Threat intelligence AI agents
Quick answer
Threat intelligence AI agents lists 6 verified listings for Cyber threat intelligence: collecting, analysing and acting on threat-actor, dark-web and indicator intelligence in dataset v0.1.31 (generated 2026-10-30).
Verified listings whose stored tasks or product pages cover threat intelligence: KELA Digital CTI Analysts, Cyble Blaze AI, SOCRadar AI Agents, Anomali Agentic AI in ThreatStream Next-Gen, Filigran XTM One, and Gambit Cyber Vizier AI.
This is not a ranking or score.
Verified listings whose stored tasks or product pages cover threat intelligence: KELA Digital CTI Analysts, Cyble Blaze AI, SOCRadar AI Agents, Anomali Agentic AI in ThreatStream Next-Gen, Filigran XTM One, and Gambit Cyber Vizier AI. CloudSEK is omitted because its live listing is digital-risk and attack-surface monitoring, not threat intelligence. Side-by-side fields come from the open dataset (vendor pages, HQ, tasks, published pricing and sources). This is not a ranking or score.
Key facts
From this dataset
- 6 verified listings on this page, with headquarters in 3 HQ regions and 4 countries.
- Dataset version 0.1.31, generated 2026-10-30.
- Cyber threat intelligence: collecting, analysing and acting on threat-actor, dark-web and indicator intelligence
Cite as: Agent Index by Heritage Services, Threat intelligence AI agents, dataset v0.1.31 (https://theagentindex.io/compare/threat-intelligence-agents/)
FAQ (from this dataset)
What is listed on this use-case table?
Cyber threat intelligence: collecting, analysing and acting on threat-actor, dark-web and indicator intelligence 6 verified listings from Agent Index dataset v0.1.31.
How many listings are on this page?
6 verified listings in dataset v0.1.31 (2026-10-30).
Which listings are headquartered in India, Asia-Pacific or Australia/NZ?
None of the 6 listings on this page publish an HQ in India, Asia-Pacific or Australia/New Zealand in the dataset.
Is this a ranking?
No. This is not a ranking or score. Order is mechanical (from dataset fields such as name, framework-tag count or table membership), not a paid placement or quality judgement.
| Field |  KELA Digital CTI Analysts (Alex and Ethan agentic threat-intelligence analysts) |  Cyble Blaze AI |  SOCRadar AI Agents (specialist threat-intelligence, attack-surface, digital-risk and alarm-triage agents) |  Anomali Agentic AI in ThreatStream Next-Gen and the Anomali Data Lake (autonomous triage, scoring and investigation agents) |  Filigran XTM One (CTEM AI agents and autonomous attack chaining for OpenCTI and OpenAEV) |  Gambit Cyber Vizier AI and KnightGuard AI agents (agentic CTEM and security workflow automation) |
|---|---|---|---|---|---|---|
| Vendor | KELA (Kela Research and Strategy Ltd.) | Cyble | SOCRadar (SOCRadar Cyber Intelligence Inc.) | Anomali (Anomali, Inc.) | Filigran (Filigran SAS) | Gambit Cyber (Gambit Cyber B.V.) |
| HQ | Israel · Middle East | United States · North America | United States · North America | United States · North America | France · Europe | Netherlands · Europe |
| Primary category | Security | Security | Security | Security | Security | Security |
| Also listed in | Security | Security | Security | Security | Security | Security |
| Summary | Always-on agentic threat-intelligence analysts trained on KELA's cybercrime data lake: Alex (enterprises and MSSPs) and Ethan (government and law enforcement) monitor the organisation's threat landscape 24/7, prioritise and proactively surface leaked credentials, targeted threats and threat-actor profiles, answer analyst questions and generate RFIs, working inside existing tools via API, MCP, webhooks and a built-in SOAR. | Multi-agent cybersecurity engine across Cyble's threat-intelligence, endpoint and cloud products: agents hunt, correlate IOCs, isolate endpoints, block domains and draft reports, with human-in-the-loop guardrails. | Roster of specialist agents inside the SOCRadar threat-intelligence platform: customers deploy agents, set each one's skills, scope and access, and green-light sensitive steps. Agents cover threat-actor and ransomware intelligence, detection-rule writing, IoC enrichment, identity/credential exposure, vulnerability analysis, brand and dark-web monitoring, phishing-domain hunting, external attack surface and Shodan recon, and alarm triage that records verdicts and asks before changing an alarm's status. | Intelligence-native agentic SOC layer: ThreatStream Next-Gen and the Anomali Data Lake ship with autonomous triage, scoring and investigation steps, Tier 1/2 triage agents, a stack-ranked decision queue and automated Priority