Threat intelligence platforms for enterprise buyers
Asked as “threat intelligence platform”, and as “cyber threat intelligence feed and platform”, on behalf of an enterprise B2B company. 44 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
01The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
Show the five products at 0%, ordered by negative rate
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.
One product takes 61% of first choices here, so the chart would put nine markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. Two products carry a negative rate above 25% in this category. Jump to the standing
02What they warned about
Seven of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, Gemini 3.5 Flash, Mistral Small, Kimi K2 and GLM 4.7 FlashX changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Recorded Future14%
8 of 59 labels negative · 7 of 12 models · 1 hard negative
“Why avoid "Standard" TIPs (Recorded Future, Mandiant, ThreatConnect)?” GLM 4.7 FlashX, budget prompt
Mandiant31%
4 of 13 labels negative · 4 of 12 models · 3 hard negative
“should be cautious about or avoid include: 1. Mandiant (Google Threat Intelligence) - due to its high pricing, ecosystem lock-in, and limited continuous external monitoring.” Llama 4 Maverick, negative prompt
MISP40%
4 of 10 labels negative · 4 of 12 models · 2 hard negative
“**SMB-Focused Tools**: Platforms like some open-source (MISP, OpenCTI) or lighter vendors don't handle enterprise data volumes” Grok 4.1 Fast, negative prompt
ThreatConnect21%
7 of 33 labels negative · 4 of 12 models · 1 hard negative
“Why avoid "Standard" TIPs (Recorded Future, Mandiant, ThreatConnect)?” GLM 4.7 FlashX, budget prompt
03What they cite
Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
66 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 908 links across 241 sites, every framing counted. Ranked by the number of answers carrying the site or page.
43 answers · 81 citations · 10 models
vendor site · UpGuard29 answers · 29 citations · 9 models
vendor site · Cyware26 answers · 36 citations · 9 models
vendor site · Bitsight23 answers · 30 citations · 10 models
20 answers · 20 citations · 9 models
vendor site · ShadowDragon20 answers · 20 citations · 10 models
vendor site · Cyble18 answers · 19 citations · 8 models
17 answers · 17 citations · 9 models
vendor site · Recorded Future16 answers · 25 citations · 8 models
16 answers · 16 citations · 9 models
14 answers · 14 citations · 8 models
14 answers · 14 citations · 8 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
33 answers · 10 models
29 answers · 9 models
23 answers · 9 models
21 answers · 9 models
20 answers · 10 models
19 answers · 9 models
17 answers · 9 models
17 answers · 8 models
17 answers · 9 models
16 answers · 9 models
04How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best threat intelligence platform for an enterprise B2B company?”Paraphrase“Which cyber threat intelligence feed and platform would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade threat intelligence platforms and how do they differ?”Budget-constrained“What is the best threat intelligence platform for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a threat intelligence platform. What should we look at?”Negative“Which threat intelligence platforms should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5no first choiceRecorded FutureChangedno first choiceRecorded Futureno first choiceagainst: AlienVault Open Threat Exchange
Three alternatives
Anomali ThreatStream, Flashpoint Ignite, Unit 42Four alternatives
Anomali ThreatStream, CrowdStrike Falcon Intelligence, Mandiant, ThreatConnectGPT-5.4 miniRecorded FutureRecorded FutureHeldRecorded FutureGroup-IB Threat Intelligenceno first choicenothing named
Two alternatives
Flashpoint, Intel 471Five alternatives
Flashpoint, Google / Mandiant intelligence ecosystem, Intel 471, KELA, ZeroFoxFive alternatives
Anomali, CrowdStrike Falcon Intelligence, MISP, Mandiant Advantage Threat Intelligence, ThreatConnectTwo alternatives
Recorded Future, SOCRadar Extended Threat IntelligenceGemini 3.5 FlashCywareAnomali ThreatStream, ThreatConnectChangedRecorded FutureOpenCTIno first choiceagainst: Anomali, MISP, OpenCTI, ThreatConnect
Five alternatives
CrowdStrike Falcon Intelligence, Flare, Google Threat Intelligence, Recorded Future, SpyCloudFive alternatives
CrowdStrike Falcon Adversary Intelligence, Flashpoint, Google Threat Intelligence / Mandiant, OpenCTI, Recorded FutureFive alternatives
Anomali ThreatStream, CrowdStrike Falcon Adversary Intelligence, EclecticIQ Intelligence Center, Google Threat Intelligence, ThreatConnectThree alternatives
Cyware, Flare, Recorded FuturePerplexity SonarRecorded FutureRecorded FutureHeldRecorded FutureMicrosoft Defender TI, UnderDefense MDRagainst: Mandiant Advantage, Recorded Futureno first choiceagainst: Cloudflare Cloudforce One, CrowdStrike Adversary Intelligence, MISP, Microsoft Defender Threat Intelligence, VirusTotal
Four alternatives
CloudSEK, Cyble Vision, Flashpoint, ThreatConnectFive alternatives
Abuse.ch, CloudSEK, Cyble Vision, Spamhaus, URLhaus / MalwareBazaarEight alternatives
