European Alternatives to Recorded Future
Looking for a European alternative to Recorded Future? Its privacy policy states that Recorded Future, Inc. and its subsidiaries are indirect, wholly owned subsidiaries of Mastercard Incorporated, so a platform full of your watchlists and incident context sits under a US parent. It publishes no prices: cost depends on the package, the organisation-size tier, add-ons, services and capacity.
The European tools below include an open-source platform you can host yourself, intelligence-first and SOC-integrated platforms, and analyst-led services for dark web and cybercrime monitoring, all contracted through companies in the EU, UK or Israel.
How we rank these tools — 4-step process
-
1
European ownership, verified
The company is headquartered and incorporated in the EU, EEA, the UK, Switzerland or Israel, and processes customer data in Europe or Israel. A US parent company disqualifies a tool from this page regardless of where its servers are.
-
2
Category fit and hands-on review
What the tool actually does, who it suits, and where it falls short — checked against the vendor’s own documentation, changelog and pricing page rather than its marketing copy.
-
3
Compliance and pricing check
GDPR posture, hosting location and the prices quoted on this page are verified against the vendor’s public pricing before publication, and re-checked when we revisit the category.
-
4
Position on this page
Placement on this page can be paid, and that can affect which tools appear here and the order they appear in. It never buys a good review: a tool that fails the checks above is not here at any price, and payment does not change the shortcomings we write about. A vendor can ask us to correct a factual error — not to remove a criticism.
Vendors can pay for visibility on this page. It never changes what an entry says about a product, including the criticism, and we earn nothing when you click through to a vendor. Vendors can pay for more visibility, higher up on the review pages; it never affects which tools are listed. Editorial policy
10 European Alternatives to Recorded Future
Filigran (OpenCTI)
Open-source threat intelligence platform on a STIX 2.1 data model
EclecticIQ
Intelligence-first platform for the full threat intelligence lifecycle
Sekoia.io
SOC platform with threat intelligence built into detection
Silobreaker
Intelligence engine across cyber, geopolitical and physical risk
CYJAX
British cyber threat intelligence with analyst access
KELA
Cybercrime underground intelligence fused with technical data
Outpost24
Swedish vulnerability and attack surface vendor with threat intelligence
ONYPHE
French Internet scan data for analysts and attack surface teams
Check Point Exposure Management (Cyberint)
Attack surface and dark web monitoring, formerly Cyberint
Maltego
Link analysis and OSINT platform for investigations
Key takeaways
- Recorded Future's privacy policy says Recorded Future, Inc. and its subsidiaries are indirect, wholly owned subsidiaries of Mastercard Incorporated.
- Recorded Future's terms set EU customers under Swedish law with arbitration in Gothenburg, while the United States and all other locations fall under Massachusetts law and Boston.
- Recorded Future publishes no prices; its pricing page says cost depends on package, organisation size, add-ons, services and extra capacity.
- Filigran's OpenCTI Community Edition is Apache 2.0 licensed and can be hosted on your own infrastructure.
- Maltego is the only tool on the Recorded Future alternatives page with published prices, from €0 to €7,500 a year before Enterprise.
Why people leave Recorded Future
Recorded Future sells threat intelligence as a subscription platform: a security team gets collected and analysed data on threat actors, vulnerabilities, leaked credentials and brand abuse, and wires it into its own tooling.
Its pricing page groups the offer into Core, Professional and Elite Platform Packages, plus narrower Solution Packages such as Digital Risk Protection and Third-Party Risk. For many analysts it is the reference product in the category, and it is the one the European tools on this page are most often measured against.
The reason European buyers look elsewhere is ownership, not capability. The privacy policy states that Recorded Future, Inc. and its subsidiaries are indirect, wholly owned subsidiaries of Mastercard Incorporated, and that data may be shared with Mastercard for administration, security, risk management, audit and legal compliance. A platform that holds your watchlists, asset names and incident context sits inside a payments group headquartered in the United States, and some of its services are hosted there too.
