External Threat Intelligence Service Providers

This page has argued since August that external threat intelligence is three products sharing one name, and that a category containing all three cannot produce a useful ranking until a buyer has decided which one they are purchasing. Forrester has now published the ranking, and the instruction that arrived with it is that same argument in a different register. The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026 went live on 17 September, and its guidance to buyers is to align vendor strengths to their most critical use cases rather than chase an all-in-one platform.

A scorecard that tells you not to read it as one ordering is worth taking seriously. It means the analysts who scored the field do not think the field reduces to a single stack, which is what this page was saying before there was a chart to say it against. What follows is the new evaluation read for the buyer it was written for, and the parts of the old page that the new one did not overturn.

One name, three products, and now a scorecard

The case for the category is unchanged. Relying on fundamental security controls and monitoring internal logs is no longer sufficient, and external cyber threat intelligence has become a foundational component of enterprise defense.

Internal telemetry tells you what is happening inside your estate. It cannot tell you that a ransomware group has begun targeting your sector, that credentials belonging to your employees are being sold, that a vulnerability in software you run is being exploited in the wild, or that someone has registered a domain resembling yours.

What sits under the heading remains several distinct things: adversary tracking and attribution, indicators of compromise, vulnerability intelligence with exploitation context, dark web and criminal marketplace monitoring, compromised credential detection, brand and domain abuse, third-party and supply chain exposure, and geopolitical risk analysis. Those are collected differently, consumed differently, and valuable to different teams. Compromised credential data is operationally actionable by an identity team within hours. Adversary tracking informs architecture decisions over quarters. Bundling them under one heading is convenient for vendors and unhelpful for buyers, and the 2026 evaluation does not pretend otherwise.

The three buyer types still describe the market. A raw data buyer already runs a security operations center, a threat intelligence platform, and analysts, and wants collection they can process themselves, judged on coverage, freshness, format, API quality, and the ability to filter at ingestion. A curated alerts buyer has a small team with no dedicated intelligence analysts and needs a short, prioritized set of things that matter to them specifically, with enough context to act. A platform buyer wants a system their team operates, storing, correlating, enriching, and investigating inside the tooling they already own.

Inside The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026

The report is authored by Jitin Shabadu and scores ten providers against 23 criteria, 17 of them under current offering and six under strategy. Its subtitle is "The 10 Providers That Matter Most And How They Stack Up."

CrowdStrike, Google, and Recorded Future hold the three Leader seats. Flashpoint, Netcraft, ReliaQuest, and ZeroFox hold the four Strong Performer seats. Doppel, Fortinet, and TrendAI are Contenders.

There is no Challengers band, so the three tiers run from Leaders straight to Strong Performers and then to Contenders, and the bottom rung holds close to a third of the field. That is a market with a settled top and a contested floor, and it is the opposite of the spread you would expect from a category whose vendors are selling three different products.

CrowdStrike reports the highest scores in both current offering and strategy, and the positioning chart supports it: its dot is the topmost and the rightmost in the field. Google placed as a Leader in 2023 on the strength of the highest possible score in fifteen criteria, including cyber threat intelligence, analyst tradecraft expertise, and innovation, and it holds a Leader seat again.

Market presence left the scorecard

The 2023 evaluation scored three categories: current offering, strategy, and market presence. The 2026 edition carries two. Market presence no longer appears as a scored category at all.

That is the structural change that matters more than any individual placement. A vendor's size, install base, and revenue are no longer part of the ranking. What remains is what the product does and where the vendor says it is going. In a category whose three product types sell to three different kinds of buyer, dropping size from the scorecard is the closest a ranking can come to admitting that its field is not comparable on scale.

It also changes how to read the chart. When market presence carries weight, a large general-purpose vendor places well on presence alone. Remove it, and a specialist that would have been dragged down by a smaller footprint is scored on its collection and its analysis instead. All four Strong Performers are specialists.

Two of the three Leaders are now divisions of larger companies

Google absorbed Mandiant and folded Mandiant frontline intelligence and VirusTotal into Google Threat Intelligence. Recorded Future is owned by Mastercard, which announced the acquisition in September 2024 at $2.65 billion and closed it in December.

The 2023 page quoted Forrester's observation that CrowdStrike's intelligence could be evaluated on its own merits even for organizations that do not run its endpoint detection tooling. The 2026 Leader rung extends that observation further than the 2023 edition could have. The top band is a search company, a payments network, and an endpoint platform vendor. None of the three sells intelligence as its only product.

