[Home](https://cybersectools.com/) / [Categories](https://cybersectools.com/categories) / [Threat Intelligence](https://cybersectools.com/categories/threat-intelligence) / Threat Intel Feeds

# Threat Intel Feeds Solutions 2026

Threat intel feeds are the raw and finished intelligence streams that tell your team what attackers are doing, who they are targeting, and which indicators to watch. The range runs from machine-readable IOC feeds of IPs, domains, hashes, and malicious URLs through curated threat actor reporting, dark web and cybercrime monitoring, and vulnerability intelligence. Security teams use these streams to enrich detections in the SIEM or SOAR, reorder patching, hunt proactively, and brief leadership on threats that actually matter to their sector. At one end you have broad commodity coverage. At the other, finished reporting tailored to your industry and the specific adversaries that target it.

54 commercial products · [What is Threat Intel Feeds?](https://cybersectools.com/glossary/threat-intel-feeds)

## Featured on CybersecTools

Paid placement: Featured vendors pay for a plan and show first. The shortlist positions are earned. [How we label paid slots](https://cybersectools.com/methodology)

- [Strike48 Platform](https://www.strike48.com/platform?utm_source=cybersectools.com&utm_medium=featured) (Featured): Security Operations
- [SecureIntent](https://secureintent.ai/?utm_source=cybersectools.com&utm_medium=featured) (Featured): Data Protection
- [Fortra](https://www.fortra.com/?utm_source=cybersectools.com&utm_medium=featured) (Featured): Data Protection
- [Lunar](https://lunarcyber.com/?utm_source=cybersectools.com&utm_medium=featured) (Featured): Threat Intelligence
- [Hudson Rock](https://www.hudsonrock.com/?utm_source=cybersectools.com&utm_medium=featured) (Featured): Threat Intelligence
- [Daylight Security](https://daylight.ai/?utm_source=cybersectools.com&utm_medium=featured) (Featured): Security Operations

## Compare in Threat Intel Feeds

The most-opened side-by-side pages for Threat Intel Feeds solutions.

- [MaxMind GeoIP Insights vs MaxMind IP Geolocation API](https://cybersectools.com/compare/maxmind-geoip-insights-vs-maxmind-ip-geolocation-api)
- [Abusix Threat Intelligence vs alphaMountain URL Classification](https://cybersectools.com/compare/abusix-threat-intelligence-vs-alphamountain-url-classification)
- [IPQS IP Address Abuse Feed vs MaxMind GeoIP Insights](https://cybersectools.com/compare/ipqs-ip-address-abuse-feed-vs-maxmind-geoip-insights)
- [Bitdefender Operational Threat Intelligence vs Mobile Threat Intelligence](https://cybersectools.com/compare/bitdefender-operational-threat-intelligence-vs-lookout-mobile-threat-intelligence)
- [Ivanti Neurons for Vulnerability Knowledge Base vs Picus Threat Library](https://cybersectools.com/compare/picus-threat-library-vs-ivanti-neurons-for-vulnerability-knowledge-base)
- [Broadsheet vs Previdian](https://cybersectools.com/compare/previdian-vs-broadsheet)

## The Threat Intelligence market

Company data as of 2026-11-05

- 166 companies sell in this market
- $1.0B raised in 23 rounds in the last 12 months
- 5 acquired in the last 12 months
- 17 founded in the last two years

[Explore the Threat Intelligence market on Mandos](https://mandos.io/data/companies?utm_source=cybersectools.com&utm_medium=category&utm_campaign=threat-intelligence)