Contracts are the second reason. European customers are directed to Recorded Future AB, SAS or GmbH, which is a real concession, yet the product, the parent and the roadmap are American. A threat intelligence platform also records what you worry about, which is information a CISO may prefer to keep inside one legal area.
- A payments group owns the platform The privacy policy describes Recorded Future as an indirect, wholly owned subsidiary of Mastercard Incorporated and lists Mastercard among the recipients of personal information for corporate administration, risk management, audit and compliance. For a buyer, the question is whether a customer's intelligence requirements and incident context should sit inside the group structure of a US card network. European vendors on this page are independent companies.
- Hosting partly in the United States The privacy policy says some of the services are hosted in the United States and that transfers from the EEA and UK rely on Standard Contractual Clauses, the Data Privacy Framework certification, and Mastercard Binding Corporate Rules for certain intra-group flows. That is a documented chain, but a data protection officer must assess every link. Against it, a French or Dutch SaaS contract makes the transfer question disappear.
- Contract law depends on where you are The terms of use assign governing law by customer location: Sweden with arbitration in Gothenburg for EU customers, England and Wales for the UK, and Massachusetts with Boston for the United States and all other locations. The EU route is sensible, but customers outside the listed regions, including Israel, land under Massachusetts law and Boston courts by default.
- No prices and a year-long lock The pricing page publishes no prices: cost follows the package, an organisation-size tier measured in unique workforce credentials, add-ons, services and extra capacity. The terms renew paid subscriptions for one-year periods unless notice is given at least 90 days before the end. Maltego (€0 to €7,500 a year) is the only tool on this page that prints its prices.
What you have to replace, not just match
Replacing Recorded Future means replacing a stack of modules behind one login. The core is the intelligence graph and its alerts on actors, malware and vulnerabilities.
Around it sit the domain products the pricing page names, such as Digital Risk Protection and Third-Party Risk, and the Terms of Use name group companies whose services sit under the same agreement: SecurityTrails, Hatching (with its Triage service) and Gemini Advisory. No single European vendor on this page covers all of that, so a migration is usually a split across two or three tools.
The second thing to replace is the plumbing. Recorded Future states that its packages carry no limit on users or integrations, with defined API call, scanned asset and monitored organisation capacity per package, and analysts build alerts, risk lists and automations on top.
Those artefacts do not move by themselves. STIX 2.1, which Filigran and EclecticIQ both use, is the common format for intelligence objects, but watchlists, alert rules and playbooks need to be rebuilt in the new tool and tested against a month of live alerts.
Finally there is the human layer. The pricing page says Premium Success adds a named technical account manager, training and professional services, whereas Standard Support covers onboarding and technical support. Decide before you leave which of those functions you will buy again, because CYJAX offers analyst access in its platform, and Silobreaker and KELA offer intelligence products of their own.
The alternatives compared
| Position | Tool | Headquarters | Pricing | Jurisdiction |
|---|---|---|---|---|
| #1 | Filigran (OpenCTI) | Paris, France | Free Community Edition, Enterprise Edition quoted per customer, with a 30-day trial on XTM Hub | EU (France) |
| #2 | EclecticIQ | Amsterdam, Netherlands | Custom quote; no published price list, contact sales | EU (Netherlands) |
| #3 | SEKOIA.IO | Paris, France | SaaS subscription | EU (France) |
| #4 | Silobreaker | Altrincham (registered office), United Kingdom | Pricing on request (demo only) | United Kingdom (not in the EEA, covered by an adequacy decision) |
| #5 | CYJAX | Witney, United Kingdom | Pricing on request | United Kingdom (not in the EEA, covered by an adequacy decision) |
| #6 | KELA | Tel Aviv, Israel | Pricing on request; a Start for FREE option appears on the site | Israel (outside the EU/EEA) |
| #7 | Outpost24 | Karlskrona, Sweden | Quote; Outscan NX is an annual subscription priced by asset count | EU (Sweden) |
| #8 | ONYPHE | Cléder, France | Custom pricing, contact sales for each view | EU (France) |
| #9 | Check Point Exposure Management (Cyberint) | Tel Aviv, Israel | See website; plan tiers are listed without prices | Israel |
| #10 | Maltego | Munich, Germany | Basic EUR 0/year; Entry EUR 3,000/year; Professional EUR 7,500/year; Enterprise on request | EU (Germany) |
How each alternative compares to Recorded Future
Filigran (OpenCTI)
Self-hostable open-source platform that takes over storage and sharing of intelligence
Best for: Teams with their own analysts who want to hold the intelligence database themselves
Against Recorded Future, Filigran changes who holds the database. OpenCTI Community Edition is Apache 2.0 software that you can run on your own infrastructure, with a STIX 2.1 data model and, according to the vendor, more than 400 one-click integrations. Filigran SAS in Paris is named as lead controller under GDPR, and a 30-day trial of the Enterprise Edition is available on XTM Hub.