That is not automatically bad for a buyer. Threat intelligence funded by a larger business is intelligence that does not have to survive on its own subscription revenue, and it can be priced into something else. It does mean the roadmap answers to a parent company's priorities, and the two things worth asking a Leader about are what its parent has already folded into it and what the parent could fold it into next.

The Customer Favorite finished a band below the Leaders

Forrester marks above-average customer feedback with a halo, and a double halo means the vendor is a Customer Favorite. Flashpoint carries the double halo. Recorded Future carries a single one, and it is the only Leader that has one at all.

The halos come from customer references. The placements come from analyst scoring. The distance between the highest-rated vendor and the Leader rung is the distance this market keeps rediscovering: buyers rate what they use, and an evaluation rates what a product is capable of.

Flashpoint's 2023 citation praised its fraud and compromised credential capability and its reputation and penetration in financial services, and that sector depth is still the clearest kind of differentiation a specialist can sell. It is also the kind of differentiation that caps a score in a criteria set built around breadth. A bank gets more from a vendor aimed at its sector. A scorecard that has to compare that vendor to a platform serving every sector will price the narrowness as a limitation.

Five names the field left behind, and the criteria that moved instead

Forrester names five vendors that were evaluated in 2023 and are not in this edition: CybelAngel, IBM, Microsoft, Rapid7, and Trellix. The field fell from twelve to ten, which means three seats are held by names the 2023 evaluation did not carry.

Two of the departures are the largest security vendors in the world. A category that no longer contains them is not the same category, and the absence is worth more attention than a placement: when general-purpose vendors leave a scored field, the field is usually being defined more narrowly around a specific job.

Three criteria changes are worth naming. Priority intelligence requirements moved from passive onboarding to active adoption, which shifts the question from whether a vendor collects what you asked for to whether your team actually uses what it collects. Digital risk protection was disaggregated into brand protection, executive protection, and fraud intelligence, which is what happens when a single criterion has been quietly doing three jobs. And agentic AI entered the strategy column as a battleground rather than as a feature, which is the analyst's way of saying that the automation claims now decide the roadmap even where the delivered capability does not yet.

Forrester also published non-scored Landscape reports on this market in the first quarters of 2025 and 2026, the second covering 34 vendors. Any buyer who treated the 2023 Wave as the newest thing Forrester had published was working from an incomplete record even before the new scorecard arrived.

The failure mode is intelligence about somebody else

A global feed reports thousands of indicators, dozens of active campaigns, and a constant stream of newly exploited vulnerabilities. The overwhelming majority concern sectors you are not in, regions you do not operate in, and software you do not run. Delivered undifferentiated, that volume is noise that consumes analyst attention and produces nothing.

The value is in the filter: which of this applies to us, given our sector, our geography, our technology estate, our suppliers, and our brand. That is why vendors compete on context rather than coverage, and why Flashpoint's financial services depth is cited as a differentiator rather than as a limitation.

It is also why any threat intelligence program fails without an asset inventory. Vulnerability intelligence saying a flaw is being actively exploited is only actionable if you know whether you run the affected software and where. Organizations that cannot answer that reduce every intelligence report to a manual checking exercise, and the program collapses under its own alerting.

What intelligence cannot do for you

Threat intelligence has a boundary worth stating plainly, because vendors are not paid to draw it.

Intelligence informs decisions. It does not make them, and it does not implement them. A report saying an adversary targeting your sector uses a particular initial access technique is valuable only if someone can change the control that would stop it, and that someone sits in a different team with a different backlog.

The organizations that get value from this category have a defined path from intelligence to action: a named owner, a regular cadence where findings are reviewed against the control environment, and the authority to change something. The ones that do not accumulate a subscription, a portal, and a monthly report that circulates and changes nothing.

That is the same pattern visible in cloud cost management, conversation intelligence, and employee experience research: the analysis is not the constraint, and no amount of tooling supplies the organizational willingness to act on it.

Threat intelligence has one feature the others do not, which is that the consequence of ignoring it is occasionally catastrophic rather than merely wasteful. That raises the stakes without changing the mechanism, and it is the reason a scorecard this narrow, scored this deliberately, still ends where every other analysis in this market ends: with a decision someone has to make.

Forrester does not endorse any provider named here, and tier placement should not be read as a recommendation to buy.

Worth reading alongside Proactive Security Platforms: Forrester retired attack surface management as a standalone market and scored its successor, where the vendor its own customers rate highest finished a band below both Leaders.