European Threat Intelligence Platforms

#1 Filigran (OpenCTI)

Paris, France Free Community Edition, Enterprise Edition quoted per customer, with a 30-day trial on XTM Hub Demo on request

Best for: Security teams that want to own and host their threat intelligence platform

• Operating company. Filigran SAS
• Jurisdiction. EU (France)
• Where the data sits. Your own infrastructure (Community Edition) or Filigran platform; region not stated on pages seen
• Source code. Closed source
• Replaces. Recorded Future, Anomali, ThreatQuotient

Of everything listed, Filigran (OpenCTI) is the one you can operate yourself. Its public OpenCTI repository carries a licence file placing the Community Edition under Apache 2.0, with copyright held by Filigran SAS, and the platform stores intelligence in a STIX 2.1 data model with dashboards and case management. According to the vendor it ships more than 400 one-click integrations that pull in commercial feeds, open-source feeds and internal tools.

Filigran SAS in Paris is named as lead GDPR controller in the privacy policy, but a US subsidiary also exists, so the signing entity deserves a look. Playbooks, priority intelligence requirements, AI-powered file imports and natural-language search are Enterprise Edition features with a 30-day trial. The free edition also supplies no intelligence by itself: feeds and analyst time come from you.

Standout feature. Filigran (OpenCTI) publishes its code and can be run on servers you control.

#2 EclecticIQ

Amsterdam, Netherlands Priced per customer after talking to sales, no list published Demo on request

Best for: Security teams with an existing SIEM or SOC that need structured, prioritised intelligence

• Operating company. EclecticIQ B.V.
• Jurisdiction. EU (Netherlands)
• Source code. Closed source
• Replaces. Recorded Future, Anomali, ThreatQuotient

EclecticIQ, based in Amsterdam, covers collection, processing, analysis and dissemination within a single product, and says plainly where it sits: it supplies a SIEM or SOC rather than replacing it. Content is held in STIX 2.1 and mapped to MITRE ATT&CK and DISARM, and analysts get AI-assisted extraction of entities from reports plus a hook into a malware sandbox. A browser extension called Threat Scout checks indicators on pages they are reading.

Contracts run through EclecticIQ B.V. in the Netherlands, while offices in the US, UK and Singapore are also listed, so look at which entity the order form names. No price list is published and engagements are quoted. Against SEKOIA.IO, which builds intelligence into detection, EclecticIQ suits organisations that already have detection and miss prioritised intelligence.

Standout feature. EclecticIQ is the one tool here whose whole pitch is to sit between intelligence sources and an existing SOC.

#3 SEKOIA.IO

Paris, France SaaS subscription Demo on request

Best for: SOC teams and service providers who prefer the vendor to keep detection rules current

• Operating company. SEKOIA.IO
• Jurisdiction. EU (France)
• Source code. Closed source
• Replaces. Microsoft Sentinel, Splunk, Falcon LogScale from CrowdStrike

SEKOIA.IO, a SOC platform from Paris, builds its threat intelligence into the detection product itself. Detection rules follow MITRE ATT&CK and draw on the vendor's own tracking of active actors, and much of that content is public according to the tool page. Case management, automated response and a large integration library sit around it, and hosting is in France, which the vendor stresses for NIS2-scope organisations.

The platform is SaaS only and priced by assets or events, with MSSP pricing for providers that run several tenants on it. That model turns each new log source into a budget decision, so volume needs modelling in advance. As a threat intelligence purchase it makes sense for a team that also needs a SIEM, and less so for one that only wants a feed.

Standout feature. SEKOIA.IO ships detection rules derived from its own actor tracking and keeps them updated for the customer.