What you do not get is content. OpenCTI structures and connects intelligence, whereas Recorded Future collects it and scores it for you, so the free edition needs feeds, either open-source ones or commercial ones that you buy separately. Playbooks, priority intelligence requirements and AI-assisted reporting sit in the paid Enterprise Edition, whose price is not published.
What Filigran (OpenCTI) does better than Recorded Future
- Hosting on your own servers
- Open licence and exportable STIX 2.1 data
- A free tier with real functionality
- A French lead controller instead of a US parent
Where Filigran (OpenCTI) is a step down from Recorded Future
- Collected and curated intelligence out of the box
- Analyst time needed to operate it
- Published Enterprise pricing
Standout against Recorded Future. It is the only tool on this page whose source code you can read and run yourself.
Best for: Teams that already run detection and need structured intelligence to prioritise alerts
EclecticIQ B.V. in Amsterdam is the nearest structural match to Recorded Future's analyst workflow. It covers collection, processing, analysis and dissemination, uses STIX 2.1, maps to MITRE ATT&CK and DISARM, and adds AI-assisted entity extraction and a malware-sandbox integration. The Threat Scout browser extension lets analysts check indicators outside the platform.
Two cautions apply. The site lists offices in the US, UK and Singapore, so the signing entity should be confirmed on the order form. And, like Recorded Future, EclecticIQ publishes no price list, so the comparison has to happen in a quote. It is also not a SIEM, which means its value depends on the SOC tooling it feeds.
What EclecticIQ does better than Recorded Future
- A Dutch parent with Amsterdam headquarters
- DISARM mapping next to MITRE ATT&CK
- STIX 2.1 as a native exchange format
Where EclecticIQ is a step down from Recorded Future
- Breadth of domain modules such as third-party risk
- Price visibility
- Standalone value without a SIEM or SOC
Standout against Recorded Future. It is built as an intelligence layer on top of other tooling rather than a bundle.
Best for: SOC teams and MSSPs that want detection content maintained for them in France
SEKOIA.IO takes a different route from Recorded Future: instead of selling intelligence into your tools, it builds the intelligence into a detection platform. Its rules are mapped to MITRE ATT&CK, informed by actor tracking, and combined with case management and automated response. Hosting in France and a multi-tenant design for MSSPs are the features the tool page stresses.
The consequence is that you buy a SOC platform, not a feed. A team that only wants Recorded Future-style alerts and risk lists would pay for SIEM capabilities it does not need. Pricing is typically by assets or events and needs modelling, and the platform is SaaS only, so on-premises deployment is not an option.
What SEKOIA.IO does better than Recorded Future
- French sovereign hosting
- Detection rules maintained by the vendor
- MSSP multi-tenancy
- One platform from intelligence to response
Where SEKOIA.IO is a step down from Recorded Future
- Standalone intelligence breadth against Recorded Future
- SaaS-only delivery
- A newer vendor with a mostly French footprint
Standout against Recorded Future. It is the only tool here that turns tracked adversary behaviour directly into maintained detection rules.
