100 threat intelligence providers compared (2026)
This comparison scores 100 threat intelligence providers across five product categories (infostealer, third-party risk, phishing and brand protection, executive protection, attack surface management) and on the availability of API documentation. Provider websites were scanned on 3 November 2026 and API documentation on 4 November 2026; infostealer scores come from The Infostealer Index 2026.
- Published
- Scanned
- 3–4 November 2026
- Infostealer score source
- The Infostealer Index 2026, 12 October 2026
94.0Dark Radarranked 1st
Methodology
Provider selection
Providers were selected from three sources: 34 providers listed in The Infostealer Index 2026; 24 providers founded in Türkiye or with a Turkish founder; and 42 global providers selected from the top 40 most-reviewed vendors in Gartner Peer Insights’ threat intelligence and attack surface markets, together with participants in the Forrester Wave security ratings report (Q2 2024). Service companies without a product and products no longer commercially available were excluded.
Criteria and weights
Each component is scored from 0 to 10 and multiplied by its weight. The weighted values are added and multiplied by 10 to give an overall score out of 100. Components that cannot be measured are counted as 0.
| Component | Weight | Rationale |
|---|---|---|
| Infostealer | 42.1% | Infostealer data is one of the primary data sources for findings assessed in the other categories. |
| Third-party risk · Phishing and brand protection · Executive protection · Attack surface management | 13.2% each | The four categories carry equal weight and together make up 52.6% of the overall score. |
| API | 5.3% | Measures how the platform integrates with an organization’s existing systems. |
Infostealer score
Scores for the providers in the index were taken from The Infostealer Index 2026 (12 October 2026). Two of the index’s nine criteria were excluded: pricing accessibility, because price is not an indicator of infostealer capability, and API, which is scored separately for every provider. The weights of the remaining seven criteria were rescaled to a total of 100. The Dark Radar score comes from an assessment made against the same criteria.
| Criterion | Weight |
|---|---|
| Infostealer focus | 15% |
| Device-level infection details | 15% |
| Employee, customer and supplier segmentation | 12% |
| Session cookie and token coverage | 10% |
| Collection timeliness | 10% |
| Published research | 10% |
| Free access | 10% |
Category scoring
Third-party risk, phishing and brand protection, executive protection and attack surface management were each assessed against five capabilities. Each capability verifiable on a provider’s product pages is worth 2 points, up to 10 points per category. The source is the provider’s own website: on 3 November 2026 the homepage and up to 12 product pages on the same domain were reviewed, excluding the top navigation and footer.
| Category | Five capabilities assessed |
|---|---|
| Third-party risk | Supplier account exposure, supplier risk score, supplier portfolio, ransomware or breach involving a supplier, supplier attack surface |
| Phishing and brand protection | Lookalike domain, phishing website, fraudulent mobile application, social media impersonation account, takedown request |
| Executive protection | Executive account exposure, impersonation profile, personal information (address, phone), forums and dark web, takedown request |
| Attack surface management | Asset discovery, open ports and services, technology and version, vulnerability (CVE), SSL and DNS |
API
Public API documentation scores 10 points, documentation behind a login or contract 5 points, and documentation not found on the website or in search results 0 points (4 November 2026).
Components that could not be measured
The KELA and CloudSEK websites could not be accessed during automated scanning; their category scores are shown as “–” and counted as 0 in the overall score. Infostealer criteria could not be measured for the 65 providers outside the index; their infostealer score is shown as “–” and counted as 0 in the overall score.
Comparison table
The table is sorted by overall score. The category buttons re-sort it by the selected category’s score; providers with equal scores share the same rank. Ranks are given among the providers that could be measured in that category.