#4 Silobreaker

Altrincham (registered office), United Kingdom Pricing on request (demo only) Demo on request

Best for: Intelligence teams that follow geopolitical and physical risk next to cyber threats

• Operating company. Silobreaker Limited
• Jurisdiction. United Kingdom (not in the EEA, covered by an adequacy decision)
• Where the data sits. Not stated on pages seen
• Source code. Closed source
• Replaces. Recorded Future

Silobreaker puts cyber, geopolitical and physical risk into one structure, and its product pages mention the Silobreaker Intelligence Engine, guided workflows for priority intelligence requirements and an AI module called Mimir. The vendor says the platform collects from millions of open, closed and premium sources and lets users add their own from a URL or RSS feed, but the pages do not name feeds or give a coverage breakdown.

According to Companies House, Silobreaker Limited is a British company registered on 15 April 2005 with number 05425764. The UK sits outside the EEA, with an adequacy decision. Pricing is demo-only, and its legal pages refused automated access, leaving hosting region, deployment and processing terms unchecked. A pure SOC may find the scope broader than it needs.

Standout feature. Silobreaker runs geopolitical and physical security intelligence through the same requirements workflow as cyber.

#5 CYJAX

Witney, United Kingdom Pricing on request Demo on request

Best for: Mid-sized security teams that want analyst help alongside a platform

• Operating company. CYJAX Limited
• Jurisdiction. United Kingdom (not in the EEA, covered by an adequacy decision)
• Where the data sits. Not stated on pages seen
• Source code. Closed source
• Replaces. Recorded Future

CYJAX describes itself as British threat intelligence with global visibility, and the homepage lets visitors put a question about an actor, an emerging threat or an exposure to an analyst. Product lines cover cyber, investigation, card fraud and physical security, collected from open, deep and dark web sources, and an MSSP edition exists. It names ISO 27001, NIS2, DORA and GDPR as frameworks its intelligence supports.

CYJAX Limited has its registration in England and Wales and an office at Witney; English law governs the website terms, and Companies House records incorporation on 21 November 2012. Neither price, hosting region nor deployment model appears on the pages seen, and the integrations page lists no named products. Treat it as a service to trial with real questions, since public pages cannot show how deep the collection goes.

Standout feature. CYJAX puts an Ask an Analyst function on its homepage as part of the offer.

#6 KELA

Tel Aviv, Israel Pricing on request; a Start for FREE option appears on the site Demo on request

Best for: Teams that want visibility into cybercrime forums, access brokers and infostealer logs

• Operating company. Kela Research and Strategy Ltd.
• Jurisdiction. Israel (outside the EU/EEA)
• Where the data sits. Not stated on pages seen
• Source code. Closed source
• Replaces. Recorded Future

KELA is an Israeli provider whose CTI page describes a Cyber Fusion approach: underground chatter is correlated with technical infrastructure and live network telemetry. It lists the KELA Datalake, KELA Control for NetFlow visibility of command-and-control communication, and pre-emptive hunting that, according to the vendor, watches access sellers and stolen-log markets. Exposure management and digital risk protection modules appear around it.

In its privacy policy the company appears as Kela Research and Strategy Ltd. and claims ISO 27001:2022; a press release from 2026 carries a Tel Aviv dateline. Israel counts as European on this directory but is outside the EU and EEA. Its registered address, any foreign subsidiaries and the hosting region stayed unverified, the Start for FREE terms could not be read, and no self-hosting is mentioned.

Standout feature. KELA builds its product on cybercrime forum, broker and stolen-log data.

#7 Outpost24

Karlskrona, Sweden By quote; the Outscan NX yearly subscription scales with the number of assets Demo on request

Best for: Bigger companies looking for a Swedish supplier of vulnerability and exposure tooling

• Operating company. Outpost24 AB (registration 556615-2103)
• Jurisdiction. EU (Sweden)
• Where the data sits. Not checked
• Source code. Closed source
• Replaces. Bitsight, Tenable, Qualys

Outpost24 comes from the exposure side of security and answers what is reachable, not who is attacking. The vendor's pages describe finding internet-facing assets and shadow IT, and Outscan NX scores vulnerabilities by likelihood of exploitation using threat intelligence and machine learning. It claims 2,500+ customers across 80+ countries.

