IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index Security operations Threat intel › Small business September 2026 Edition

Threat intelligence platforms for small business buyers

Asked as “threat intelligence platform”, and as “cyber threat intelligence feed and platform”, on behalf of a small B2B company. 47 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Contested
19% of first choices, contested.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01NordStellar19%7%27accepted challenger
02MISP17%12%32accepted challenger
03AlienVault OTX9%0%19accepted challenger
04VirusTotal4%0%15accepted challenger
05CrowdStrike Falcon4%18%11accepted challenger
06OpenCTI4%32%19criticized challenger
07ThreatConnect4%68%22criticized challenger
08SOCRadar2%0%15accepted challenger
09Abuse.ch2%0%15accepted challenger
10Recorded Future2%67%33criticized challenger
Show the three products at 0%, ordered by negative rate
13Anomali ThreatStream0%67%12criticized challenger
12Anomali0%64%11criticized challenger
11GreyNoise0%4%24accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
12
13
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative30%
Key
01NordStellar19%
02MISP17%
03AlienVault OTX9%
04VirusTotal4%
05CrowdStrike Falcon4%
06OpenCTI4%
07ThreatConnect4%
08SOCRadar2%
09Abuse.ch2%
10Recorded Future2%
11GreyNoise0%
12Anomali0%
13Anomali ThreatStream0%

02What they warned about

One of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Recorded Future
67%
22 of 33 labels negative · 10 of 12 models · 12 hard negative
“purchasing a traditional, enterprise-grade Threat Intelligence Platform (TIP) like Recorded Future, Mandiant (Google Cloud), or ThreatConnect is almost always a mistake” Gemini 3.5 Flash, direct prompt
ThreatConnect
68%
15 of 22 labels negative · 7 of 12 models · 9 hard negative
“Avoid "Big" TIPs initially: Traditional heavyweights like **Recorded Future**, **Anomali**, or **ThreatConnect** are powerful but expensive and complex.” Qwen 3.7 Flash, comparative prompt
Anomali
64%
7 of 11 labels negative · 6 of 12 models · 5 hard negative
“Avoid "Big" TIPs initially: Traditional heavyweights like **Recorded Future**, **Anomali**, or **ThreatConnect** are powerful but expensive and complex.” Qwen 3.7 Flash, comparative prompt
Flashpoint
83%
5 of 6 labels negative · 5 of 12 models · 4 hard negative
“**Why to avoid:** This platform focuses on "Dark web and deep web intelligence" and is described as having **"Custom pricing"**” GLM 4.7 FlashX, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

63 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 5 of those lists are Google grounding redirects that name no site and are left out of the counts. 869 links across 195 sites, every framing counted. Ranked by the number of answers carrying the site or page.