Silobreaker
British intelligence engine that adds geopolitical and physical risk to cyber threats
Best for: Corporate security teams that follow geopolitical and physical risk next to cyber
Silobreaker is the closest to Recorded Future in sales model: a UK company, Silobreaker Limited (incorporated in 2005 per Companies House), that sells an intelligence engine through demos. It splits its solutions into cyber, geopolitical risk and physical security, and offers PIR guided workflows plus an AI module called Mimir. Custom sources can be added from any URL or RSS feed.
Verification was thin: its legal pages returned a 403 error to automated fetches, so deployment options, hosting region and data processing terms could not be confirmed here. The UK sits outside the EEA, with an adequacy decision. Its breadth suits a risk department, while a pure SOC may find more scope than it needs.
What Silobreaker does better than Recorded Future
- Geopolitical and physical risk coverage in one tool
- Requirements-driven workflows
- Adding your own sources by RSS or URL
Where Silobreaker is a step down from Recorded Future
- Documented hosting and terms
- Price transparency
- Fit for a SOC-only workflow
Standout against Recorded Future. It treats a flood, an election and a ransomware group as parts of the same intelligence requirement.
Best for: Mid-sized security teams without a large analyst bench
CYJAX Limited in Witney, England, places analysts at the front of the product: the homepage invites you to ask an analyst about a threat actor or an exposure. It lists cyber, investigative, payment fraud and physical security intelligence, collection across open, deep and dark web sources, and a version for MSSPs. Website terms are under English law.
Against Recorded Future the evidence is shorter. Pricing, hosting region and deployment model are not stated, the integrations page names no products, and coverage depth cannot be compared from public pages. That makes it a service to evaluate by trial, not a drop-in replacement for a large platform with a published package structure.
What CYJAX does better than Recorded Future
- Analyst access built into the offering
- Payment fraud intelligence as a named product
- English-law terms and UK company record
Where CYJAX is a step down from Recorded Future
- Named integrations
- Stated hosting and deployment
- Brand recognition among large buyers
Standout against Recorded Future. It sells the ability to ask an analyst a question as a feature of the platform.
Best for: Teams that want visibility into access brokers, leaked credentials and infostealer logs
KELA is the most specific alternative on the page. Its CTI page describes correlating underground chatter with technical indicators and network telemetry, with the KELA Datalake for stored data and KELA Control for NetFlow-based visibility of command-and-control traffic. According to the vendor it monitors initial access brokers and infostealer logs for early warning.
The company is Kela Research and Strategy Ltd. in Tel Aviv, outside the EU and EEA but treated as European on this site, and the privacy policy states ISO 27001:2022. Registered address, subsidiaries and hosting region could not be verified. A Start for FREE option appears on the site, though its terms were not readable, and the platform is closed.
What KELA does better than Recorded Future
- Focus on underground and credential-leak intelligence
- A free entry option on the website
- Technical indicators and telemetry in one store
Where KELA is a step down from Recorded Future
- Breadth of domains beyond cybercrime
- Stated hosting region
- Verified entity details
Standout against Recorded Future. It concentrates on cybercrime marketplaces and infostealer data instead of general-purpose coverage.
Outpost24
Swedish exposure and vulnerability vendor that overlaps Recorded Future's attack surface work
Best for: Larger organisations that want external exposure and vulnerability management from one Swedish vendor
Outpost24 AB in Karlskrona, Sweden, replaces a different slice than the others. Its pages describe external attack surface management, Outscan NX for risk-based vulnerability management and testing services. For a Recorded Future customer that mainly uses attack surface and vulnerability prioritisation, it addresses that use directly. It is not an intelligence feed platform.
Evidence is limited, because the vendor site blocked automated fetches and facts come from search results and service terms. The vendor states over 2,500 customers in more than 80 countries. Outscan NX is priced as an annual subscription by number of assets, and no other price is public.
What Outpost24 does better than Recorded Future
- Vulnerability management in the same vendor
- Swedish AB with registration number
- Asset-count pricing logic for Outscan NX
Where Outpost24 is a step down from Recorded Future
- Dark web and actor-level intelligence
- Open product pages
- Published prices
Standout against Recorded Future. It is the only vendor on this page that couples exposure discovery with scanning and penetration testing services.