The contracting party is Outpost24 AB (556615-2103) of Karlskrona, and it posts its own terms for Outscan NX, sold per year by asset count with overage billed monthly. Checking was limited, because the vendor site returned errors to our fetches and the facts rest on search snippets and those terms. Nothing else is priced publicly, and the target buyer is a larger organisation.

Standout feature. Outpost24 links exposure discovery with vulnerability scanning and penetration testing under one vendor.

#8 ONYPHE

Cléder, France Each view is priced individually through sales Demo on request

Best for: Analysts wanting unprocessed Internet scan data and discovery of assets by domain

• Operating company. ONYPHE SAS
• Jurisdiction. EU (France)
• Where the data sits. The website runs on OVH in France, where the platform itself is hosted is not given
• Source code. Closed source
• Replaces. Bitsight, Censys, Shodan

ONYPHE sells Internet scan data collected weekly across the whole Internet. On its homepage the vendor cites monthly intake of 20 billion+ banners and 10 billion+ DNS entries, 5,000+ ports covered each week, a 0.1 second API response and up to 48 months of history on the larger views. The ASM Edition layers on asset tracking by domain, Vulnscan for 190+ exploited CVEs and Riskscan for risky configurations.

The legal notices name ONYPHE SAS, Cléder, France (SIRET 83154069500036); OVH in France carries the website, but the platform's hosting is not mentioned. Every view is priced by contact, there is no supplier score, and all views are throttled to roughly one request a second. Analysts must build their own queries, which fits CTI teams more than buyers wanting a ready report.

Standout feature. ONYPHE hands analysts the weekly Internet scan data that sits underneath its asset tracking.

#9 Check Point Exposure Management (Cyberint)

Tel Aviv, Israel Plan tiers are shown on the website without any amounts Demo on request

Best for: Existing Check Point customers, or teams after dark web and attack surface monitoring in a single platform

• Operating company. Check Point Software Technologies Ltd, the parent that owns Cyberint
• Jurisdiction. Israel (outside the EU/EEA)
• Where the data sits. Not checked
• Source code. Closed source
• Replaces. Bitsight, SecurityScorecard

Cyberint is the former name of Check Point Exposure Management, and cyberint.com now presents the company as part of Check Point. Modules cover attack surface, deep and dark web, brand protection and a supplier module that spots which vendors you use and flags serious risks. Tiers are compared on the pricing page without amounts, together with takedown remediation credits.

Who signs is unclear. The licence text points to the Israeli parent in Tel Aviv, but a US subsidiary called Cyberint Inc. appears in Check Point's own privacy policy, so the order form decides. The product has lost its independence, shows no amounts and its data location went unchecked. A buyer already holding Check Point contracts may find procurement easier.

Standout feature. Check Point Exposure Management (Cyberint) alone sells takedown remediation credits inside its tiers.

#10 Maltego

Munich, Germany Basic EUR 0/year; Entry EUR 3,000/year; Professional EUR 7,500/year; Enterprise on request Demo on request

Best for: Analysts investigating infrastructure, actors and social media connections

• Operating company. Maltego Technologies GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. Not stated on pages seen
• Source code. Closed source
• Replaces. Recorded Future (investigation features)

Maltego is an investigation tool rather than a feed platform. The graph product draws relationships between entities and Search handles quick lookups, while the pricing page lists Monitor for watching social media, Evidence for keeping copies of it and Data as a curated data pass. Graph runs on the desktop and in a browser, which suits an analyst who needs to map how domains, people and infrastructure connect after an alert.

Maltego Technologies GmbH is registered in Munich at Amtsgericht Muenchen, HRB236523, and EU customers contract with it, while the licence agreement names Maltego US, Inc. for the United States. Tiers run from a free Basic plan with 200 credits to Entry and Professional plans, with Enterprise by quote, and lookups on the cheaper plans stop when credits run out. STIX intelligence is not stored in it, so it supplements a platform.

Standout feature. Maltego prices in euros on its website and starts at a free tier.