber insurance clients) to identify common threats. FUS1ON identifies "root threats" that can affect multiple organizations within (or supported by) the enterprise. FUS1ON leads to an understanding of aggregation risk through patented technology by considering the root threats that affect multiple tenants. Ranking for each individual vulnerability by assigning a probability or relative likelihood. CYR3CON FUS1ON is fueled by hacker community information. Allows for alignment of many popular passive scanning tools. Allows for alignment of vulnerability scanning results from any scanner with CYR3CON FUS1ON results. Easy management of aggregation across multiple tenant organizations. Simple summary report outlines systemic threats. -
12
REDXRAY
Red Sky Alliance
You have spent years building your business, so don’t let cyber criminals destroy it in seconds. Using our proprietary intelligence feeds, REDXRAY can identify threats against your networks, supply chain, or target companies/agencies daily. The emailed report covers the following threat types: Botnet Tracker, Breach Data, Keylogger Records, Malicious Emails Context, Malicious Email Detections, OSINT Records, Sinkhole Traffic, and THREATRECON Records. -
13
Cisco Talos
Cisco
Meet Cisco Talos, the industry-leading threat intelligence group fighting the good fight. Cisco Talos is one of the largest commercial threat intelligence teams in the world, comprised of world-class researchers, analysts, and engineers. Industry-leading visibility, actionable intelligence, and vulnerability research drive rapid detection and protection for Cisco customers against known and emerging threats--and stop threats in the wild to protect the Internet at large. Cisco Talos is one of the largest and most trusted providers of cutting-edge security research globally. We provide the data Cisco Security products and services use to take action. The key differentiator of Talos is our process — seeing what is happening broadly across the threat landscape, acting on that data rapidly and meaningfully, and driving protection. Integral to that process is that Talos has more visibility than any other security vendor in the world and unique capabilities and scale in intelligence. -
14
Darkfeed
Cybersixgill
Unleash cyber security performance, supercharge your security stack and maximize analysts’ performance with the ultimate underground threat intelligence collection available. Darkfeed is a feed of malicious indicators of compromise, including domains, URLs, hashes, and IP addresses. It relies on Cybersixgill’s vast collection of deep and dark web sources and provides unique and advanced warnings about new cyberthreats. It is automated, meaning that IOCs are extracted and delivered in real-time, and it is actionable, meaning that its consumers will be able to receive and block items that threaten their organizations. Darkfeed also offers the most comprehensive IOC enrichment solution on the market. By enriching IOCs from SIEM, SOAR, TIP or VM platforms, users gain unparalleled context and essential explanations in order to accelerate their incident prevention and response and stay ahead of the threat curve. -
15
Secure Malware Analytics (formerly Threat Grid) combines advanced sandboxing with threat intelligence into one unified solution to protect organizations from malware. With a robust, context-rich malware knowledge base, you will understand what malware is doing, or attempting to do, how large a threat it poses, and how to defend against it. Secure Malware Analytics rapidly analyzes files and suspicious behavior across your environment. Your security teams get context-rich malware analytics and threat intelligence, so they’re armed with insight into what a file is doing and can quickly respond to threats. Secure Malware Analytics analyzes the behavior of a file against millions of samples and billions of malware artifacts. Secure Malware Analytics identifies key behavioral indicators of malware and their associated campaigns. Take advantage of Secure Malware Analytics's robust search capabilities, correlations, and detailed static and dynamic analyses.