| Rank | Provider | Country | Overall | Infostealer | Third-party | Phishing | Executive | Attack surface | API |
|---|---|---|---|---|---|---|---|---|---|
| 1 | Dark Radar | Türkiye | 94.0 | 98.2 | 9 | 9 | 9 | 9 | 10 |
| 2 | Bitsight (Cybersixgill) | United States | 72.3 | 46.7 | 10 | 10 | 8 | 8 | 10 |
| 3 | NordStellar | Lithuania | 69.9 | 66.1 | 0 | 10 | 10 | 8 | 10 |
| 4 | Flare | Canada | 65.8 | 81.2 | 4 | 8 | 8 | 0 | 10 |
| 5 | Cyble | United States | 64.8 | 47.7 | 4 | 10 | 10 | 8 | 5 |
| 6 | Recorded Future | United States | 63.3 | 69.0 | 10 | 6 | 0 | 6 | 10 |
| 7 | SOCRadar | United States | 63.1 | 71.7 | 5 | 5 | 8 | 5 | 5 |
| 8 | Check Point (Cyberint) | Israel | 58.8 | 52.1 | 8 | 10 | 0 | 8 | 5 |
| 9 | ThreatMon | Türkiye | 55.9 | 39.0 | 6 | 10 | 8 | 4 | 5 |
| 10 | SpyCloud | United States | 53.5 | 83.3 | 6 | 0 | 4 | 0 | 10 |
| 11 | Constella Intelligence | United States | 52.8 | 69.1 | 0 | 10 | 6 | 0 | 5 |
| 12 | Breachsense | United States | 52.7 | 69.0 | 4 | 8 | 0 | 2 | 10 |
| 13 | Flashpoint | United States | 50.2 | 63.0 | 0 | 10 | 2 | 4 | 5 |
| 14 | Brandefense | Türkiye | 50.0 | – | 8 | 10 | 10 | 8 | 5 |
| 14 | Deepinfo | Türkiye | 50.0 | – | 8 | 10 | 8 | 8 | 10 |
| 16 | Hudson Rock | Israel | 49.0 | 97.6 | 2 | 0 | 0 | 0 | 10 |
| 17 | WhiteIntel | Türkiye | 45.4 | 57.9 | 6 | 6 | 0 | 0 | 10 |
| 18 | ImmuniWeb | Switzerland | 44.7 | – | 10 | 8 | 2 | 10 | 10 |
| 18 | Styx Intelligence | Canada | 44.7 | – | 8 | 10 | 10 | 6 | 0 |
| 20 | CybelAngel | France | 44.6 | 49.6 | 0 | 10 | 0 | 4 | 10 |
| 21 | CTM360 | Bahrain | 42.1 | – | 8 | 10 | 4 | 8 | 5 |
| 22 | Outpost24 Threat Compass | Sweden | 39.7 | 50.6 | 0 | 6 | 0 | 6 | 5 |
| 23 | ZeroFox | United States | 39.5 | – | 8 | 4 | 10 | 6 | 5 |
| 23 | Axur | Brazil | 39.5 | – | 0 | 10 | 8 | 10 | 5 |
| 25 | Lunar (Webz.io) | Israel | 37.8 | 71.0 | 0 | 0 | 2 | 0 | 10 |
| 26 | RiskProfiler | United States | 36.8 | – | 8 | 8 | 2 | 10 | 0 |
| 26 | UpGuard | United States | 36.8 | – | 6 | 10 | 0 | 8 | 10 |
| 28 | Group-IB | Singapore | 36.6 | 49.4 | 0 | 8 | 0 | 2 | 5 |
| 29 | DarkStrata | United Kingdom | 34.5 | 44.5 | 0 | 0 | 8 | 0 | 10 |
| 30 | ThreatBook | China | 34.2 | – | 2 | 10 | 0 | 10 | 10 |
| 31 | Resecurity | United States | 33.1 | 34.8 | 0 | 8 | 2 | 2 | 5 |
| 32 | KELA | Israel | 31.7 | 69.0 | – | – | – | – | 5 |
| 33 | Black Kite | United States | 31.6 | – | 10 | 2 | 0 | 10 | 5 |
| 33 | Panorays | United States | 31.6 | – | 8 | 2 | 0 | 10 | 10 |
| 33 | Foresiet | India | 31.6 | – | 8 | 8 | 2 | 6 | 0 |
| 36 | Searchlight Cyber | United Kingdom | 29.8 | 45.7 | 2 | 0 | 0 | 4 | 5 |
| 37 | ECHO | Türkiye | 28.9 | – | 2 | 10 | 4 | 4 | 5 |
| 37 | SecurityScorecard | United States | 28.9 | – | 8 | 4 | 0 | 6 | 10 |