Best for: Analysts who want queryable scan data and domain-based asset tracking
ONYPHE SAS in Cléder, France, supplies data rather than finished reports. The homepage states weekly scans of the whole Internet, 20 billion or more banners collected monthly and history up to 48 months on larger views. The ASM Edition adds asset tracking by domain name, Vulnscan across 190+ exploited CVEs, and Riskscan. An API and the OQL query language are provided.
Against Recorded Future that means a different job: you query exposures yourself instead of reading scored risk lists. There is no supplier security score, a rate limit of about one request a second applies, and no prices are shown. The website sits on OVH in France, but platform hosting is not stated.
What ONYPHE does better than Recorded Future
- Raw scan data access via API and OQL
- French company with published registration
- Up to 48 months of history
Where ONYPHE is a step down from Recorded Future
- Ready-made scoring and curated reports
- Threat actor and dark web coverage
- Visible pricing
Standout against Recorded Future. It exposes the underlying Internet scan data that other vendors only show as scores.
Check Point Exposure Management (Cyberint)
Israeli-parent external risk platform that bundles dark web, brand and supplier monitoring
Best for: Teams that use Check Point or want attack surface, dark web and brand monitoring in one platform
Check Point Exposure Management, formerly Cyberint, resembles Recorded Future's Digital Risk Protection and Third-Party Risk packages more than its core intelligence graph. The pricing page compares tiers by module: attack surface, brand protection, deep and dark web monitoring, supply chain intelligence and global threat intelligence, with remediation credits for takedowns.
Ownership needs attention. Cyberint is now a Check Point company, the licence names Check Point Software Technologies Ltd in Tel Aviv, and Check Point lists Cyberint Inc. among US subsidiaries, so the signing entity must be confirmed. As with Recorded Future, a large parent stands behind the product and no prices are published.
What Check Point Exposure Management (Cyberint) does better than Recorded Future
- Takedown credits as part of the plan
- Tiers compared module by module
- Supplier monitoring in the same tool
Where Check Point Exposure Management (Cyberint) is a step down from Recorded Future
- Independence from a large vendor
- Confirmed contracting entity
- Price disclosure
Standout against Recorded Future. It is the only tool here that includes remediation credits for takedowns in its plan tiers.
Best for: Investigators and analysts who map infrastructure, people and social media connections
Maltego Technologies GmbH in Munich replaces the investigative side of Recorded Future, not the feed. Maltego Graph draws relationships between domains, people and infrastructure, Monitor watches social media, Evidence preserves social media data, and Data is a curated pass. It runs on desktop and in the browser.
It is the one tool here with a printed price list: Basic €0 a year with 200 credits, Entry €3,000, Professional €7,500 for up to five users, Enterprise on request. Credit limits cap lookups on lower tiers, and US customers contract with Maltego US, Inc. It does not store or share STIX intelligence, so it complements a platform instead of replacing one.
What Maltego does better than Recorded Future
- Price transparency in euros
- Graph-based investigation
- A free Basic tier
- German GmbH with commercial register entry
Where Maltego is a step down from Recorded Future
- Continuous intelligence feed and alerts
- Credit caps on lower tiers
- Playbooks and sharing of intelligence objects
Standout against Recorded Future. It turns a single indicator into a visual map of connected infrastructure.
What actually breaks when you switch
The first break is the archive. Recorded Future's terms say you are responsible for your own backups and that no export of Customer Data is provided after termination, so alert history, watchlists and analyst notes have to be exported while the subscription runs. With a 90-day non-renewal notice period on one-year terms, a late decision can mean paying for another year of a platform you have already left.
The second is the people and the plumbing. Analysts who built alerts around Recorded Future's risk scores will find different scoring in every European tool, and SIEM, SOAR and ticketing integrations must be re-pointed. Filigran advertises more than 400 integrations and EclecticIQ uses STIX 2.1, which helps, but detection rules and playbooks are authored again. Plan a parallel run of at least one full alert cycle before switching off the old feed.
Does Recorded Future store European customer data in Europe?
