ThreatConnect
ThreatConnect provides an AI-powered threat intelligence platform that fuses external threat data from over 200 sources with internal organizational telemetry for enterprise and government security teams. Now a Dataminr subsidiary, it serves one-third of the Fortune 50 and over 250 enterprise organizations.
- Company typePrivate
- Founded2014
- HeadquartersArlington, United States
- Headcount101–250
- GTM typeB2B
- OfferingSoftware
What ThreatConnect does
ThreatConnect is an Arlington, Virginia-based threat and risk-informed defense software company founded in 2011. The company built an enterprise threat intelligence platform that aggregates contextual threat data from over 200 external sources and fuses it with client-side internal telemetry, enabling security teams to operationalize threat intelligence, quantify cyber risk, and automate response across complex internal environments. Its product portfolio comprises the ThreatConnect Platform as the core offering, the Polarity analyst workflow tool (acquired July 2024) that surfaces contextual intelligence at the point of decision, and the RQ risk quantification module that translates threat exposure into financial impact metrics.
The company served more than 250 enterprise and government organizations prior to acquisition, including approximately one-third of the Fortune 50, with deployments spanning financial services, retail, hospitality, and federal agencies. Revenue was generated primarily through annual enterprise subscriptions with quote-based pricing reflecting deep integration requirements and varying organizational scope. The platform differentiates on data fusion of external signals with internal client context, supported by proprietary AI capabilities including agentic Intel Agents, predictive exposure management, generative AI summarization across 50+ LLMs, and anomaly detection across fused telemetry.
In October 2025, Dataminr announced its intent to acquire ThreatConnect for $290 million, completing the transaction in November 2025 with PSG as the exiting private equity sponsor. The combined Dataminr-ThreatConnect entity reports approximately $200 million in annual recurring revenue, more than 800 employees, and over 1,000 customers worldwide. In March 2026, Dataminr launched 'Dataminr for Cyber Defense,' an AI-native integrated cyber defense suite consolidating ThreatConnect technology with Dataminr's external real-time detection capabilities.
ThreatConnect firmographics
Firmographics- Name
- ThreatConnect
- Legal name
- ThreatConnect Inc.
- Website
- https://threatconnect.com
- Company type
- Private
- Founded year
- 2014
- Operating status
- Acquired
- Headcount range
- 101–250 employees
- Short description
- ThreatConnect provides an AI-powered threat intelligence platform that fuses external threat data from over 200 sources with internal organizational telemetry for enterprise and government security teams. Now a Dataminr subsidiary, it serves one-third of the Fortune 50 and over 250 enterprise organizations.
- Ownership category
- akta.pro rank
ThreatConnect industry classification
Industry- Product category
- Threat Intelligence Platform
- NAICS
- Computer Systems Design and Related Services (5415), Other Computer Related Services (541519)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Threat Intelligence Platforms (TIP) (HDADAGAD)
- akta.pro secondary industries
- Vulnerability Intelligence & Exploit Prediction (HDADAHAI), Deception Technology & Threat Hunting (HDADAGAI), Threat Intelligence Services (BPAEADAC)
Keywords
Where ThreatConnect is headquartered
LocationHeadquarters
- HQ city
- Arlington
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
ThreatConnect business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- Threat Intelligence Platform Subscription: Enterprise subscription-based model providing access to threat intelligence platform, integrated threat data feeds, and AI-powered analytics. The combined entity with Dataminr achieves approximately $200 million in annual recurring revenue.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Enterprise pricing - custom quote-based |
Go-to-market motion1 record
Distribution channels1 record
Marketing channels4 records
ThreatConnect product offering
Product offeringCore offering
ThreatConnect provides an AI-powered threat intelligence platform that fuses intelligence, automation, orchestration, and response capabilities to enable organizations to proactively manage cyber threats. The platform connects hundreds of internal client data sources with over 200 external threat data feeds, applying AI and risk quantification to contextualize, prioritize, and automate threat defense for enterprise and government clients.
Product overview
ThreatConnect is a threat and risk-informed defense company offering a suite of integrated cybersecurity products. The core ThreatConnect Platform provides AI-powered threat intelligence management and automation capabilities, augmented by the Polarity analyst workflow tool (acquired July 2024) and the RQ risk quantification module. Following Dataminr's November 2025 acquisition for $290 million, the ThreatConnect technology was integrated into Dataminr's broader cyber defense offerings, including the newly launched Dataminr for Cyber Defense suite.
Differentiator
Problem solved
Functional benefit
Brands
- Polarity: Security analyst workflow streamlining and threat detection enhancement tool acquired by ThreatConnect in July 2024.
- RQ
Products and services
- ThreatConnect Platform Threat and risk-informed defense platform that enables organizations to operationalize threat intelligence with AI and automation. Connects hundreds of client data sources across complex internal environments for threat contextualization, prioritization, and automated response. Used by enterprise and government security teams.
- Polarity Security analyst workflow tool acquired by ThreatConnect that streamlines threat detection and response by providing contextual threat data at the point of decision. Integrates with the ThreatConnect platform to provide frictionless access to data from over 200 threat intelligence sources.
- RQ
Quantifiable outcome
- Helped more than 250 enterprises improve their cybersecurity strategies
- +1 more outcomes
Companies that use ThreatConnect
Customer profileNamed customers5 records
Segments3 records
Ideal customer profiles3 records
ThreatConnect technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
AI capability6 records
Feature4 records
ThreatConnect partnerships and signals
Strategic signalPartnerships
One partnership is on record.