Anomali ThreatStream, CloudSEK, CrowdStrike Falcon Adversary Intelligence, Cyble Vision, Flashpoint, Mandiant, Microsoft Defender Threat Intelligence, ThreatConnectGrok 4.1 FastRecorded FutureRecorded FutureHeldRecorded FutureRecorded Futureagainst: Google Threat Intelligence, ThreatConnectCrowdStrike Falcon Adversary Intelligence, Recorded Futureagainst: CrowdStrike Falcon Intelligence, Flashpoint, MISP, Mandiant/Google, OpenCTI, Recorded Future, ThreatConnect
Four alternatives
Bitsight, CrowdStrike Falcon Adversary Intelligence, Flashpoint, Google MandiantThree alternatives
Anomali ThreatStream, Google Mandiant Advantage, ThreatConnectFour alternatives
Anomali ThreatStream, CrowdStrike Falcon Adversary Intelligence, Google Threat Intelligence, ThreatConnectOne alternative
CrowdStrike Falcon Adversary IntelligenceTwo alternatives
Cyble Vision, Mandiant/Google Threat IntelligenceMistral SmallCrowdStrike Falcon Adversary Intelligence, Recorded FutureGoogle Threat Intelligence, Recorded FutureChangedRecorded FutureCrowdStrike Falcon XDRagainst: Google Threat Intelligenceno first choiceagainst: Flashpoint Ignite, Mandiant, Recorded Future
One alternative
Google Threat IntelligenceThree alternatives
CrowdStrike Falcon Adversary Intelligence, Cyble Vision, ThreatConnectSix alternatives
CrowdStrike Falcon Adversary Intelligence, Cyble Vision, Cyware, Flashpoint, Google Threat Intelligence, Microsoft Defender Threat IntelligenceOne alternative
Recorded FutureDeepSeek V4 FlashRecorded FutureRecorded FutureHeldRecorded FutureRecorded Futureagainst: CrowdStrike Falcon Adversary Intelligence, Google SecOpsno first choiceagainst: Recorded Future
Two alternatives
CrowdStrike Adversary Intelligence, Google MandiantFive alternatives
Bitsight, CrowdStrike Falcon Adversary Intelligence, Flashpoint, Google Cloud Mandiant, Intel 471Seven alternatives
CrowdStrike Falcon Adversary Intelligence, Cyware, Flashpoint, Google Mandiant Threat Intelligence, MISP, ThreatConnect, ZeroFoxOne alternative
Google Threat IntelligenceLlama 4 Maverickno first choiceno first choiceHeldno first choiceRecorded Futureno first choiceagainst: Mandiant, Recorded Future
Qwen 3.7 FlashRecorded FutureRecorded FutureHeldRecorded FutureRecorded Futureno first choiceagainst: Anomali, CrowdStrike, MISP, OpenCTI, Palo Alto Cortex, SentinelOne TI modules, Silobreaker
Two alternatives
CrowdStrike Falcon Threat Intel, MandiantThree alternatives
Flashpoint, Google Mandiant, ThreatConnectFive alternatives
CrowdStrike Falcon Adversary Intelligence, Flashpoint, IBM Security X-Force, Intel 471, ThreatConnectTwo alternatives
CrowdStrike Falcon Adversary Intelligence, Mandiant AdvantageKimi K2Recorded FutureGoogle Threat Intelligence, Mandiant Advantage, Recorded FutureChangedRecorded FutureRecorded Futureagainst: Google Threat Intelligence, Mandiant Advantage, ThreatConnectRecorded Futureagainst: ThreatConnectagainst: Anomali, Exabeam, Mandiant/Google Threat Intelligence, Recorded Future, ThreatConnect
Six alternatives
Anomali ThreatStream, Bitsight, CrowdStrike Falcon Intelligence, Flashpoint, Google Mandiant, ThreatConnectFour alternatives
Anomali ThreatStream, Mimecast, Proofpoint Emerging Threats, ThreatConnectFour alternatives
Anomali ThreatStream, CrowdStrike Falcon Intelligence, Google Threat Intelligence, ThreatConnectTwo alternatives
Anomali, CrowdStrike Falcon IntelligenceThree alternatives
Anomali, Google Threat Intelligence, MandiantGLM 4.7 FlashXRecorded Futureagainst: MISP / OpenCTIMicrosoft Sentinel, Q-Feeds, Recorded Future Intelligence FeedChangedRecorded FutureMicrosoft Sentinelagainst: Mandiant, Recorded Future, ThreatConnectno first choiceagainst: Recorded Future
Seven alternatives
Anomali ThreatStream, Check Point Exposure Management, CrowdStrike Falcon Intelligence, Cyberint, Cyble Vision, Google Mandiant, ThreatConnectTwo alternatives
Cyble Vision, Google Threat Intelligence FeedFive alternatives
Anomali ThreatStream, CrowdStrike Falcon Intelligence, Microsoft Defender Threat Intelligence, ThreatConnect, ZeroFoxTwo alternatives
CrowdStrike Falcon Intelligence, OpenCTIMiniMax M2.5Recorded FutureRecorded FutureHeldno first choiceRecorded Futureno first choiceagainst: Mandiant
Four alternatives
Anomali, CrowdStrike Falcon Intelligence, Google Mandiant, ThreatConnectThree alternatives
Anomali, CrowdStrike Falcon Intell, MandiantThree alternatives
Flare, Group-IB Threat Intelligence, Threat LandscapeBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
05The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 09:47 | no | 0 | 4 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 14:02 | yes | 3 | 7 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 10:36 | yes | 14 | 25 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-09-17 14:00 | yes | 20 | 6 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-09-17 11:08 | yes | 31 | 13 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 10:06 | yes | 8 | 9 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 10:54 | yes | 18 | 21 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 13:43 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 12:21 | no | 0 | 34 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 12:21 | yes | 18 | 52 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 09:44 | yes | 12 | 134 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 10:51 | yes | 10 | 37 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 11:56 | yes | 14 | 8 