## Threat Intel Feeds solutions

All 101 · Free 47 · Commercial 54

1. [Webz.io](https://cybersectools.com/tools/webzio) (Featured · Threat Intel Feeds): Web data platform providing open, deep & dark web APIs and monitoring.
2. [defend.network](https://cybersectools.com/tools/defendnetwork) (Threat Intel Feeds · Free): Free daily cyber threat briefings and CVE tracking, verified against NVD and CISA KEV.
3. [Broadsheet](https://cybersectools.com/tools/broadsheet) (Threat Intel Feeds): Vulnerability intel service tracking CVEs for your specific vendor/product stack.
4. [Mobile Threat Intelligence](https://cybersectools.com/tools/lookout-mobile-threat-intelligence) (Threat Intel Feeds): Mobile-focused threat intel covering apps, devices, URLs, APTs, and malware.
5. [BadBot Gateway](https://cybersectools.com/tools/badbot-gateway) (Threat Intel Feeds · Free): IP reputation lookup service with scored indicators and community reports.
6. [SecurityTrails API™](https://cybersectools.com/tools/securitytrails-apitm) (Threat Intel Feeds): API providing historical & current DNS, WHOIS, and domain intelligence data.
7. [PhishTank](https://cybersectools.com/tools/phishtank) (Threat Intel Feeds · Free): Community-driven phishing URL archive operated by Cisco Talos.
8. [OpenAVN Data](https://cybersectools.com/tools/openavn-data) (Threat Intel Feeds): Digital threat intel platform with 300TB+ of malware data, AI analytics & forecasting.
9. [Constella Threat Intelligence Data Signals API](https://cybersectools.com/tools/constella-threat-intelligence-data-signals-api) (Threat Intel Feeds): API providing access to compromised identity data and threat signals
10. [Cisco Umbrella Popularity List](https://cybersectools.com/tools/cisco-umbrella-popularity-list) (Threat Intel Feeds · Free): A list of most queried domains based on passive DNS usage across the Umbrella global network.
11. [Binary Defense IP Banlist](https://cybersectools.com/tools/binary-defense-ip-banlist) (Threat Intel Feeds · Free): A free threat intelligence feed and banlist feed of known malicious IP addresses for public use only.
12. [abuse.ch](https://cybersectools.com/tools/abusech) (Threat Intel Feeds · Free): Platform providing community-driven threat intelligence on cyber threats with a focus on malware and botnets.
13. [CI Army List](https://cybersectools.com/tools/ci-army-list) (Threat Intel Feeds · Free): A comprehensive list of IP addresses for cybersecurity purposes, including threat intelligence, incident response, and security research.
14. [botvrij.eu](https://cybersectools.com/tools/botvrijeu) (Threat Intel Feeds · Free): Freely available network IOCs for monitoring and incident response
15. [CyberCure Advanced Cyber Threat Intelligence](https://cybersectools.com/tools/cybercure-advanced-cyber-threat-intelligence) (Threat Intel Feeds · Free): Free cyber threat intelligence feeds for proactive threat detection
16. [Zero Day Initiative Published Advisories](https://cybersectools.com/tools/zero-day-initiative-published-advisories) (Threat Intel Feeds · Free): List of publicly disclosed vulnerabilities with security filters and detailed advisories.
17. [Previdian](https://cybersectools.com/tools/previdian) (Threat Intel Feeds): Early-warning feed of exploited CVEs with sensor evidence, compared against CISA KEV.
18. [Netacea Threat Intel Center](https://cybersectools.com/tools/netacea-threat-intel-center) (Threat Intel Feeds)
19. [Vultara Threat Intelligence](https://cybersectools.com/tools/vultara-threat-intelligence) (Threat Intel Feeds): Automotive-focused threat intelligence service producing ISO/SAE 21434 compliant
20. [Scarlet Shark Intel Lists](https://cybersectools.com/tools/scarlet-shark-intel-lists) (Threat Intel Feeds · Free)
21. [Q-Feeds OPNsense Integration](https://cybersectools.com/tools/q-feeds-opnsense-integration) (Threat Intel Feeds · Free): Plugin that feeds curated threat intel as firewall aliases into OPNsense
22. [Packet Forensics Cyber Intelligence](https://cybersectools.com/tools/packet-forensics-cyber-intelligence) (Threat Intel Feeds): Commercial threat intel service for enrichment, attribution
23. [NebuSec Vulnerability Index](https://cybersectools.com/tools/nebusec-vulnerability-index) (Threat Intel Feeds · Free): Public database of vulnerabilities and CVEs discovered by NebuSec's research team
24. [Cyberwatch Vulnerability Encyclopedia](https://cybersectools.com/tools/cyberwatch-vulnerability-encyclopedia) (Threat Intel Feeds): Searchable database of vulnerabilities, alerts, and attack kits

