Report:

The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2023

Top Vendor Products for External Threat Intelligence Service Providers in 2023

• CrowdStrike
• Google
• Recorded Future

External Threat Intelligence Service Providers Vendor Product Comparisons 2023

• CrowdStrike - Leaders
  

  Pros:

  • World-class threat intelligence integrated into Falcon platform
  • Finely crafted human-written reports with extensive adversary library
  • Operational efficiencies delivered through the Falcon platform
  • Supplements traditional sources with telemetry from established Falcon Platform customer base
  • Lessons learned from 500-plus incident response engagements
  • Experience from Falcon OverWatch Threat Hunting teams
  • Tracks over 200 named nation-state, electronic crime, and hacktivist adversaries
  • Reference customers find endpoint telemetry compelling
  • Detailed TTPs in threat reports drive fruitful threat-hunting exercises
  • Comprehensive solution even for non-EDR customers

  Cons:

  • Brand-protection threat intelligence needs more development
  • Does not offer services such as taking down fraudulent domains


• Google - Leaders
  

  Pros:

  • Combines Google capabilities with Mandiant acquisition
  • Comprehensive suite at a scale few can match
  • Leverages power, scale, and innovation of Google
  • Vast number of suspicious files processed by VirusTotal
  • Visibility from malicious activity across Google's product ecosystem
  • Over a thousand Mandiant breach response engagements annually
  • Reference customers very satisfied with portal experience
  • Interface is intuitive, easy to navigate, and user friendly
  • Google AI Security Workbench and PaLM integration planned
  • Vast internet visibility

  Cons:

  • Variety of solution options and pricing models can be complex
  • Relies on third-party services for rogue domain and profile takedowns
  • Digital risk protection suite released in 2022 still has room to grow


• Recorded Future - Leaders
  

  Pros:

  • Easy-to-use yet powerful threat intelligence solution
  • Extensive open source threat intelligence with over 10 billion entities in Intelligence Graph
  • Nine specific threat intelligence modules for specific use cases and personas
  • Allows customers to expand deployment as they mature
  • Free tools including browser extension, asset discovery tool, and daily newsletter with 1.5+ million subscribers
  • Reference customers believe open source threat intelligence is best in class
  • Multiple ways to provide feedback in portal
  • Benchmarking capabilities to compare with other customers
  • Intuitive, user-friendly platform

  Cons:

  • Requires additional licensing costs for needed use cases in other modules
  • Lacks breadth and depth of internal telemetry from proprietary technologies
  • Reference customers felt dark web threat intelligence wasn't at same level as open source
  • Most consistent complaint from references was about high price tag


• Flashpoint - Strong Performers
  

  Pros:

  • Excels in fraud and compromised credentials intelligence
  • Strong reputation and deep penetration in financial services industry
  • Excels at collecting information from underground and dark web sources
  • Four distinct modules for cyber, vulnerability, physical, and national security intelligence
  • Purchased Risk Based Security to strengthen vulnerability and data breach intelligence
  • Acquired Echosec to enhance OSINT capabilities
  • Published roadmap includes delivery confidence factor
  • Reference customers felt dark web threat intelligence was especially strong
  • Flexible pricing model with value-based bundles

  Cons:

  • Portal features and overall user experience need improvement
  • Reference customers wanted enhanced visualization, easier searching, and more intuitive navigation
  • Complex a la carte pricing model despite value-based bundles


• ReliaQuest - Strong Performers
  

  Pros:

  • Expanding already solid threat intelligence capabilities
  • Straightforward, simple pricing model
  • Prescriptive and thorough requirement-gathering process
  • Collecting telemetry from GreyMatter security operations platform
  • Portal interface simple to navigate with configurable options
  • Alert risk scoring based on FAIR model adjustable to customer risk appetite
  • Reference customers valued actionability of threat intelligence
  • Triage page specifically praised
  • Ideal for small to midsize security teams

  Cons:

  • Partner ecosystem not as expansive as other providers
  • EASM capabilities not as robust as rest of portfolio
  • Reference customers expressed concerns about missing specific local and regional sources outside Europe and America


• ZeroFox - Strong Performers
  

  Pros:

  • Best known for suite of digital risk protection
  • Analysts provide valuable disruption services
  • Collects substantial information from dark web
  • Extensive incident response services
  • Customer obsessed with active metric, feedback, and quality review initiatives
  • Disruption services team performs tens of thousands of actions per week
  • Domain takedown success rates in 95%-plus range
  • Reference customers very satisfied with brand protection capabilities
  • Social media monitoring highly praised
  • Alerts were timely

  Cons:

  • Lacks telemetry from proprietary technologies
  • Not as active in community beyond usual events or publishing free reports
  • Reference customers complained it took fair amount of time to reduce initial volume of false positives


• CybelAngel - Contenders
  

  Pros:

  • Small company that delivers high efficacy results
  • Rigorous keyword-matching and AI/ML curation process reduces false positives
  • Human analyst conducts final analysis
  • 25 dedicated threat analysts
  • Reference customers laud lack of false positives
  • Overall efficacy of alerts praised
  • Vision is inspiring and true to value proposition
  • Working to enhance EASM with live status feature

  Cons:

  • Two-thirds of customers based in EMEA - limited global presence
  • Portal more closely resembles ticketing system
  • Cannot perform full-blown ad hoc searches or general threat research
  • Pricing model requires estimating expected volume of detections
  • Partner ecosystem not as broad as other providers
  • Reference customers observed alerting frequency felt cyclical as opposed to real time


• Fortinet - Contenders
  

  Pros:

  • Robust IOC integration across extensive product portfolio
  • Telemetry obtained across extensive portfolio of products
  • Active in industry collaborations and partnerships
  • Founding member of World Economic Forum Centre for Cybersecurity
  • Inexpensive and seamless integration across Fortinet products
  • Reference customers rely on integration of FortiGuard Threat Intelligence

  Cons:

  • Standalone portal needs development
  • FortiRecon still has maturing to do before competing with established digital risk protection providers
  • FortiRecon has standalone UI but rest of capabilities dependent on existing Fortinet technologies
  • Reference customers do not actively search out and read written threat intelligence reports regularly
  • Best suited only for existing Fortinet customers


• IBM - Contenders
  

  Pros:

  • Specializes in relevant indicators of compromise
  • Extensive partner ecosystem with over 40 countries and dozen global CERTs
  • Robust malware analysis team
  • Threat intelligence specialists aligned to operational technology vertical
  • Multiple options to obtain IOCs
  • APIs for IOCs are more accurate and relevant than other sources
  • Strong across standard cyber threat intelligence use cases

  Cons:

  • Structures offerings differently with primarily consumption-based pricing
  • Harder and potentially more expensive to address specific needs
  • Weaker in digital risk protection use cases like brand protection
  • Portal interface underwhelming, harder to navigate, and less customizable than competitors
  • Declined to participate in full Forrester Wave evaluation process


• Microsoft - Contenders
  

  Pros:

  • Most expansive source of threat intelligence telemetry
  • Reach across commercial and enterprise cloud, endpoint, and other products
  • Reference customers excited about volume of telemetry
  • Used for enrichment and automation across Microsoft stack
  • Plans to leverage generative AI for natural language consumption
  • Poised to be long-term disruptor to threat intelligence market

  Cons:

  • MDTI released in 2022 - currently has limitations
  • Focused on integration with Microsoft technologies only
  • Navigation of threat intelligence across technology landscape needs improvement
  • Traditional TIP features like MITRE ATT&CK mapping happens in separate product (Sentinel)
  • Reference customers prefer IOCs over written threat reports
  • Customers should supplement with another provider in short term until services mature


• Rapid7 - Contenders
  

  Pros:

  • Addresses multiple use cases
  • Can be purchased as standalone solution
  • Maintains well-known open source technologies like Metasploit and Velociraptor
  • Includes TIP for integrating other public or private IOC feeds
  • Embedding threat intelligence into broader portfolio
  • Reasonable price for smaller customers

  Cons:

  • Portfolio integration needs strengthening
  • Does not have as broad partner ecosystem as other providers
  • Vision focused on enhancing standard functionality
  • Portal lacks capabilities of competitors with tightly integrated threat intelligence
  • Reference customers say Threat Command interface is outdated with little UI change post-acquisition
  • Integration across Insight Platform not as seamless as it should be
  • References felt information was commodity


• Trellix - Contenders
  

  Pros:

  • Collects telemetry from broad portfolio of proprietary technologies
  • Unique IOCs from diverse technology sources
  • Trellix Private GTI for air-gapped environments
  • Reference customers appreciate richness of IOCs
  • Seamless integration with Trellix technology stack
  • Suited for customers needing robust IOCs across broad technology stack

  Cons:

  • Portfolio primarily delivers cyber threat intelligence use cases rather than brand protection
  • Trellix Insights standalone but GTI and TIE tightly bundled - only for existing customers
  • ATLAS geared to customers with mature threat intelligence programs
  • Vision lacks differentiation
  • Does not directly address common digital risk protection use cases
  • Requires going through RFI process for takedowns
  • Reference customers rely on other vendors for brand and domain protection

Reference

• Forrester, The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2023, 02-Aug-2023, ID RES178511

View Market Definition
View Vendor Movements