Threat intelligence
Threat intelligence for small security teams
For technical founders, CTOs and solo analysts who need to know which threat actors are hitting their sector and countries, from ransomware leak sites, forums, Telegram channels, marketplaces and paste sites.
Plans from $49. Pro, $199, is the one that replaces a CTI retainer.
- Actors indexed
- 13,000+
- New entries / month
- 8,000+
Manufacturing · United States · last 90 days
| Actor | Risk | Activity | Events | Actions |
|---|---|---|---|---|
| The Gentlemen | 95/100 | Spiked | 420 | On this watchlistProfile |
| Qilin | 87/100 | Steady | 1,200 | On this watchlistProfile |
| Akira | 84/100 | Steady | 580 | On this watchlistProfile |
| Medusa | 73/100 | Cooling | 310 | Not on this watchlistProfile |
Without a CTI team
What “no CTI team” means here
A CTI team's job is collecting from the underground, deciding which actors matter to you, profiling them, and telling you when they move. DarkWebSonar does the collecting, ranking, profiling and alerting. One person reads the shortlist and acts — you don't hire an analyst for that.
You still own the decisions and the response. The platform does not replace judgment; it removes the work of building a watchlist from scratch.
Collection
Where it collects from
Worldwide coverage of ransomware leak sites, forums, Telegram channels, marketplaces and paste sites, including Europe. The weekly summary email can be limited to your region.
- Leak sites
- Forums
- Telegram
- Marketplaces
- Paste sites
Actor profiles
What's in an actor profile
Every plan sees the same profile, including the trial: aliases, focus, the countries and industries they hit, attack types, and first and last seen. Targeting, techniques, and activity sit on the same profile.
Descriptions are generated and can be overridden by hand. Profiles can link out to MITRE, MISP, ETDA and Malpedia.
Public research on the same names: NoName057(16), Qilin, The Gentlemen and Akira.
NoName057(16)
Overview
Pro-Russian DDoS collective. Public research on this actor is in the Most Wanted profile.
- Aliases
- NN057, NoName
- Focus
- DDoSSpecialist
- Active since
- Oct 2024
- Last seen
- 18 Oct 2026
Targeted countries
- Ukraine
- Poland
- Lithuania
Targeted industries
- Government
- Transport
- Energy
Attack types
- DDoS Attack
Ranked watchlist
Which actors target you
Set your sector and the countries you operate in. DarkWebSonar scores the actors that have actually hit that footprint and returns a short watchlist — not a directory of every name in the index. Ranking favors relevance over raw volume, so the list stays small enough to watch.
A scored shortlist
Actors that have actually hit your sector and countries, not every name in the index.
Where they hit
Per-actor geography and industry mix, so you can see why they made the list.
Custom threat profiles
First setup is free. Then 2 updates a month on Starter, 4 on Growth, 8 on Pro, 30 on Enterprise.
Qilin
87/100Targeting
Observed targeting
Geography and industry across this actor's recorded history.
Observed events
1,200
Countries
18
Leading country
United States
50% of events
Leading industry
Manufacturing
25% of events
Top geographies
- United States600 (50%)
- Canada96 (8%)
- United Kingdom84 (7%)
- Germany60 (5%)
Alert delivery
Alerts where you already work
Email is on every plan. Slack, Microsoft Teams, PagerDuty, ServiceNow and signed webhooks are also on every plan, capped at 1, 3, 5 or unlimited destinations. A monitored keyword or watched actor getting a hit is what fires the alert.
API and MCP start on Pro. The 14-day trial does not include API or MCP access.
Slack
Microsoft Teams
PagerDuty
ServiceNow
Signed webhooks
DarkWebSonar
16 Oct · 18:14
New Threat Alert
Qilin listed millwright.example on a leak site
Watched actor Qilin posted millwright.example, a US manufacturer, on a ransomware leak site. Listing time 16 Oct 2026, 18:14 UTC.
- Victim
- Millwright
- Site
- millwright.example
- Actor
- Qilin
- Detected
- 16 Oct 2026 · 18:14 UTC
- Industry
- Manufacturing
- Country
- United States
View in DarkWebSonar
Same alert to email, Teams, PagerDuty, ServiceNow, or a webhook.
From alert to brief
Threat Intelligence Briefs
On-demand PDFs from a monitoring alert, a lookalike-domain finding, or an intel-feed event. Each Brief has an executive summary, assessment, actor context, evidence, and recommended actions. Generated from templates, not written by an analyst.
Pro includes Threat Intelligence Briefs from your own alerts and findings. Enterprise adds Briefs from any entry in the intel feed. Growth can also generate Briefs from its own alerts and findings.
The weekly summary email
Pro and Enterprise include a weekly summary email of feed activity and your watchlist. It can be limited to your region.
DarkWebSonarThreat Intelligence BriefThreat intelligence brief
Alleged leak-site listing of millwright.example by Qilin
Qilin listed millwright.example on a leak site.
- Entry ID
- a1b2c3d4···e5f6
- Detected
- 16 Oct 2026 · 18:14 UTC
- Threat actor
- Qilin
- Classification
- TLP:AMBER
Pro
Plug it into your stack
REST API and MCP server for Claude and Cursor. Pro includes 1,000 requests a month. There is no API or MCP access on the trial. See the Dark Web Monitoring API and MCP setup.