Page 1 of 5. Next: https://cybersectools.com/categories/threat-intel-feeds.md?page=2

54 commercial products · 47 free products under [Free solutions](https://cybersectools.com/free) | Related: [Threat Intel Platforms](https://cybersectools.com/categories/tip) · [Digital Risk Protection](https://cybersectools.com/categories/drp) · [Brand Protection](https://cybersectools.com/categories/brand-protection) · [Deepfake Detection](https://cybersectools.com/categories/deepfake-detection) · [APT Detection](https://cybersectools.com/categories/apt-detection)

## How to choose Threat Intel Feeds solutions

- Decide whether you need data or decisions. Machine-readable IOC feeds enrich solutions. Finished intelligence helps humans prioritize. Buying the wrong type is the most common mistake.
- Check relevance to your sector and geography. A feed weighted toward threats to your industry and the regions you operate in beats a larger but generic one.
- Scrutinize freshness and false-positive rate. Stale indicators and noisy data create alert fatigue and erode trust in the feed faster than anything else.
- Confirm it integrates with your stack. Look for STIX/TAXII support and native connectors into your SIEM, SOAR, or threat intelligence platform so the feed actually drives action.
- Assess dark web and cybercrime coverage if that is your threat model. Underground forum access, leaked credential monitoring, and ransomware tracking require specialized sourcing and language coverage.
- Match the feed to your team's capacity. A rich finished-intelligence service is wasted if no analyst reads it, and a firehose of raw indicators needs a platform and process to be useful.

## Threat Intel Feeds Solutions FAQ

Common questions about Threat Intel Feeds solutions: how to choose, pricing and comparisons.

### What is a threat intel feed?

A threat intel feed is a continuously updated stream of data about threats, delivered to your security stack. At one end you have machine-readable indicators, malicious IPs, domains, file hashes, and URLs that enrich detection and blocking. At the other end you have finished intelligence: analyst-written reports on threat actors, campaigns, and dark web chatter that humans read to make decisions.

### How do I choose a threat intel feed?

Start with the outcome you need. To enrich detections, prioritize feed coverage, indicator freshness, false-positive rate, and STIX/TAXII integration with your SIEM. For strategic context, prioritize analyst quality, sector relevance, and language coverage for the regions and underground forums where your adversaries operate. Match the feed to your maturity, not the vendor's pitch.

### What is the difference between a threat intel feed and a threat intelligence platform?

A feed is a source of data. A threat intelligence platform (TIP) is where you aggregate, deduplicate, score, and operationalize feeds from many sources. Feeds are an input. A TIP is the management layer that turns multiple inputs into something your SOC can act on. Many teams run several feeds into one platform rather than relying on a single source.

### Are free threat intel feeds good enough?

Free and open-source feeds, abuse trackers, OSINT lists, and community sources, are genuinely useful for baseline blocking and enrichment, and many mature teams use them alongside paid sources. Their limits show up in freshness, context, false positives, and the absence of finished analysis. Commercial feeds earn their cost through curation, sector-specific reporting, dark web access, and lower noise. Most programs blend both.

### How do threat intel feeds help with vulnerability management?

Vulnerability intelligence is the bridge. Knowing a CVE exists is one thing. Knowing it is being actively exploited by an actor that targets your industry is what changes your patching order. Feeds drive that decision, along with detection engineering, threat hunting, and the briefings you give leadership. They turn a generic risk list into a prioritized, evidence-backed plan.

---

Source: https://cybersectools.com/categories/threat-intel-feeds

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md.

More on the Threat Intel Feeds vendors: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=category-md