# Threat intelligence platforms: what AI models recommend, September 2026 IT AI Recommendation Index, September 2026 Edition. Asked as "threat intelligence platform" and as "cyber threat intelligence feed and platform", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://it-ai-index.com/security/threat-intelligence-platforms/ **Standing:** NordStellar leads with 13% of first choices; verdict contested. 47 first choices across the direct, paraphrase, budget and scale prompts. ## First-choice share | # | Product | Share | Negative rate | Labels | |---|---|---|---|---| | 1 | NordStellar | 13% | 0% | 13 | | 2 | MISP | 11% | 8% | 24 | | 3 | Rapid7 Threat Command | 11% | 0% | 11 | | 4 | Recorded Future | 9% | 41% | 46 | | 5 | OpenCTI | 6% | 9% | 23 | | 6 | Cyble Vision | 6% | 0% | 12 | | 7 | AlienVault OTX | 4% | 15% | 13 | | 8 | ThreatConnect | 4% | 36% | 28 | | 9 | Anomali | 2% | 23% | 13 | | 10 | Abuse.ch | 0% | 0% | 10 | | 11 | Anomali ThreatStream | 0% | 14% | 14 | | 12 | Flashpoint | 0% | 0% | 10 | ## Each model's first choice on the direct prompt - Claude Haiku 4.5: Cyble Vision; alternatives Recorded Future, SOCRadar, ThreatConnect - GPT-5.4 mini: Recorded Future; alternatives Anomali, CrowdStrike Falcon Adversary Intelligence, Cyware, SOCRadar - Gemini 3.5 Flash: SOCRadar; alternatives Feedly for Threat Intelligence, Flare, MISP, OpenCTI - Perplexity Sonar: Cyble Vision, SOCRadar; alternatives Flare, Rapid7 Threat Command - Grok 4.1 Fast: NordStellar; alternatives Flare, Rapid7 Threat Command - Mistral Small: NordStellar, Rapid7 Threat Command; alternatives CrowdStrike Falcon, UpGuard - DeepSeek V4 Flash: NordStellar, Rapid7 Threat Command; alternatives Cyble Vision - Llama 4 Maverick: NordStellar; alternatives Flare, Rapid7 Threat Command - Qwen 3.7 Flash: ThreatConnect; alternatives GreyNoise, OpenCTI, Palo Alto Networks Cortex XSOAR, Recorded Future - Kimi K2: Flare, SOCRadar Extended Threat Intelligence; alternatives NordStellar, Rapid7 Threat Command - GLM 4.7 FlashX: Recorded Future; alternatives Flare, Rapid7 Threat Command - MiniMax M2.5: Anomali, Recorded Future; alternatives AlienVault OTX, Intel 471, MISP, Microsoft Defender for Threat Intelligence ## Sources the answers cite 62 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers: - analyticsinsight.net: 37 answers, 64 citations - upguard.com: 33 answers, 39 citations - cyware.com: 27 answers, 37 citations - b2breviews.com: 25 answers, 25 citations - learn.g2.com: 24 answers, 25 citations - esecurityplanet.com: 21 answers, 21 citations - underdefense.com: 15 answers, 16 citations - shadowdragon.io: 15 answers, 15 citations Pages named in the most answers: - https://upguard.com/blog/best-threat-intelligence-platforms-and-vendors (33 answers) - https://analyticsinsight.net/cybersecurity/10-best-threat-intelligence-platforms-in-2026 (25 answers) - https://b2breviews.com/threat-intelligence-platforms (25 answers) - https://learn.g2.com/best-threat-intelligence-tools (24 answers) - https://analyticsinsight.net/cybersecurity/best-threat-intelligence-platforms (22 answers) - https://cyware.com/blog/top-threat-intelligence-platforms-and-solutions (19 answers) - https://esecurityplanet.com/products/threat-intelligence-platforms (18 answers) - https://shadowdragon.io/resources/best-threat-intelligence-platforms (15 answers) - https://devopsschool.com/blog/top-10-threat-intelligence-tools-globally (13 answers) - https://cyble.com/knowledge-hub/top-best-threat-intelligence-platforms (12 answers) ## Warned against - Recorded Future: 19 of 46 labels negative. "Verdict: Avoid if you have a limited budget or require high-volume, automated ingestion into many disparate tools." (GLM 4.7 FlashX, negative prompt) - ThreatConnect: 10 of 28 labels negative. "Avoid enterprise-heavy like Anomali/ThreatConnect unless growing fast." (Grok 4.1 Fast, direct prompt) - Mandiant: 7 of 9 labels negative. "Large enterprises often buy raw, firehose-style threat feeds (like Recorded Future or Mandiant)" (Gemini 3.5 Flash, direct prompt) - Anomali: 3 of 13 labels negative. "Avoid enterprise-heavy like Anomali/ThreatConnect unless growing fast." (Grok 4.1 Fast, direct prompt) ## Record - Method: https://it-ai-index.com/methodology/ - Raw judge labels and full responses: https://it-ai-index.com/data/ - License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.