| 39 | DarkOwl | United States | 26.7 | 38.3 | 2 | 0 | 2 | 0 | 10 |
| 40 | TechOwl Shield | India | 26.3 | – | 0 | 8 | 4 | 8 | 0 |
| 40 | ScruteX (BrandSek) | Australia | 26.3 | – | 2 | 6 | 0 | 8 | 10 |
| 42 | Have I Been Pwned | Australia | 24.7 | 46.2 | 0 | 0 | 0 | 0 | 10 |
| 43 | CloudSEK | India | 24.0 | 44.5 | – | – | – | – | 10 |
| 44 | ThingsRecon | Netherlands | 23.7 | – | 8 | 2 | 0 | 8 | 0 |
| 45 | LeakRadar | France | 22.1 | 40.1 | 0 | 0 | 0 | 0 | 10 |
| 46 | StealthMole | Singapore | 22.0 | 45.9 | 0 | 0 | 0 | 0 | 5 |
| 47 | IntelRadar | Türkiye | 21.1 | – | 0 | 6 | 0 | 10 | 0 |
| 47 | Palo Alto Networks (Xpanse) | United States | 21.1 | – | 4 | 0 | 0 | 8 | 10 |
| 47 | Darkivore (Potech) | Lebanon | 21.1 | – | 0 | 10 | 2 | 4 | 0 |
| 47 | IONIX | Israel | 21.1 | – | 2 | 2 | 0 | 10 | 5 |
| 47 | Censys | United States | 21.1 | – | 2 | 2 | 0 | 8 | 10 |
| 47 | Criminal IP (AI Spera) | South Korea | 21.1 | – | 4 | 2 | 0 | 8 | 5 |
| 47 | Aquila I | India | 21.1 | – | 4 | 4 | 0 | 8 | 0 |
| 47 | Orpheus Cyber | United Kingdom | 21.1 | – | 6 | 0 | 0 | 10 | 0 |
| 47 | FireCompass | United States | 21.1 | – | 8 | 0 | 0 | 8 | 0 |
| 56 | HackedList | Czechia | 20.4 | 35.9 | 0 | 0 | 0 | 0 | 10 |
| 57 | Intelligence X | Czechia | 19.8 | 34.6 | 0 | 0 | 0 | 0 | 10 |
| 58 | Farnsworth Intelligence | United States | 19.4 | 46.0 | 0 | 0 | 0 | 0 | 0 |
| 59 | SwordSec | Türkiye | 18.4 | – | 0 | 8 | 0 | 6 | 0 |
| 59 | S4E | Türkiye | 18.4 | – | 0 | 2 | 0 | 8 | 10 |
| 59 | Microsoft | United States | 18.4 | – | 4 | 2 | 0 | 4 | 10 |
| 59 | CyCognito | United States | 18.4 | – | 2 | 0 | 0 | 10 | 5 |
| 59 | Intruder | United Kingdom | 18.4 | – | 0 | 0 | 0 | 10 | 10 |
| 59 | Hadrian | Netherlands | 18.4 | – | 2 | 0 | 0 | 10 | 5 |
| 59 | Detectify | Sweden | 18.4 | – | 0 | 0 | 0 | 10 | 10 |
| 66 | LeakCheck | United Kingdom | 16.9 | 27.7 | 0 | 0 | 0 | 0 | 10 |
| 67 | SOS Intelligence | United Kingdom | 16.4 | 32.8 | 0 | 0 | 0 | 0 | 5 |
| 67 | Hold Security | United States | 16.4 | 39.0 | 0 | 0 | 0 | 0 | 0 |
| 69 | TrySec | Türkiye | 15.8 | – | 0 | 4 | 0 | 8 | 0 |
| 69 | ReliaQuest | United States | 15.8 | – | 2 | 2 | 0 | 4 | 10 |
| 69 | CYFIRMA | Singapore | 15.8 | – | 0 | 6 | 0 | 4 | 5 |
| 69 | Feedly | United States | 15.8 | – | 2 | 2 | 0 | 4 | 10 |
| 69 | Halo Security | United States | 15.8 | – | 4 | 2 | 0 | 4 | 5 |
| 69 | watchTowr | Singapore | 15.8 | – | 4 | 2 | 0 | 4 | 5 |
| 69 | Zynap | Spain | 15.8 | – | 2 | 2 | 0 | 6 | 5 |
| 76 | Kaduu | Switzerland | 13.9 | 26.7 | 0 | 0 | 0 | 0 | 5 |
| 77 | VulnHero | Türkiye | 13.2 | – | 0 | 0 | 0 | 10 | 0 |
| 77 | PRODAFT | Switzerland | 13.2 | – | 4 | 4 | 0 | 2 | 0 |
| 77 | CrowdStrike | United States | 13.2 | – | 4 | 0 | 0 | 4 | 5 |