36 answers · 37 citations · 11 models
36 answers · 36 citations · 9 models
vendor site · UpGuard32 answers · 33 citations · 10 models
vendor site · SourceForge28 answers · 32 citations · 9 models
26 answers · 26 citations · 10 models
vendor site · Vectra24 answers · 24 citations · 8 models
vendor site · Cyware21 answers · 31 citations · 8 models
20 answers · 27 citations · 9 models
18 answers · 22 citations · 9 models
18 answers · 18 citations · 7 models
14 answers · 15 citations · 6 models
12 answers · 16 citations · 8 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best threat intelligence platform for a small B2B company?”Paraphrase“Which cyber threat intelligence feed and platform would you recommend to a small business that sells to other businesses?”Comparative“What are the top threat intelligence platforms for a small team and how do they differ?”Budget-constrained“What is the best threat intelligence platform for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a threat intelligence platform. What should we look at?”Negative“Which threat intelligence platforms should a small business avoid or be cautious about?”
Claude Haiku 4.5no first choiceOpen Threat Exchange, SpamhausChangedCloud SEK, SOCRadar
Two alternativesCrowdStrike Falcon, Cyble Vision
against: Recorded Future
Open Threat Exchange
Two alternativesGreyNoise, Stellar Cyber
no first choiceagainst: Cisco Talos, IBM Threat Intelligence
GPT-5.4 miniRecorded Future
Five alternativesCloudSEK, Cyble, GreyNoise, SOCRadar, ZeroFox
ThreatConnectChanged
Four alternativesCrowdStrike, Mandiant, OpenCTI, Recorded Future
OpenCTI
Three alternativesAnomali ThreatStream, MISP, ThreatConnect
MISP
Two alternativesIntelFinder, Microsoft Defender XDR
no first choiceagainst: OpenCTI
Gemini 3.5 FlashCrowdStrike Falcon, Huntress
Five alternativesFlare, GreyNoise, LevelBlue OTX, SOCRadar, SentinelOne Singularity Control
against: Mandiant, Recorded Future, ThreatConnect
LevelBlue Open Threat ExchangeChanged
Eight alternativesAbuse.ch, CISA’s AIS, CrowdStrike Falcon Go, GreyNoise, MS-ISAC, Microsoft Defender for Cloud, PhishTank, Spamhaus
against: MISP, OpenCTI
LevelBlue Open Threat Exchange
Four alternativesFlare, MISP, OpenCTI, SOCRadar
against: Google Mandiant, Recorded Future
LevelBlue Open Threat Exchange
Four alternativesGreyNoise, MISP, OpenCTI, Pulsedive
against: Anomali ThreatStream, Recorded Future
Flare.io, SpyCloud
Seven alternativesCrowdStrike, Expel, HaveIBeenPwned, Huntress, Microsoft Defender Threat Intelligence, Red Canary, SentinelOne
against: Anomali, Recorded Future, ThreatConnect
against: Anomali ThreatStream, Cyware, MISP, OpenCTI, Palo Alto Networks Cortex XSOAR, Recorded Future, ThreatConnect, ThreatQuotient
Perplexity SonarNordStellar
Two alternativesCloudSEK, GreyNoise
against: Cyble Vision
MISPChanged
Seven alternativesAbuse.ch, AlienVault OTX, CISA AIS, Flare, GreyNoise Block, VMRay's ThreatFeed, VirusTotal community
Flare, GreyNoise
Five alternativesAlienVault OTX, CloudSEK, Falcon Adversary Intelligence, MISP, VirusTotal
against: Anomali, ThreatConnect
Amazon GuardDuty
Two alternativesGreyNoise, VirusTotal
against: NordStellar
no first choiceagainst: Anomali ThreatStream, FireEye iSight, Flashpoint, Mandiant Advantage, NetWitness, Recorded Future, Splunk Intelligence Management
Grok 4.1 FastVirusTotal
Three alternativesAmazon GuardDuty, GreyNoise, NordStellar
against: CrowdStrike Falcon
AlienVault Open Threat ExchangeChanged
Four alternativesCISA Cyber Hygiene Services, CrowdStrike Falcon Go, GreyNoise Block, MISP
against: Recorded Future
NordStellar
Four alternativesGreyNoise, MISP, OpenCTI, SOCRadar
against: CrowdStrike Falcon Intelligence, Recorded Future, ThreatConnect
AlienVault OTX
Three alternativesMISP, OpenCTI, VirusTotal
against: Recorded Future
no first choiceagainst: Anomali, CrowdStrike, EclecticIQ, Flashpoint, Mandiant, Recorded Future, ThreatConnect
Mistral SmallNordStellarNordStellarHeld
Three alternativesBlocklist.de, GreyNoise, VirusTotal
NordStellar
Five alternativesCheck Point Exposure Management, CloudSEK, GreyNoise, MISP, OpenCTI
against: Mandiant, Recorded Future
Amazon GuardDuty
Six alternativesAbuse.ch, AlienVault OTX, CISA AIS, GreyNoise, MISP, VirusTotal
against: Deepinfo, NordStellar
no first choicenothing named
DeepSeek V4 FlashCrowdStrike Falcon, NordStellar
Three alternativesCrowdSec, GreyNoise, Microsoft Defender Threat Intelligence
against: Anomali ThreatStream, Palo Alto Cortex XSOAR, Recorded Future, ThreatConnect
Abuse.ch, AlienVault OTXChanged
Two alternativesCrowdStrike Falcon, NordStellar
against: MISP, Mandiant, Recorded Future, ThreatConnect
AlienVault OTX, MISP, OpenCTI, VirusTotal
Seven alternativesAbuse.ch, CrowdStrike Falcon Intelligence / Adversary Intelligence, Cyble, GreyNoise, Microsoft Defender Threat Intelligence, NordStellar, SOCRadar
against: Anomali ThreatStream, Mandiant, Recorded Future, ThreatConnect
MISP, OpenCTI
Six alternativesAbuse.ch, AlienVault OTX, CISA AIS, CloudSEK, GreyNoise, NordStellar
MISP, OpenCTI
One alternativeCISA Automated Indicator Sharing/AIS
against: Anomali ThreatStream, Flashpoint, Mandiant, Recorded Future, ThreatConnect
Llama 4 MaverickNordStellar
Two alternativesCrowdStrike Falcon, Pyrra
FalconFeedsChanged
Three alternativesAnomali, Bitsight, MISP
NordStellar
Two alternativesCloudSEK, GreyNoise
Amazon GuardDuty, Deepinfo
One alternativeNordStellar
no first choicenothing named
Qwen 3.7 FlashNordStellar
Five alternativesAmazon GuardDuty, CrowdStrike Falcon, ISMalicious, Microsoft Defender for Cloud, VirusTotal
AlienVault OTXChanged
Two alternativesAbuse.ch, Anomali
Flare.io, NordStellar
Three alternativesCrowdStrike Falcon Intelligence, Cyberint, Microsoft Defender TI
against: Anomali, MISP, OpenCTI, Recorded Future, ThreatConnect
MISP, Maltiverse
Two alternativesAlienVault Open Threat Exchange, Microsoft Defender XDR
no first choiceagainst: Anomali, Cyware, Flashpoint, IBM X-Force Exchange, OpenCTI, Recorded Future, ThreatConnect
Kimi K2SOCRadar
Three alternativesGreyNoise, MISP, Pulsedive
against: Anomali ThreatStream, CrowdStrike Falcon Intelligence, Google Threat Intelligence, Recorded Future, ThreatConnect
MISP, VirusTotalChanged
Four alternativesAmazon GuardDuty, Deepinfo, NordStellar, OpenCTI
MISP, NordStellar
Four alternativesAnomali ThreatStream, OpenCTI, Recorded Future, ThreatConnect
AlienVault OTX
Two alternativesMISP, VirusTotal
against: GreyNoise
no first choice
Three alternativesBreachsense, Flare, SOCRadar