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 10:21 | yes | 4 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 10:23 | yes | 16 | 22 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-09-17 14:08 | yes | 20 | 7 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-09-17 09:23 | yes | 38 | 16 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 12:14 | yes | 10 | 7 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 11:13 | yes | 16 | 23 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 10:48 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 11:50 | yes | 10 | 39 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 12:34 | yes | 19 | 39 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 13:20 | yes | 14 | 47 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 09:54 | yes | 5 | 27 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 12:27 | yes | 18 | 15 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 13:23 | yes | 8 | 15 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 11:45 | yes | 19 | 27 s |
| Comparative | Perplexity Sonar | sonar | 2026-09-17 13:23 | yes | 20 | 10 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-09-17 12:29 | yes | 22 | 14 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 12:46 | yes | 5 | 7 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 10:39 | yes | 19 | 25 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 11:12 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 13:16 | yes | 5 | 41 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 11:46 | yes | 12 | 34 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 12:04 | yes | 25 | 73 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 09:35 | yes | 5 | 17 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 12:14 | yes | 9 | 7 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 13:48 | yes | 3 | 6 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 12:08 | yes | 14 | 22 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-09-17 14:02 | yes | 20 | 5 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-09-17 12:14 | yes | 36 | 18 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 11:03 | yes | 10 | 8 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 12:23 | yes | 19 | 25 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 11:31 | yes | 5 | 2 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 09:25 | yes | 9 | 76 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 09:46 | yes | 28 | 85 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 10:01 | yes | 25 | 110 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 10:46 | yes | 19 | 69 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 13:05 | no | 0 | 7 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 10:36 | no | 0 | 12 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 13:58 | yes | 8 | 27 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-09-17 11:50 | yes | 20 | 11 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-09-17 11:06 | yes | 24 | 14 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 12:00 | no | 0 | 8 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 10:26 | yes | 19 | 26 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 13:24 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 12:16 | no | 0 | 47 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 12:49 | yes | 28 | 41 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 12:05 | yes | 26 | 78 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 12:32 | yes | 10 | 26 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 09:34 | yes | 15 | 8 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 14:02 | yes | 3 | 9 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 09:32 | yes | 24 | 29 s |
| Negative framing | Perplexity Sonar | sonar | 2026-09-17 09:55 | yes | 20 | 7 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-09-17 09:23 | yes | 27 | 18 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 13:53 | yes | 12 | 9 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 12:01 | yes | 28 | 37 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 09:24 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 10:22 | yes | 10 | 56 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 10:58 | yes | 18 | 75 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 10:32 | yes | 21 | 62 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 12:24 | yes | 10 | 30 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
Category-scoped readings
None. Every name in this category resolved on its own.
Unresolved, counted raw
Ancrowdstrike
Any.Run
Azure Sentinel
CrowdStrike Falcon Intell
CrowdStrike Falcon Threat Intel
Dataminr
Digital Shadows
EclecticIQ Intelligence Center
Filigran (OpenCTI Enterprise Edition)
Financial ISAC (FS-ISAC)
Google / Mandiant intelligence ecosystem
Google Cloud Mandiant
Google Mandiant Advantage
Google Threat Intelligence Feed
IBM Security X-Force
KELA
Malware Bazaar
Mandiant Advantage Threat Intelligence
Microsoft Security / Sentinel
Palo Alto Unit 42
Proofpoint Emerging Threats
Q-Feeds
Recorded Future Intelligence Feed
SentinelOne TI modules
Silobreaker
Splunk TI Framework
Threat Landscape
ThreatStream
URLhaus
URLhaus / MalwareBazaar
UnderDefense MDR
VulnDB
Discontinued, still offered
No shut-down product was recommended here.