Intelligence Requirement monitoring, with analysts setting how much autonomy the agents get. | Agentic AI layer for Filigran's open-source threat-intelligence (OpenCTI) and exposure-validation (OpenAEV) platforms: pre-built agents turn threat intelligence into hunting packages, detection rules and attack scenarios, and an autonomous attack-chaining orchestrator plans, runs and adapts an AI penetration test against an authorized environment, with optional human approval for sensitive actions. | Netherlands-headquartered continuous threat exposure management (CTEM) platform, KnightGuard, whose Vizier AI layer uses coordinated AI agents (CTI analyst, SOC analyst, red and blue team, ITOps) to monitor the attack surface, turn threat intel into deployable detections, validate them and orchestrate response. |
| Frameworks (vendor-stated) | — | — | — | — | — | — |
| Frameworks (vendor-claimed) | — | — | — | — | SOC 2, ISO 27001 | — |
| Capabilities / tasks | threat intelligence, threat detection, alert triage, case investigation | threat detection, security operations, incident response, threat intelligence | threat intelligence, attack surface, alert triage, case investigation, security operations, threat detection | security operations, alert triage, case investigation, threat intelligence, threat detection | threat intelligence, pen test management, exposure management, threat detection | threat intelligence, exposure management, attack surface, threat detection, security operations |
| Integrations (vendor-listed) | REST API, MCP, webhooks, built-in SOAR, Slack, Microsoft Teams, email | Not recorded in this dataset yet | Not recorded in this dataset yet | Not recorded in this dataset yet | Not recorded in this dataset yet | Not recorded in this dataset yet |
| Pricing (as published) | Not published; demo-led, with a free start option on kelacyber.com (checked 2026-10-29). | Not published | Agent pricing not published separately. SOCRadar publishes module plans (socradar.io/pricing, checked 2026-10-21), e.g. Advanced Dark Web Monitoring Essential $4,550/year ($600/month) and Cyber Threat Intelligence Essential $14,750/year ($1,625/month); higher tiers and bundles on quote. A free tier with platform access is offered. | Not published | Not published (pre-packaged agents included for OpenCTI/OpenAEV Enterprise Edition customers with a usage quota; advanced XTM One capabilities licensed separately; 30-day trial and free open-source MCP server) | Not published (free trial offered) |
| Pricing model | quote | quote | published-tiers | quote | quote | quote |
| Primary source | https://www.kelacyber.com/platform/digital-cti-analysts/ | https://cyble.com/platforms/blaze-ai/ | https://socradar.io/ai-agents/ | https://www.anomali.com/products/agentic-ai | https://filigran.io/products/xtm-one | https://gambitcyber.org/press-releases/gambit-cyber-launches-vizier-ai-an-autonomous-security-intelligence-workspace-for-continuous-exposure-management/ |
| Last checked | 2026-10-29 | 2026-10-18 | 2026-10-21 | 2026-10-19 | 2026-10-20 | 2026-10-19 |
| Official site | https://www.kelacyber.com/platform/digital-cti-analysts/ | https://cyble.com/platforms/blaze-ai/ | https://socradar.io/ai-agents/ | https://www.anomali.com/products/agentic-ai | https://filigran.io/products/xtm-one | https://gambitcyber.org/ |
Side-by-side data is generated from the open dataset. “Vendor-claimed” frameworks are as marketed by each vendor and not verified by Agent Index; framework tags indicate relevance, not certification. Request current quotes from each vendor before buying. This page does not rank or score vendors. Sponsored comparisons, if any, will be labelled.
Use-case comparisons
- AI SOC and security-analyst agents — 52 listings (Security operations, alert investigation and threat detection)
- Agentic pentesting AI agents — 35 listings (Autonomous or AI-assisted penetration testing, attack-surface testing and exploitable-path verification)
Related
- KELA Digital CTI Analysts (Alex and Ethan agentic threat-intelligence analysts) alternatives
- Cyble Blaze AI alternatives
- SOCRadar AI Agents (specialist threat-intelligence, attack-surface, digital-risk and alarm-triage agents) alternatives
- Anomali Agentic AI in ThreatStream Next-Gen and the Anomali Data Lake (autonomous triage, scoring and investigation agents) alternatives
- Filigran XTM One (CTEM AI agents and autonomous attack chaining for OpenCTI and OpenAEV) alternatives
- Gambit Cyber Vizier AI and KnightGuard AI agents (agentic CTEM and security workflow automation) alternatives
- Best security AI agents
- AI SOC and security-analyst agents