- DataminrcoreThreatConnect merged with Dataminr in a $290M transaction, creating a combined entity with approximately $200M ARR and 800+ employees. The acquisition combines Dataminr's external real-time detection capabilities with ThreatConnect's internal data management to deliver unified external and internal intelligence for enterprise and government clients. ThreatConnect operates as a core pillar of Dataminr's cybersecurity strategy while maintaining service continuity.
Scale indicators4 records
Recent moves5 records
Expansion highlights5 records
ThreatConnect competitors and assessment
Company assessmentDirect peers
- Recorded Future: Recorded Future is a direct competitor in the threat intelligence platform category, aggregating data from hundreds of sources and providing contextual, real-time intelligence to enterprise and government SOCs — the same core value proposition ThreatConnect delivers to its Fortune 50 base.
- Anomali: Anomali sells a Threat Intelligence Platform alongside SIEM integrations and AI-driven analytics aimed at enterprise security teams. It is a direct rival in the TIP category where ThreatConnect Platform, Polarity, and RQ compete.
- Flashpoint: Flashpoint delivers threat intelligence and vulnerability intelligence with a focus on illicit communities and fraud, complementing mainstream CTI feeds. It is a direct alternative for the same enterprise and government buyer purchasing ThreatConnect's platform.
Broad incumbents
- Mandiant (Google Cloud): Mandiant, now part of Google Cloud, combines threat intelligence with incident response and managed defense at very large enterprise and government scale. Its intelligence product (Mandiant Advantage) competes head-on with ThreatConnect's CTI and risk-prioritized insights.
- Palo Alto Networks (Unit 42 / XSOAR): Palo Alto Networks bundles threat intelligence (Unit 42) and orchestration/automation (XSOAR) into a broad cybersecurity platform that competes for the same enterprise CTI and SOC budget that ThreatConnect targets, especially as standalone TIPs are absorbed into platform deals.
- CrowdStrike (Charlotte AI / Falcon Intelligence): CrowdStrike's Falcon platform combines endpoint, threat intelligence, and AI-assisted SOC workflows for large enterprises. Its threat intelligence and analytics modules are increasingly bundled against standalone platforms like ThreatConnect in enterprise renewals.
- Microsoft Defender Threat Intelligence: Microsoft bundles threat intelligence and exposure management across Defender and Sentinel ecosystems and is a default incumbent in enterprises with heavy Microsoft footprint. It is a broad incumbent competitor for the same enterprise CTI and risk-prioritization use cases ThreatConnect serves.
Emerging players
- Cyware: Cyware offers a TIP and security orchestration platform aimed at automated threat intelligence sharing and response workflows for enterprises and ISACs. It overlaps with ThreatConnect's TIP and automation/orchestration capabilities targeting similar SOC buyer personas.
- ReliaQuest: ReliaQuest sells AI-driven security operations and 'GreyMatter' intelligence platform that fuses internal telemetry with external threat signals — closely paralleling ThreatConnect/Dataminr's internal-plus-external fusion thesis for enterprise SOCs.
- ZeroFox: ZeroFox provides external threat intelligence and digital risk protection for enterprises, including brand and surface attack monitoring. It overlaps with ThreatConnect's external-signal intelligence and predictive exposure use cases for similar enterprise buyers.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks5 records
Key highlights7 records
Customer concentration
ThreatConnect social profiles
Digital presenceThreatConnect financial estimates
Financial estimateRevenue estimate
Valuation estimate
ThreatConnect leadership team
Management profileNumber of profiles
Profiles13 records
ThreatConnect subsidiaries and ownership
Company hierarchySubsidiaries1 record
ThreatConnect funding detail
Funding detailFunding overview
Funding rounds4 records
Investors3 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
ThreatConnect M&A and investment
M&A and investmentM&A2 records
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about ThreatConnect
What does ThreatConnect do?
ThreatConnect provides an AI-powered threat intelligence platform that fuses intelligence, automation, orchestration, and response capabilities to enable organizations to proactively manage cyber threats. The platform connects hundreds of internal client data sources with over 200 external threat data feeds, applying AI and risk quantification to contextualize, prioritize, and automate threat defense for enterprise and government clients.
Is ThreatConnect a public or private company?
ThreatConnect is a private company. It is classified as corporate owned and is currently acquired.
When was ThreatConnect founded?
ThreatConnect was founded in 2014. It employs 101 to 250 people.
Where is ThreatConnect based?
ThreatConnect is headquartered in Arlington, United States, in the North America region.
How does ThreatConnect make money?
One revenue line is on record: threat Intelligence Platform Subscription.
Who are ThreatConnect's main competitors?
Direct peers on record are Recorded Future, Anomali and Flashpoint. Broad incumbents are Mandiant (Google Cloud), Palo Alto Networks (Unit 42 / XSOAR), CrowdStrike (Charlotte AI / Falcon Intelligence) and Microsoft Defender Threat Intelligence. Emerging players are Cyware, ReliaQuest and ZeroFox.
Does ThreatConnect have an API?
No public API is recorded for ThreatConnect.
What industry is ThreatConnect in?
ThreatConnect's product category is Threat Intelligence Platform. Its primary akta.pro industry code is HDADAGAD, Threat Intelligence Platforms (TIP), with a secondary code of HDADAHAI, Vulnerability Intelligence & Exploit Prediction. Its NAICS code is 5415 and its SIC code is 7372.