| 77 | QuoIntelligence | Germany | 13.2 | – | 2 | 4 | 0 | 4 | 0 |
| 77 | Intel 471 | United States | 13.2 | – | 6 | 0 | 0 | 2 | 5 |
| 82 | Seccops (CyberThint) | Türkiye | 10.5 | – | 0 | 4 | 0 | 4 | 0 |
| 82 | Barikat | Türkiye | 10.5 | – | 2 | 2 | 0 | 4 | 0 |
| 82 | OctoXLabs | Türkiye | 10.5 | – | 0 | 0 | 0 | 4 | 10 |
| 82 | Google (Mandiant) | United States | 10.5 | – | 2 | 0 | 0 | 2 | 10 |
| 82 | Cognyte | Israel | 10.5 | – | 0 | 2 | 2 | 4 | 0 |
| 82 | Silobreaker | United Kingdom | 10.5 | – | 4 | 0 | 0 | 2 | 5 |
| 82 | Element Security | Israel | 10.5 | – | 0 | 0 | 0 | 8 | 0 |
| 82 | WithSecure | Finland | 10.5 | – | 0 | 2 | 0 | 2 | 10 |
| 82 | Prevalent (Mitratech) | United States | 10.5 | – | 4 | 0 | 0 | 2 | 5 |
| 91 | CenterOnDigital | Türkiye | 7.9 | – | 0 | 2 | 0 | 4 | 0 |
| 91 | Cylana | Türkiye | 7.9 | – | 0 | 2 | 0 | 4 | 0 |
| 91 | CatchProbe | United States | 7.9 | – | 0 | 2 | 0 | 2 | 5 |
| 94 | Secrove | Türkiye | 5.3 | – | 0 | 0 | 0 | 4 | 0 |
| 94 | Nebula | Türkiye | 5.3 | – | 0 | 0 | 0 | 4 | 0 |
| 94 | C-Prot | Türkiye | 5.3 | – | 0 | 0 | 0 | 4 | 0 |
| 94 | Cyberwise | Türkiye | 5.3 | – | 0 | 0 | 0 | 4 | 0 |
| 98 | LastGuard | Türkiye | 2.6 | – | 0 | 0 | 0 | 2 | 0 |
| 98 | Secunnix | Türkiye | 2.6 | – | 0 | 0 | 0 | 2 | 0 |
| 98 | SOBE | Türkiye | 2.6 | – | 0 | 0 | 0 | 2 | 0 |
Infostealer
Infostealer scores were calculated for 35 providers: the 34 providers in the index and Dark Radar. Dark Radar has the highest score (98.2), followed by Hudson Rock (97.6). The score is the weighted total of seven criteria and makes up 42.1% of the overall score.
- 1Dark Radar98.2 / 100
- 2Hudson Rock97.6 / 100
- 3SpyCloud83.3 / 100
- 4Flare81.2 / 100
- 5SOCRadar71.7 / 100
- 6Lunar (Webz.io)71.0 / 100
- 7Constella Intelligence69.1 / 100
- 8Recorded Future69.0 / 100
- 8Breachsense69.0 / 100
- 8KELA69.0 / 100
Third-party risk
98 providers were measured in this category; 53 scored with at least one capability and 4 scored 10 with all five. Capabilities assessed: Supplier account exposure, supplier risk score, supplier portfolio, ransomware or breach involving a supplier, supplier attack surface. The category carries 13.2% of the overall score.
- 1Bitsight (Cybersixgill)10 / 10
- 1Recorded Future10 / 10
- 1ImmuniWeb10 / 10
- 1Black Kite10 / 10
- 5Dark Radar9 / 10
- 6Check Point (Cyberint)8 / 10
- 6Brandefense8 / 10
- 6Deepinfo8 / 10
- 6Styx Intelligence8 / 10
- 6CTM3608 / 10
Phishing and brand protection
98 providers were measured in this category; 60 scored with at least one capability and 17 scored 10 with all five. Capabilities assessed: Lookalike domain, phishing website, fraudulent mobile application, social media impersonation account, takedown request. The category carries 13.2% of the overall score.