-
16
Cobwebs Web Intelligence
Cobwebs Technologies
Our powerful web intelligence solution monitors online activity, collecting and analyzing data of endless digital channels – from the open, deep and dark web, to mobile and social. Our exclusive deep and dark web monitoring technology extracts targeted intelligence from the web’s big data using the latest machine learning algorithms, automatically generating critical insights. The increasing use of social media, mobile apps, and dark web has led to significant growth of illegal activities on the internet. These platforms are used by criminals, terrorists, and hackers and to conduct operations with minimal visibility. Enterprises as well as government agencies deal with manual web investigations on a day to day basis facing the various challenges to do with exposing their digital footprint. Web Intelligence has become a crucial part of Intelligence methodologies and security management. -
17
Chimpa
Chimpa
It takes just a few minutes to activate Chimpa and its ease of use makes it suitable even for inexperienced users. Chimpa supports iOS, iPadOS, tvOS and Android operating systems. The MDM is generally a distribution of a combination of applications and configurations on the device, company policies and certificates and back-end infrastructure, in order to simplify and improve the IT management of end-user devices. In modern corporate IT environments, the number and variety of managed devices (and user behavior) is the basis of MDM solutions that allow the management of devices and users in a coherent and scalable way. The general role of MDM is to increase the user-friendliness, security and functionality, while maintaining a certain flexibility for the user. Kiosk mode, security functions, blocking, remote initialization. Collection of analytical data on the use of the App and the network. -
18
Stairwell
Stairwell
Adversaries are successful because of how well they know your defenses. All the security tools you can buy are a part of their testing arsenal. But with Inception, your security teams create out-of-band defenses that can’t be used against you. Traditional approaches focus on applying outside insights into your environment. Most security teams are fast-following, checking lists of “bad things” in a type of retroactive whack-a-mole. Inception gives you visibility from the inside out instead. You understand what’s going on within your environment in relation to the outside world. Instead of triaging irrelevant noisy alerts, use Inception to focus on things that matter, whether they are anomalous, outright nefarious, or something in between. Inception seeks and scrutinizes novel signals in your environment and alerts you to problems that no one else has found. You can anticipate what’s to come, and stop it before it strikes. -
19
ThreatStryker
Deepfence
Runtime attack analysis, threat assessment, and targeted protection for your infrastructure and applications. Stay ahead of attackers and neutralize zero-day attacks. Observe attack behavior. ThreatStryker observes, correlates, learns and acts to protect your applications and keep you one step ahead of attackers. Deepfence ThreatStryker discovers all running containers, processes, and online hosts, and presents a live and interactive color-coded view of the topology. It audits containers and hosts to detect vulnerable components and interrogates configuration to identify file system, process, and network-related misconfigurations. ThreatStryker assesses compliance using industry and community standard benchmarks. ThreatStryker performs deep inspection of network traffic, system, and application behavior, and accumulates suspicious events over time. Events are classified and correlated against known vulnerabilities and suspicious patterns of behavior. -
20
DarkOwl
DarkOwl
We are the industry’s leading provider of darknet data, offering the largest commercially available database of darknet content in the world. DarkOwl offers a suite of data products designed to meet the needs of business looking to quantify risk and understand their threat attack surface by leveraging darknet intelligence. DarkOwl Vision UI and API products make our data easy to access in your browser, native environment or customer-facing platform. Darknet data is a proven driver of business success for use cases spanning beyond threat intelligence and investigations. DarkOwl API products allow cyber insurance underwriters and third party risk assessors to utilize discrete data points from the darknet and incorporate them into scalable business models that accelerate revenue growth. -
21
DarkSentry
SentryBay
SentryBay can provide you with a range of services designed to provide real time threat intelligence and alerts to keep you ahead of cybersecurity risks. DarkSentry aggregates public, deep and dark web data across specific geographical locations to deliver localised, sector-targeted or individual enterprise-targeted information enabling vital cybersecurity decisions to be made. This includes the ability to point scanners to specific relevant data sources and filter results and combine credential and data scanning with SentryBay endpoint software to reinforce the use of remote access, corporate and SaaS applications. The DarkSentry service helps you to meet multiple compliance requirements including NIST, GDPR and PCI. -
22
WinMagic SecureDoc
WinMagic
SecureDoc is an encryption and security management solution designed to safeguard data at rest (DAR). The software has two components: client software for encrypting and decrypting data and server software for configuration and management across the organization's laptops, desktops, servers and external devices. Using a FIPS 140-2 validated AES 256-bit cryptographic engine, SecureDoc ensures compliance with industry regulations and data integrity. With features like pre-boot authentication and central management, the software seamlessly protects sensitive information on various platforms (Windows, macOS and Linux). -
23
Logically Intelligence
Logically
Logically Intelligence uses artificial intelligence to identify and tackle harmful and manipulative content at speed and at scale. Our platform ingests content and data from social platforms, online media source and websites. As a result, Logically Intelligence provides analysts with the insights needed to detect, assess, and act on emerging threats. Monitor and analyze a specific information environment by creating a Situation Room using a simple keyword-based interface or advanced boolean queries. Identify and analyze narratives emerging in a specific Situation Room, including keywords driving the narrative, associated posts, and original poster data. Also, you can compare two narratives over time and measure the impact of counter-narratives. Boolean queries or keywords can be added in any language and the platform will display and translate data from all languages. -
