How to choose a threat intelligence platform

"Threat intelligence" covers a wider range of products than the name suggests, and the market splits along an architecture line before it splits along any feature list. Some tools crawl the public internet and tell you what is exposed. Some tools watch traffic hitting your own infrastructure and tell you what to ignore. Some tools pay analysts to sit inside closed criminal communities and tell you what is being planned. Buying the wrong type is the most common mistake here: a SOC already drowning in alerts does not need another feed, and a company with a small internet footprint does not need access to underground marketplaces.

If your team runs its own detection and response and wants fewer false alarms with better context, most of this guide applies to you directly. If there is no dedicated security function yet, the honest answer is that none of these products should be the first security purchase — endpoint protection and patching come first.

Passive scanning versus primary-source collection

This is the split that matters most. Shodan and Censys continuously crawl the internet and index what is listening on open ports: servers, industrial control systems, cameras, routers. That index answers "what is exposed, and where," for your own estate or anyone else's. GreyNoise does something related but narrower: it classifies the senders of scanning traffic hitting your own sensors as benign, malicious or unknown, so a SOC can suppress routine internet background noise instead of chasing it.

Flashpoint and Intel 471 sit on the opposite end. They collect primary-source data from underground forums, marketplaces and closed criminal communities that open scanning never touches — Intel 471 specifically has analysts engage directly inside those communities rather than only observing them passively. Google Mandiant draws on a third kind of source entirely: evidence gathered from its own incident-response and managed-defense engagements, tracking named threat-actor groups and the malware and vulnerabilities they actually used in a breach. None of these three are exposure scanners; they are intelligence about adversaries and their tradecraft.

Google VirusTotal and LevelBlue Open Threat Exchange are different again: VirusTotal is a multi-engine verdict service for a specific file, URL, domain or IP you submit, and OTX is a free, community-contributed library of indicator bundles ("Pulses") anyone can browse or feed into other tools.

Who is producing the intelligence

A related question worth asking directly: is the data crowd-sourced, machine-generated, or human-collected? OTX is explicitly community-contributed — free, but only as good as what the community and LevelBlue's own researchers publish. Shodan, Censys, GreyNoise and VirusTotal are largely automated: scanning engines, classification models and aggregated third-party verdicts, refreshed on a schedule. Flashpoint, Intel 471 and Mandiant are analyst-driven, with people reading forums, writing reports and, in Mandiant's case, responding to live breaches. Analyst-driven intelligence tends to be higher-context and higher-cost; automated feeds are cheaper and faster to scale but need a team on your side to interpret them.

How fresh does the data need to be

Data freshness varies a lot within this category and is worth checking per vendor rather than assuming. GreyNoise, for instance, publishes tiers that differ specifically on refresh interval and lookback window — data refreshed every eight hours on its free tier versus hourly on its top tier — which matters if you are trying to catch exploitation as it starts rather than a day later. Scanning-based tools like Shodan and Censys are limited by how often they can re-crawl the internet, not by a subscription tier. Analyst-driven sources like Flashpoint and Intel 471 are timely in a different sense: value comes from surfacing planning and tradecraft before an attack, not from a refresh clock.

Noise versus signal, and false positives

Internet-wide scanning produces enormous volumes of activity that is not actually targeted at you — most of it is other researchers' scanners, academic crawlers and automated bots. GreyNoise exists specifically to solve this by feeding anomaly detection and risk scoring into that classification, so a SOC can tune alerts down to what is genuinely worth a human's time. If you adopt Shodan or Censys without something like this, expect to spend real analyst time triaging exposure results that turn out to be benign.

How it plugs into what you already run

Every tool in this category is delivered as a cloud service, but they differ sharply in how easily they integrate. Shodan and Censys both offer REST APIs and, in Censys's case, dedicated enrichment endpoints built for SIEM and SOAR pipelines. GreyNoise and VirusTotal are similarly API-first and built to enrich alerts inside an existing detection stack rather than to be a destination on their own. OTX's DirectConnect API and STIX/TAXII feed are free and have published SDKs for several languages, which lowers the bar for a small team to pull data in without a platform contract. API integration effort is a real cost here — budget engineering time to wire any of these into your alerting, not just the subscription fee.

Free, freemium and quote-only

Pricing model is itself a signal about who a vendor is built for. OTX is entirely free with no paid tier. GreyNoise and VirusTotal both publish a genuine free tier alongside paid plans that require a sales conversation. Shodan is unusual in this category for publishing its self-serve prices outright, from a one-time membership up to a monthly Corporate plan. Censys publishes named tiers (Core, Adversary Investigation, Security Operations) with feature limits but not dollar figures. Flashpoint, Intel 471 and Mandiant publish nothing — access is sold as an enterprise subscription or engagement, scoped to the modules or services you need. If your organization wants to trial before committing budget, that narrows the field considerably to OTX, GreyNoise, VirusTotal and Shodan.

A shortlist by situation

• If you want a free indicator feed to enrich existing tools with no procurement process, start with LevelBlue OTX.
• If your SOC is overwhelmed by scanning noise and needs to separate background internet activity from targeted threats, look at GreyNoise.
• If you need to discover your own organization's unknown internet-facing assets and shadow IT, look at Censys or Shodan.
• If you want a fast second opinion on a suspicious file or URL, Google VirusTotal's free Public API covers that, with the caveat that public submissions are shared with the wider security community.
• If you need visibility into planning happening inside closed criminal communities, evaluate Flashpoint and Intel 471 against each other directly.
• If you are already dealing with an active breach or want hands-on incident response alongside intelligence, Google Mandiant sells both together.

Questions to ask vendors

• Exactly which sources feed this data — automated scanning, community contribution, or direct analyst engagement — and can you show a sample report?
• What is the data refresh interval and lookback window on the plan we're pricing, not the top tier shown in the demo?
• Is any data we submit shared with the vendor's community or with third-party antivirus vendors, as with VirusTotal's standard scanning?
• What does the API rate limit look like at our expected query volume, and does it support our SIEM or SOAR directly?
• If pricing is quote-only, what actually drives the number — seats, API call volume, data history, or engagement scope?

Common mistakes

Buying an underground-forum intelligence subscription before the team has the analyst capacity to act on it is a common and expensive mistake — that data needs interpretation, not just ingestion. The opposite mistake is buying a free or cheap scanning tool and assuming it replaces analyst judgment; Shodan and Censys tell you what is exposed, not what to do about it. Treating VirusTotal as a private malware sandbox is a real and specific error, since standard submissions become visible to the wider community. And judging any of these tools on a demo's sample data rather than your own environment hides exactly the noise-versus-signal problem you are trying to solve.

For two direct comparisons inside this category, see Censys vs Shodan and Flashpoint vs Intel 471. The full list of tools in this category is at every tool in this category.