- 1Bitsight (Cybersixgill)10 / 10
- 1NordStellar10 / 10
- 1Cyble10 / 10
- 1Check Point (Cyberint)10 / 10
- 1ThreatMon10 / 10
- 1Constella Intelligence10 / 10
- 1Flashpoint10 / 10
- 1Brandefense10 / 10
- 1Deepinfo10 / 10
- 1Styx Intelligence10 / 10
Executive protection
98 providers were measured in this category; 27 scored with at least one capability and 5 scored 10 with all five. Capabilities assessed: Executive account exposure, impersonation profile, personal information (address, phone), forums and dark web, takedown request. The category carries 13.2% of the overall score.
- 1NordStellar10 / 10
- 1Cyble10 / 10
- 1Brandefense10 / 10
- 1Styx Intelligence10 / 10
- 1ZeroFox10 / 10
- 6Dark Radar9 / 10
- 7Bitsight (Cybersixgill)8 / 10
- 7Flare8 / 10
- 7SOCRadar8 / 10
- 7ThreatMon8 / 10
Attack surface management
98 providers were measured in this category; 80 scored with at least one capability and 14 scored 10 with all five. Capabilities assessed: Asset discovery, open ports and services, technology and version, vulnerability (CVE), SSL and DNS. The category carries 13.2% of the overall score.
- 1ImmuniWeb10 / 10
- 1Axur10 / 10
- 1RiskProfiler10 / 10
- 1ThreatBook10 / 10
- 1Black Kite10 / 10
- 1Panorays10 / 10
- 1IntelRadar10 / 10
- 1IONIX10 / 10
- 1Orpheus Cyber10 / 10
- 1CyCognito10 / 10
Limitations
- Capabilities not identified
- A capability that does not appear on the source pages is not confirmation that the provider lacks it; it only shows that the capability was not identified on the pages reviewed on 3 November 2026.
- Evidence from product pages
- Category scores are based on information the providers publish on their own websites; the actual scope of the products was not verified through trials or sales discussions. For larger providers, a scan limited to 12 pages may not cover the whole product range, which can result in a lower score than the provider’s actual capabilities warrant.
- Unmeasured components
- Infostealer scores for providers outside the index count as 0 in the overall score, which can lower the overall rank of providers that do not focus on infostealers. The KELA and CloudSEK websites could not be scanned, and only limited content was available for Element Security and ScruteX.
- Weights
- The weights are a methodological choice of this research; different weights produce a different ranking. The category buttons in the table show each category’s own ranking.
- Country information
- Country refers to where the company is headquartered. Country records with a single source were not verified against company registries.
- Date
- Websites were scanned on 3 November 2026 and API documentation on 4 November 2026. Providers’ websites and product coverage may have changed since.
Frequently asked questions
How many providers are compared, and how were they selected?
100 providers: 34 listed in The Infostealer Index 2026, 24 founded in Türkiye or with a Turkish founder, and 42 global providers from the Gartner Peer Insights and Forrester Wave lists.
Which provider has the highest overall score?
Dark Radar ranks first (94.0) and Bitsight (Cybersixgill) second (72.3). The overall score is the weighted total of the infostealer (42.1%), four product category (13.2% each) and API (5.3%) scores.
Which provider has the highest infostealer score?
Dark Radar ranks first with 98.2. Infostealer scores were calculated for 35 providers; the others are not listed in the index.
How many providers have public API documentation?
37 providers have public API documentation. For 33 providers the documentation is behind a login or contract; for 30 no API documentation was found on the website or in search results.
Does any provider score in all five categories?
5 providers scored in all five categories: Dark Radar, Bitsight (Cybersixgill), Cyble, SOCRadar and ThreatMon.
Which countries are the providers from?
The providers are headquartered in 22 countries. The most represented are United States (31), Türkiye (23) and Israel (7).
Does a score of 0 mean the provider lacks the capability?
No. A score of 0 means the capability was not identified on the product pages reviewed on 3 November 2026. “–” means the component could not be measured: the website could not be scanned, or the provider is not listed in the index.