The pages we could read do not give a hosting region. The privacy policy states that some of the services are hosted in the United States, and that EEA and UK data may be transferred there under Standard Contractual Clauses or the Data Privacy Framework certification. The terms of use name Recorded Future AB, SAS and GmbH as contracting entities for European customers, which tells you who signs, not where the platform runs.
Ask for the data location per module in writing before renewal, and compare it with what Filigran (your own infrastructure), SEKOIA.IO (French sovereign hosting, according to the tool page) and ONYPHE (website on OVH in France, platform hosting not stated) say. Several European vendors here also leave the region unstated, so the question applies to them too.
Can I get my data out when I stop using Recorded Future?
The terms of use say the customer is solely responsible for retaining backup copies of its data and that Recorded Future will not provide an export of Customer Data after termination. In practice that means exporting alerts, watchlists, lists of indicators and notes while the subscription is still active. Paid subscriptions also renew automatically for one-year terms unless notice of non-renewal reaches Recorded Future at least 90 days before the term ends.
Put the notice date in the calendar before you start a trial of an alternative, and run both platforms in parallel for one alert cycle. A STIX 2.1 target such as Filigran or EclecticIQ eases the import of exported indicators, though contextual notes and rule logic will usually need to be recreated by hand.
Which one to pick
If you want ownership of the platform, choose Filigran, and expect to bring feeds and analyst time. If you want an intelligence layer on top of a SOC you already have, EclecticIQ is the closer fit, and SEKOIA.IO fits better when you have no SIEM yet and want detection content maintained for you. Teams with a broader risk remit should compare Silobreaker, and teams that need analysts on call should compare CYJAX.
For underground and credential-leak coverage, KELA is the specialist, while Check Point Exposure Management is the option for brand and supplier monitoring if a large Israeli-parent vendor is acceptable.
Outpost24 and ONYPHE cover the exposure and scan-data side, and Maltego covers investigations at a visible price. If your organisation is comfortable with Recorded Future AB, SAS or GmbH as contracting entity and with Mastercard as owner, staying is a defensible decision, because no single tool here replicates its whole module set.
Frequently Asked Questions
It depends on which part of Recorded Future you use. Filigran (OpenCTI) is the closest match for a threat intelligence platform you can host yourself, EclecticIQ suits intelligence-first teams with an existing SIEM, and SEKOIA.IO adds intelligence to a French SOC platform. Silobreaker, CYJAX and KELA are the intelligence-service alternatives, and Maltego covers investigations. None of them replicates the whole Recorded Future module set.
Yes. Its privacy policy describes Recorded Future, Inc. and its subsidiaries as indirect, wholly owned subsidiaries of Mastercard Incorporated, a US company. European customers contract with local group entities such as Recorded Future AB in Sweden, SAS in France or GmbH in Germany, but the parent is American, which keeps the CLOUD Act question open for data held by the group.
Recorded Future publishes no prices. Its pricing page says the cost depends on the package, the organisation-size tier, add-ons, services and extra capacity. Among the European tools, Maltego prints €0, €3,000 and €7,500 a year tiers, and Filigran's Community Edition is free to host yourself. Filigran Enterprise, EclecticIQ, Silobreaker, CYJAX and KELA all give prices on request.
Partly. KELA concentrates on underground forums, access brokers and infostealer logs, CYJAX lists deep and dark web collection with analyst access, and Check Point Exposure Management (Cyberint) combines dark web monitoring with attack surface and brand protection. Coverage depth cannot be compared from public pages, so test each against your own brand names and credentials during a trial.
Filigran's OpenCTI is open source in its Community Edition under the Apache License 2.0, with Filigran SAS holding the copyright. You can run it on your own servers, connect feeds through its advertised 400+ integrations and export STIX 2.1. Playbooks, priority intelligence requirements and AI-assisted import are Enterprise Edition features, and you supply the intelligence feeds and the analyst time yourself.
Related comparisons
Buying guides
About the author
Explore More European Alternatives
Discover privacy-focused European alternatives to other popular US tech services.