Freedom251 › IT & Infrastructure
Free and open first
Best Threat Intelligence Platforms in 2026
Threat intelligence platforms support work with indicators, reports, and security cases. Compare indicator enrichment and STIX/TAXII support alongside case management and report management. Deployment options and workflow automation offer more ways to assess operational fit, while free-plan availability and the paid starting price provide cost context. OpenAEV, IBM X-Force Exchange, and ThreatForge are among the entries shown. Consider how your team handles intelligence and related workflows when weighing the capabilities listed for each platform.
- 32 apps
- Research read 23 Sept 2026
- How the order is worked out
- 1
MISP
Free plan Open source APILinuxSelf-hosted+1MISP brings threat-intelligence collection, analysis, sharing controls, and automation into one platform. The software is free, while prioritized support and training are paid options.
- 2
IntelOwl
Free plan APILinuxSelf-hosted+1IntelOwl combines file and observable enrichment with a web interface, API, clients, and extensible plugins. It is a practical fit when self-hosting on a documented Linux environment suits your team.
- 3
Pulse Intelligence
Free plan APILinuxMac+3Choose Pulse Intelligence if your team wants an open-source, self-hosted threat intelligence workspace with feed ingestion, enrichment, saved hunts, exports, and scheduled reports.
- 4
IBM X-Force Exchange
Free plan APIWebX-Force Exchange brings threat research and collaboration into a cloud-based portal, with QRadar integration and documented intelligence feeds.
- 5
Kaspersky Threat Intelligence Portal
Free plan APIWebThe portal combines lookup, file and URL analysis, investigation features and integrations for security teams.
- 6
ThreatForge
Free plan APISelf-hostedWebThreatForge combines indicator enrichment, brand monitoring, and access controls in a free Community edition.
- 7
SOCRadar Extended Threat Intelligence Platform
Free plan APIWebSOCRadar XTI combines several security-monitoring areas with threat intelligence and workflow tools.
- 8
Threat Intelligence Platform
Free plan APIWebThreat Intelligence Platform offers host and infrastructure analysis through a web interface and APIs, with several types of enrichment data.
- 9
Yeti
Free plan APISelf-hostedWebYeti combines threat intelligence organization with DFIR-focused searching, indicators, and automation. Its documented installation requires a Docker-based setup and associated tools.
- 10
Google Cloud Secret Manager
Free plan Web - 11
OpenCTI
Free plan LinuxWeb - 12
EclecticIQ Platform
Paid APIExtensionSelf-hosted+1EclecticIQ Platform combines lifecycle management, structured intelligence formats, analysis workspaces, AI assistance, and controlled sharing.
- 13
Anomali Platform
Paid APIWebAnomali Platform combines telemetry processing, threat intelligence, and AI-supported investigation for security operations. Buyers need to contact sales for pricing.
- 14
Cyble Vision
Paid APIWebChoose Cyble Vision if your organization needs broad threat monitoring, indicator-led investigations, and intelligence delivery through APIs or STIX/TAXII.
- 15
Cyware Intelligence Exchange
Paid APISelf-hostedChoose Cyware Intelligence Exchange if your team needs a system to automate threat intelligence workflows and connect analysis with sharing and action.
- 16
Open Threat Exchange
Free plan WebChoose Open Threat Exchange when indicator enrichment and report management are the main requirements. Its free, cloud-based web access keeps those functions in one online service.
- 17
DomainTools Monitors
Paid APIWebDomainTools Monitors covers brand, ownership, DNS, and IP changes with alerts, APIs, and integrations. Check membership rules and the name-server domain limit for your use case.
5.6 Visit site - 18
Flashpoint Ignite
Paid APIWebIgnite combines searchable intelligence, alerts, reports, integrations, and analyst requests in a cloud platform. Prospective users need to request pricing to learn the cost.
- 19
DAS-Security ATIP
Paid APISelf-hostedWebChoose DAS-Security ATIP if your team needs broad threat intelligence, response automation, and fully on-premise deployment.
- 20
Intel 471 Verity471
Paid APIWebVerity471 brings exposure management, threat intelligence, and hunting into one platform, with cited intelligence and integrations to existing security tools.
- 21
Security Vision TIP
Paid APILinuxSelf-hosted+2Security Vision TIP combines threat-data ingestion, enrichment, searching, and response in a self-hosted platform.
- 22
Recorded Future Intelligence Cloud
Paid APIExtensionWebRecorded Future Intelligence Cloud combines broad intelligence collection with package-based security capabilities and integrations.
- 23
Shodan Monitor
Paid APILinuxWebShodan Monitor combines continuous network observation with multiple alert routes and scan options.
- 24
Threatnote
Free trial WebThreatnote brings several threat intelligence and monitoring workflows into one web platform, with listed integrations and partner controls.
- 25
ThreatConnect Platform
Paid APISelf-hostedWebThreatConnect combines threat data analysis, operational workflows, case management, and cyber risk capabilities.
#1Places #1, #2, #3, #4, #5 on this list can be bought by the makers of the software on it. See the price
More in IT & Infrastructure
- Unattended Remote Access Software29
- Unified Endpoint Management Software31
- User and Entity Behavior Analytics Software21
- Virtualization Management Software34
- VoIP Monitoring Software21
- Vulnerability Management Software33
- WAN Optimization Software19
- Web Application Firewall Software35
- Web Application Security Scanners29
- Website Monitoring Software55
- Wireless Network Management Software27
- Zero Trust Network Access Software42