Sources
Infostealer criteria and scores for the providers in the index: The Infostealer Index 2026 (hudsonrock.com/infostealer-index, 12 October 2026). Websites scanned for the category and API scores:
- Aquila I: aquilai.io
- Axur: axur.com
- Barikat: barikat.com.tr
- Bitsight (Cybersixgill): bitsight.com
- Black Kite: blackkite.com
- Brandefense: brandefense.io
- Breachsense: breachsense.com
- C-Prot: c-prot.com
- CatchProbe: catchprobe.com
- Censys: censys.com
- CenterOnDigital: centerondigital.com
- Check Point (Cyberint): cyberint.com
- CloudSEK: cloudsek.com
- Cognyte: cognyte.com
- Constella Intelligence: constella.ai
- Criminal IP (AI Spera): criminalip.io
- CrowdStrike: crowdstrike.com
- CTM360: ctm360.com
- CybelAngel: cybelangel.com
- Cyberwise: cyberwise.com
- Cyble: cyble.com
- CyCognito: cycognito.com
- CYFIRMA: cyfirma.com
- Cylana: cylana.io
- Dark Radar: darkradar.com
- Darkivore (Potech): potech.global/darkivore
- DarkOwl: darkowl.com
- DarkStrata: darkstrata.io
- Deepinfo: deepinfo.com
- Detectify: detectify.com
- ECHO: echocti.com
- Element Security: element.security
- Farnsworth Intelligence: farnsworthintelligence.com
- Feedly: feedly.com/threat-intelligence
- FireCompass: firecompass.com
- Flare: flare.io
- Flashpoint: flashpoint.io
- Foresiet: foresiet.com
- Google (Mandiant): cloud.google.com/security/products/threat-intelligence
- Group-IB: group-ib.com
- HackedList: hackedlist.io
- Hadrian: hadrian.io
- Halo Security: halosecurity.com
- Have I Been Pwned: haveibeenpwned.com
- Hold Security: holdsecurity.com
- Hudson Rock: hudsonrock.com
- ImmuniWeb: immuniweb.com
- Intel 471: intel471.com
- Intelligence X: intelx.io
- IntelRadar: intelradar.io
- Intruder: intruder.io
- IONIX: ionix.io
- Kaduu: kaduu.io
- KELA: kelacyber.com
- LastGuard: lastguardsecurity.com
- LeakCheck: leakcheck.io
- LeakRadar: leakradar.io
- Lunar (Webz.io): webz.io
- Microsoft: Microsoft Defender EASM page
- Nebula: nebulabilisim.com.tr
- NordStellar: nordstellar.com
- OctoXLabs: octoxlabs.com
- Orpheus Cyber: orpheus-cyber.com
- Outpost24 Threat Compass: outpost24.com
- Palo Alto Networks (Xpanse): paloaltonetworks.com/cortex/cortex-xpanse
- Panorays: panorays.com
- Prevalent (Mitratech): mitratech.com/products/prevalent
- PRODAFT: prodaft.com
- QuoIntelligence: quointelligence.eu
- Recorded Future: recordedfuture.com
- ReliaQuest: reliaquest.com
- Resecurity: resecurity.com
- RiskProfiler: riskprofiler.io
- S4E: s4e.io
- ScruteX (BrandSek): scrutex.ai
- Searchlight Cyber: slcyber.io
- Seccops (CyberThint): seccops.com
- Secrove: secrove.com
- Secunnix: scnx.com
- SecurityScorecard: securityscorecard.com
- Silobreaker: silobreaker.com
- SOBE: sobesoftware.com
- SOCRadar: socradar.io
- SOS Intelligence: sosintel.co.uk
- SpyCloud: spycloud.com
- StealthMole: stealthmole.com
- Styx Intelligence: styxintel.com
- SwordSec: swordsec.com
- TechOwl Shield: techowlshield.com
- ThingsRecon: thingsrecon.com
- ThreatBook: threatbook.io
- ThreatMon: threatmon.io
- TrySec: trysec.com
- UpGuard: upguard.com
- VulnHero: vulnhero.com
- watchTowr: watchtowr.com
- WhiteIntel: whiteintel.io
- WithSecure: withsecure.com
- ZeroFox: zerofox.com
- Zynap: zynap.com
This comparison was prepared through web scanning and source review carried out with Claude Opus 5.5.