Plans
Plans from $49 a month
Plans from $49. Pro, $199, is the one that replaces a CTI retainer.
| Feature | Starter$49/mo | Growth$99/mo | Pro$199/moMost popular | Enterprisefrom $499/mo |
|---|---|---|---|---|
| History | 3 months | 6 months | 12 months | Full |
| Threat actor watchlists | 5 | 10 | 20 | 100 |
| Custom threat profiles | 2 updates / month | 4 updates / month | 8 updates / month | 30 updates / month |
| Monitored keywords | 10 | 25 | 50 | 200 |
| Alert destinations | 1 | 3 | 5 | Unlimited |
| API + MCP | – | – | Yes | Yes |
| Weekly summary email | – | – | Yes | Yes |
| Threat Intelligence Briefs | – | Own alerts and findings | Own alerts and findings | Own alerts and findings + any intel-feed entry |
First profile setup is free; later updates count against the monthly cap.
Starter$49/mo
- History
- 3 months
- Threat actor watchlists
- 5
- Custom threat profiles
- 2 updates / month
- Monitored keywords
- 10
- Alert destinations
- 1
- API + MCP
- –
- Weekly summary email
- –
- Threat Intelligence Briefs
- –
Growth$99/mo
- History
- 6 months
- Threat actor watchlists
- 10
- Custom threat profiles
- 4 updates / month
- Monitored keywords
- 25
- Alert destinations
- 3
- API + MCP
- –
- Weekly summary email
- –
- Threat Intelligence Briefs
- Own alerts and findings
ProMost popular$199/mo
- History
- 12 months
- Threat actor watchlists
- 20
- Custom threat profiles
- 8 updates / month
- Monitored keywords
- 50
- Alert destinations
- 5
- API + MCP
- Yes
- Weekly summary email
- Yes
- Threat Intelligence Briefs
- Own alerts and findings
Enterprisefrom $499/mo
- History
- Full
- Threat actor watchlists
- 100
- Custom threat profiles
- 30 updates / month
- Monitored keywords
- 200
- Alert destinations
- Unlimited
- API + MCP
- Yes
- Weekly summary email
- Yes
- Threat Intelligence Briefs
- Own alerts and findings + any intel-feed entry
Published pricing
How this compares to enterprise CTI platforms
Only one axis is compared here: whether the vendor publishes a price. No claim about who writes a brief, who is better, or who sends real-time alerts.
| Vendor | Published price |
|---|---|
| DarkWebSonar | Yes, all plans ($49 / $99 / $199 / from $499) |
| Recorded Future | No. Its pricing page asks, “Why don't you publish prices?” |
| Flashpoint | No. Core packages are listed; each one is “Get pricing.” |
| Google Threat Intelligence | No. Standard, Enterprise and Enterprise+ say “Contact sales for pricing.” |
| SOCRadar | Partly. Cyber Threat Intelligence Essential is $14,750 a year. Advanced Dark Web Monitoring Essential is $4,550 a year; Business is $9,100. Other modules are quoted. |
Sources, checked 23 October 2026: recordedfuture.com/pricing; flashpoint.io/pricing; cloud.google.com/security/products/threat-intelligence; socradar.io/plans-and-pricing.
Common questions
Frequently asked questions
Do small companies need threat intelligence?
Yes. Actors like Akira do not only hit household names. DarkWebSonar's Most Wanted research on Akira shows construction, manufacturing and professional services dominate, and small firms stay in the mix. The Gentlemen's 2026 leak-site batches are the same shape: small manufacturers, construction subcontractors and mid-market plants. Get MFA, backups and patching in place first. Then watch the actors that actually hit that footprint.
DarkWebSonar research: Akira, The Gentlemen.
What is threat intelligence without a CTI team?
DarkWebSonar collects from ransomware leak sites, forums, Telegram channels, marketplaces and paste sites, ranks the actors that hit your sector and countries, keeps a profile on each, and alerts you when they move. You decide what to do.
How does DarkWebSonar rank threat actors?
Set your sector and the countries you operate in. DarkWebSonar scores the actors that have actually hit that footprint and returns a short watchlist — not a directory of every name in the index. Ranking favors relevance over raw volume, so the list stays small enough to watch.
What's in a threat actor profile?
Aliases, a description, risk and activity, countries and industries, attack types, MITRE techniques, and recent incidents. Every plan sees the same profile, including the trial.
How much does it cost?
Plans from $49 a month. Pro, at $199 a month, adds the API and MCP server, 20 actor watchlists, 12 months of history, the weekly summary email, and Threat Intelligence Briefs from your own alerts and findings. Enterprise starts at $499 a month.
How does it compare to enterprise CTI platforms?
Recorded Future, Flashpoint and Google Threat Intelligence don't publish prices. SOCRadar publishes some packages: Cyber Threat Intelligence Essential is $14,750 a year, and Advanced Dark Web Monitoring Essential is $4,550 a year. DarkWebSonar publishes every plan, from $49 a month.
Is there a free trial?
Yes, 14 days, with keyword and threat actor monitoring, the personalized threat profile and full actor profiles. The trial doesn't include API or MCP access.
Start the 14-day trial
Keyword and threat actor monitoring, the personalized threat profile, and full actor profiles. No API or MCP on the trial.