against: Anomali ThreatStream, CrowdStrike Falcon Intelligence, Cyble, Darktrace, Google Threat Intelligence, Mandiant Threat Intelligence, Recorded Future
GLM 4.7 FlashXNordStellar
Five alternativesCrowdStrike Falcon, Cyble, Deepinfo, GreyNoise, SOCRadar
NordStellar, ThreatConnectChanged
Nine alternativesAlienVault OTX, CISA AIS, CrowdSec, CrowdStrike Falcon Intelligence, Cyble, GreyNoise, MISP, Recorded Future, abuse.ch PhishTank
NordStellar
Six alternativesCrowdStrike Falcon Intelligence, CyberCure Advanced Cyber Threat Intelligence, Cyberint, Recorded Future, SOCRadar Extended Threat Intelligence, ZeroFox
MISP
Eight alternativesAbuse.ch, AlienVault OTX, CISA Known Exploited Vulnerabilities, Criminal IP, MalwareBazaar, ManageEngine Endpoint Central, Shodan, VirusTotal
no first choiceagainst: Anomali, Flashpoint, Recorded Future
MiniMax M2.5NordStellar
Two alternativesRapid7 Threat Command, ZeroFox
against: CrowdStrike Falcon, Recorded Future
no first choiceChangedGreyNoise
Three alternativesCloudSEK, NordStellar, Recorded Future
MISP
Four alternativesAbuse.ch, AlienVault OTX, CISA AIS, VirusTotal
against: ThreatConnect
no first choiceagainst: Anomali, OpenCTI, ThreatConnect
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:26no04 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:42yes27 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 09:55yes1823 s
Direct recommendationPerplexity Sonarsonar2026-09-17 12:12yes204 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 11:55yes4223 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 12:13yes127 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-09-17 13:51yes2547 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 10:51yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 14:06yes922 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 10:48yes2943 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:49yes13116 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:17yes1126 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:30yes179 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:56no07 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 14:00yes1427 s
ParaphrasePerplexity Sonarsonar2026-09-17 12:37yes186 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:54yes3917 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 10:36yes107 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 09:37yes1716 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 14:13yes53 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:59no044 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 14:02yes1421 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:44yes13114 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 09:36yes588 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 09:36yes1613 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:41yes412 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:03yes2130 s
ComparativePerplexity Sonarsonar2026-09-17 10:34yes208 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:21yes4720 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 12:02yes98 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:00yes2727 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:48yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:34yes1042 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:58yes1449 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:32yes28324 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:56yes2253 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:47yes96 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:31yes45 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 14:12yes1727 s
Budget constrainedPerplexity Sonarsonar2026-09-17 12:41yes205 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 14:09yes2414 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 10:25yes54 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:13yes1013 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:48yes53 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:18no031 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:37yes2047 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:06yes14145 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:58yes545 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:44no06 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 11:28no09 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:19no015 s
Scale constrainedPerplexity Sonarsonar2026-09-17 13:45yes2013 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:56yes149 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 09:37no08 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:03yes1729 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:25yes54 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:21no035 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:27yes1829 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 14:06yes1386 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:05yes516 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:49yes148 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:52yes56 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:02yes722 s
Negative framingPerplexity Sonarsonar2026-09-17 11:19yes206 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:43yes2012 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 12:06yes56 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:02yes1825 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:22yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:58yes949 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:13yes2941 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 10:34yes18150 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:09yes1033 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
None. Every name in this category resolved on its own.
Unresolved, counted raw
ActiveFence
Blocklist.de
Breachsense
CIRCL OSINT feed
CISA Automated Indicator Sharing/AIS
CISA Cyber Hygiene Services
CISA Known Exploited Vulnerabilities (KEV)
CISA’s AIS
Cloud SEK
CyberCure Advanced Cyber Threat Intelligence
Falcon Intelligence
FalconFeeds
FireEye iSight
GreyNoise Community
HaveIBeenPwned
IBM Threat Intelligence
IntelFinder
Maltiverse
Microsoft Defender threat intel
Microsoft built-ins
Pyrra
RiskIQ PassiveTotal
SentinelOne Singularity Control
Splunk Intelligence Management
VMRay's ThreatFeed
abuse.ch PhishTank
whiteintel.io
Discontinued, still offered
No shut-down product was recommended here.
← TPRMVuln management →