About threatintelagents.com

Why this site exists

Cyber threat intelligence is one of the security categories where vendor marketing pages and analyst-firm paywalls do the most damage to buyer reality. Recorded Future, Mandiant, CrowdStrike, Flashpoint, Intel 471, and Anomali all publish capability copy that reads as roughly equivalent. None publish list pricing. Few publish honest verdicts on where they are weak. Mid-market SOC managers and MSSP procurement leads end up spending six-figure budgets on platforms that look the same in a demo and feel very different in a year-two renewal.

This site is the reference we needed when we were sizing CTI investment for SOC engineering work: real pricing ranges triangulated from buyer-side procurement data, honest reads on the agentic SOC architecture beyond vendor manifestos, and a working open-source alternative for teams that cannot justify the six-figure commercial spend. The audience is CTI analysts, SOC managers, MSSP procurement leads, security engineers evaluating buildout, and CISOs running the procurement decision-tree.

Who runs this

Threat Intel Agents is published by Digital Signet, a UK-based research and engineering consultancy run by Oliver Wakefield-Smith. We publish independent decision-support sites across security and engineering cost categories. digitalsignet.com is the parent brand.

Sister sites that overlap with this surface: mdrcost.com (managed detection and response cost benchmarks), edrcost.com (endpoint detection), xdrcost.com (extended detection), iso27001cost.com (ISO 27001 compliance cost), and pentestcost.com (penetration test pricing). All are independent of vendor sales and are not lead-generation funnels.

Editorial independence

We are not a reseller. We are not a consultancy lead-generation funnel. We do not run sponsored content. We do not accept vendor-provided guest posts. Our comparison pages on Recorded Future, Mandiant, and CrowdStrike include explicit "skip if" sections naming the buyer profiles for whom the platform is the wrong fit.

Affiliate relationships exist where we participate in publisher programmes (currently DomainTools via the Impact network, Hetzner via referral). Where an affiliate link appears on a page, it is disclosed inline at the top of the page. Affiliate revenue does not influence ranking, verdicts, pricing data, or "buy / skip" recommendations. We have actively declined affiliate participation from vendors where we have publicly negative verdicts.

How pricing is sourced

Where vendors publish list pricing (CrowdStrike Falcon per-device tiers, AWS Marketplace listings), we use it directly and link to the manufacturer page. Where vendors refuse to publish list pricing (the majority of enterprise CTI), we triangulate ranges from four independent source types: Vendr buyer-side procurement data, Gartner Peer Insights reviewer comments referencing specific contract sizes, AWS Marketplace private-offer historical data, and Gov.UK G-Cloud framework contract listings. Ranges are presented as ranges, not single point estimates, because real contract pricing varies significantly by sector, analyst seat count, and module selection.

We do not publish pricing we cannot corroborate to at least two independent sources. We do not accept vendor-provided ROI figures without independent corroboration. See the methodology page for the full sourcing protocol.

What this site covers

Fifteen reference pages spanning vendor comparisons, workflow guides, the open-source stack, and a working ROI calculator. The sub-page index:

• Vendor reviews: Recorded Future, Mandiant, CrowdStrike
• Workflow: IoC enrichment, SIEM correlation, phishing infrastructure, dark-web monitoring, vuln prioritisation
• Buildout: agentic SOC, MSSP stack, open-source toolchain
• Decision support: ROI calculator, glossary, FAQ

Affiliate disclosure

Threat Intel Agents participates in affiliate programmes. When you click a product link and make a purchase, we may receive a commission at no additional cost to you. Pages with affiliate relationships disclose the disclosure inline (look for the "affiliate disclosure" note near the relevant links). Current affiliate relationships:

• DomainTools (via Impact affiliate network)
• Hetzner (referral programme)

These relationships do not influence editorial verdicts. We recommend products we believe are genuinely good for specific use cases, and we note where they are not the right choice.

Updates and contact

We refresh pricing and capability claims on a monthly cadence. The "Last verified" stamp on each page is sourced from a single constant so the freshness signal updates uniformly across the site. Where vendors announce significant changes (price moves, rebrands, GA launches), we update out-of-cycle and add a correction note.

For corrections, data disputes, or vendor commentary on coverage, email editorial@threatintelagents.com. We welcome vendor corrections on factual errors and will update pages with a dated correction note.

Technical disclaimer

All CTI tool verdicts are based on publicly available information, documentation, and community reporting as of the verified date. Security tooling capabilities change rapidly. A verdict published one quarter may be outdated the next. Always verify current capabilities directly with the vendor before a procurement decision. The ROI calculator produces estimates based on documented assumptions. Real costs depend on negotiated contract terms, existing vendor relationships, and implementation complexity.