Every category where a model named Recorded Future for a mid-market B2B company. Share is first choices across the direct, paraphrase, budget and scale prompts; rank is within every product named in that category.

Category	Function	Share	Rank	Negative rate	Labels	Quadrant
Threat intelligence platforms	Security operations	9%	4 of 128	41%	46	criticized challenger

Movement

This is the first edition on this tier, so no move can be computed for Recorded Future yet. From the next edition this section shows, per buyer segment, whether its share moved by more than the measured noise floor.

By model

How each model treated Recorded Future across every prompt where it was named for a mid-market B2B company. Twelve models, six prompts per category.

Model	First choice	Alternative	Mention	Negative	Labels
Claude Haiku 4.5	1	1	0	0	2
GPT-5.4 mini	1	2	0	0	3
Gemini 3.5 Flash	1	0	0	3	4
Perplexity Sonar	1	1	0	1	3
Grok 4.1 Fast	1	1	0	4	6
Mistral Small	0	1	0	1	2
DeepSeek V4 Flash	1	0	0	4	5
Llama 4 Maverick	0	1	2	0	3
Qwen 3.7 Flash	1	2	0	1	4
Kimi K2	1	0	0	3	4
GLM 4.7 FlashX	3	0	0	2	5
MiniMax M2.5	1	2	2	0	5

By framing

Which of the six questions produced the naming. By model says how often; this says asked what. The first-choice count on the right carries the marks of the models that produced it.

FramingLabels by classFirst choices

Direct25 labels13

Paraphrase25 labels10

Comparative32 labels17not counted in share

Budget-constrained19 labels7

Scale-constrained12 labels2

Negative25 labelsNone

First choiceAlternativeMentionNegative138 labels in all, every segment counted; 32 of the 49 first choices count toward share, since the comparative and negative framings do not. The bar is one segment per label class, to scale within the framing.

What the models said for it

Verbatim evidence the judge attached to positive labels.

“Broad intelligence platforms like Recorded Future are strongest when you need coverage across malware, actors, infrastructure, and business risk for many teams.” Perplexity Sonar · Threat intel · comparative prompt · first choice

“Recorded Future operates as the intelligence cloud leader, processing over 900 billion data points daily... suits broad enterprise CTI programs” Claude Haiku 4.5 · Threat intel · comparative prompt · first choice

“Recorded Future is the go‑to: depth of commercial feeds, AI‑assisted analysis, and strong SIEM/SOAR integration.” GLM 4.7 FlashX · Threat intel · comparative prompt · first choice

“Recorded Future and Anomali are frequently the top picks for mid‑market teams.” MiniMax M2.5 · Threat intel · direct prompt · first choice

And against it

Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.

“Verdict: Avoid if you have a limited budget or require high-volume, automated ingestion into many disparate tools.” GLM 4.7 FlashX · Threat intel · negative prompt · hard negative

“What to avoid for a mid-sized business - Recorded Future — category-leading, but enterprise pricing” DeepSeek V4 Flash · Threat intel · paraphrase prompt · hard negative

“enterprise-grade Threat Intelligence Platforms (TIPs) like Recorded Future or Google/Mandiant—which often cost upwards of $75,000 to $100,000+ annually—are typically too expensive and complex” Gemini 3.5 Flash · Threat intel · paraphrase prompt · soft negative

“Large enterprises often buy raw, firehose-style threat feeds (like Recorded Future or Mandiant) because they have dedicated Cyber Threat Intelligence (CTI) teams” Gemini 3.5 Flash · Threat intel · direct prompt · soft negative

Named alongside

The products named in the same answers as Recorded Future, over the 138 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and Recorded Future was named but was not.

ProductSame answerTook the first choice insteadHead to head

ThreatConnect74 of 1386Not in the top three

MISP42 of 1387Not in the top three

OpenCTI36 of 1384Not in the top three

Anomali ThreatStream36 of 1381Not in the top three

Flashpoint35 of 1380Not in the top three

Anomali32 of 1380Not in the top three

Mandiant27 of 1380Not in the top three

CrowdStrike Falcon Intelligence25 of 1380Not in the top three

AlienVault OTX23 of 1387Not in the top three

CrowdStrike Falcon Adversary Intelligence23 of 1380Not in the top three

A head-to-head page exists where both products are in a category's top three. The other rows are the same fact without a page behind them, so they link to the product instead.

What carried it into the answer

The sites and pages cited by the answers that named Recorded Future. A fact about retrieval, not a lever on the model.

Citations exist only for the models that return a source list, four of the twelve in this edition, so these counts come from 117 of the 138 answers that named Recorded Future and are not a share of its labels.

Domains cited

analyticsinsight.net73

upguard.com67

learn.g2.com51

b2breviews.com50

esecurityplanet.com50

cyware.com48

shadowdragon.io32

cyble.com31

cipherssecurity.com29

tech-insider.org29

460 of the 460 domain citations in answers naming Recorded Future came from somebody else's page.

Pages cited

upguard.com/blog/best-threat-intelligence-platforms-and-vendors66

learn.g2.com/best-threat-intelligence-tools51

analyticsinsight.net/cybersecurity/best-threat-intelligence-platforms50

b2breviews.com/threat-intelligence-platforms50

esecurityplanet.com/products/threat-intelligence-platforms47

analyticsinsight.net/cybersecurity/10-best-threat-intelligence-platforms-in-202642

cyware.com/blog/top-threat-intelligence-platforms-and-solutions36

shadowdragon.io/resources/best-threat-intelligence-platforms32

Pages are listed as the models cited them.

Names read as Recorded Future

What the judge wrote, as written, with how often. The vendor table decides that these count as Recorded Future; a claim can dispute any of them.

Recorded Future (Community Edition) 1Recorded Future (Intelligence Cloud) 1

Is this your product?

Claim this page

Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Recorded Future's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Recorded Future, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.

It does not get any change to labels, shares or verdicts, any preview, or any say over which quotes appear. A verification link goes to your work email; an address at recordedfuture.com is approved on the spot, any other address is reviewed by hand.

Your name and company appear on the claimed page, or the company alone if you ask below. A title and a LinkedIn address appear there too if you give them, and are left off if you do not. Your email address is never published.