24
CleanINTERNET
Centripetal
While traditional cybersecurity solutions remediate threats as they emerge, CleanINTERNET® shields against threats proactively, preventing them from reaching your network in the first place. The largest collection of high-confidence, high-fidelity commercial threat intelligence in the world, is operationalized so your defenses adapt and defend in parallel with the threat landscape. Applying over 100 billion indicators of compromise from real-time intelligence feeds, updated every 15 minutes, to protect your network. The fastest packet filtering technology on the planet is integrated at your network’s edge with no latency, enabling the use of billions of threat indicators so malicious threats are dynamically blocked from entering your network. Highly skilled analysts augmented by AI technology monitor your network, providing automated shielding based on real-time intelligence, and validated by human expertise. -
25
ThreatBook
ThreatBook
ThreatBook CTI provides high-fidelity intelligence collected from alerts from real customer cases. Our R&D team uses it as a critical indicator to evaluate our intelligence extraction and quality control work. Meanwhile, we continuously assess the data based on any relevant alerts from timely cyber incidents. ThreatBook CTI aggregates data and information with a clear verdict, behavior conclusions, and intruder portraits. It enables the SOC team to spend less time on irrelevant or harmless activities,boosting the operation's efficiency. The core value of threat intelligence is detection and response, that is, enterprises can carry out compromise detection with high-fidelity intelligence, figuring out if a device has been attacked or if a server has been infected and respond based on the investigation to prevent threats, isolate or avoid risks in a timely manner and reduce the likelihood of serious consequences. -
26
Cogility Cogynt
Cogility Software
Deliver Continuous Intelligence solutions easier, faster, and cost-effectively - with less engineering effort. The Cogility Cogynt platform delivers cloud-scalable event stream processing software powered by advanced, Expert AI-based analytics. A complete, integrated toolset enables organizations to quickly, easily, and more efficiently deliver continuous intelligence solutions. The end-to-end platform streamlines deployment, constructing model logic, customizing data source intake, processing data streams, examining, visualizing and sharing intelligence findings, auditing and improving results, and integrating with other applications. Cogynt’s Authoring Tool provides a convenient, zero-code design environment for creating, updating, and deploying data models. Cogynt’s Data Management Tool makes it easy to publish your model to immediately apply to stream data processing while abstracting Flink job coding. -
27
Cavalier
Hudson Rock
Cavalier is based on forensic technologies and operational know-how developed at the IDF’s 8200 Unit to counter nation-state adversaries and professional threat actors. It is a unique cybercrime intelligence data source composed of millions of machines compromised in global malware-spreading campaigns. Our high-fidelity data is sourced directly from threat actors and augmented monthly with hundreds of thousands of new compromised machines. Cavalier’s high-fidelity data protects employees, partners, customers, and digital assets with an unprecedented granularity of threat vectors including ransomware, business espionage, breaches & network overtakes. Allows hackers to use existing victims' sessions by importing their cookies and bypassing security measurements. URL accessed by the victim, their login credentials, and plaintext passwords, are used by hackers to hack into employee and user accounts. -
28
Google Threat Intelligence
Google
Get comprehensive visibility and context on the threats that matter most to your organization. Google Threat Intelligence provides unmatched visibility into threats enabling us to deliver detailed and timely threat intelligence to security teams around the world. By defending billions of users, seeing millions of phishing attacks, and spending hundreds of thousands of hours investigating incidents we have the visibility to see across the threat landscape to keep the most important organizations protected, yours. Focus on the most relevant threats to your organization by understanding the threat actors and their ever changing tactics, techniques, and procedures (TTPs). Leverage these insights to proactively set your defenses, hunt efficiently, and respond to new and novel threats in minutes. -
29
MSPDarkIntel
MSPDarkIntel
MSP Dark Intel is a specialized dark web monitoring platform built by MSPs for MSPs, designed to help managed service providers protect their clients and generate recurring revenue. It monitors over 500 billion breached assets in real time, providing immediate alerts for compromised credentials and detailed breach reports. The platform supports multi-client management through an intuitive dashboard and integrates seamlessly with popular tools like ConnectWise, Autotask, Microsoft 365, Slack, and Teams. MSP Dark Intel offers unlimited prospecting scans and reports, helping MSPs identify and convert new clients easily. With no long-term contracts and month-to-month billing, it provides flexibility and minimal overhead. Thousands of MSPs use this platform to boost client retention, grow predictable monthly revenue, and deliver critical cybersecurity services. -
30
Cybool
Cybool
Cybool is a Next-Gen GRC platform that integrates real-time threat intelligence directly into compliance workflows. Unlike traditional tools relying on static questionnaires, Cybool automatically correlates proprietary security data—including infostealer logs and live signals—with frameworks like NIS2, ISO 27001, SOC 2, and HIPAA. This provides immediate visibility into security posture and data-driven risk prioritization based on current threats. The platform features automated evidence collection, centralized policy management with mandatory acknowledgment tracking, and gamified remediation that accelerates task completion while boosting team engagement. It includes cyber insurance gap analysis to identify coverage blind spots and a tamper-resistant incident log for complete audit trails. Designed for financial services, healthcare, retail, government, and tech sectors, Cybool ensures continuous compliance and audit readiness in one unified platform.
