Sold by: SpyCloud
Deployed on AWS
SpyCloud Investigations accelerates cybercrime and identity threat investigations by providing CTI and SOC analysts with access to the worlds largest repository of dark web identity data recaptured from data breaches, malware infections, and successful phishing attacks. Powered by AI Insights and advanced identity correlation, the solution enables security teams to start with a single identifier and rapidly resolve investigations into insider threats, financial crimes, ransomware, threat actor attribution, platform abuse, and more. Choose from an easy-to-use SaaS console or API to use SpyCloud alongside other data sources in Maltego, Splunk, or Jupyter Notebook.
4.7
Overview
SpyCloud Investigations accelerates cybercrime and identity threat investigations by providing CTI and SOC analysts with access to the world's largest repository of dark web identity data recaptured from data breaches, malware infections, and successful phishing attacks. The platform continuously delivers new data that SpyCloud directly recaptures from the criminal underground, giving users the freshest insights and a critical advantage in stopping threats proactively.
Use Cases:
- Insider Threat Detection: Identify malicious, negligent, or compromised employees using recaptured breach and malware data
- Ransomware Prevention: Query infected device datasets to determine where threat actors have stolen access
- Threat Actor Attribution: Deanonymize adversaries by profiling digital footprints across thousands of breach sources
- Financial Crime Analysis: Uncover synthetic identities and fraudulent accounts
- Supply Chain Risk: Analyze vendor exposures from credentials to malware-infected systems
- Platform Abuse & Fraud: Detect fake signups and multi-account abuse
Flexible Deployment:
- SaaS Module: Browser-based console with unlimited queries, interactive graphs, and one-click pivoting
- API Access: REST-based APIs for custom automation and multi-source OSINT integration in Maltego, Splunk, Jupyter Notebook, i2 Analyst's Notebook, and Synapse Vertex
Core Functionality:
- IDLink Analytics - automatically correlates identity data across multiple online personas, mapping connected assets like emails, passwords, and IP addresses to build complete digital identity profiles. Typically reveals 8x more identity records vs manual analysis.
- AI Insights - generates structured reports highlighting potential insider threats, coordinated campaigns, and fraud indicators. Designed to make investigative findings accessible to analysts regardless of experience level.
Professional Services & Training:
- Optional analyst services are available for complex investigations, staffed by professionals with backgrounds in federal law enforcement and intelligence.
- Training on investigative methodologies and tradecraft is available.
Highlights
- Accelerate Investigations - Connect dots across fragmented identity data faster, revealing hidden relationships that accelerate investigations from discovery to attribution by 50% or more
- Amplify Analyst Impact - Boost team productivity with automated identity analytics that eliminate dead ends and focus analysts on high-impact threats
- Get Actionable Intelligence - Move from data to decision faster with AI-powered summaries that deliver finished intelligence your stakeholders can act on immediately
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
SpyCloud Cybercrime Investigations | Named user seat for SpyCloud Investigations Module. Contact SpyCloud to structure a private offer | $90,000.00 |
Dimensions summary
This listing offers one pricing dimension: a named user seat for the SpyCloud Investigations Module. You buy access per person, so cost scales with the number of analyst seats you need. Each seat provides unlimited in-portal queries and includes up to 200 API queries at no extra charge. Pricing is set through a private offer, so you contact SpyCloud to structure the agreement and seat count for your team. Volume discounts are available as your seat count grows.
Top-of-mind questions for buyers
A named user seat ties to one individual analyst who logs into the SpyCloud Investigations Module. Each person who needs access requires their own seat. Seats are assigned per user, not shared. Your total cost scales with the number of analysts on your team.
Each seat gives unlimited in-portal queries through the console. It also includes up to 200 API queries per seat at no extra cost. If your team needs more API volume, SpyCloud also offers a separate query-based API option. Contact SpyCloud to structure that arrangement.
Yes. Every seat provides access to the same console built on recaptured identity data. IDLink correlation, visual link analysis, and finished intelligence reports work for analysts at all levels. Some agentic features, such as Research Agent, are tied to Pro licenses within the module.
www.spycloud.com+2
Helpful?
Vendor refund policy
SpyCloud does not offer refunds
Custom pricing options
Request a private offer to receive a custom quote.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
SpyCloud customers get dedicated account managers and access to 24/7 support.
Existing customers can reach out to support@spycloud.com , and future customers can reach out to info@spycloud.com to start a conversation.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Secure employee and vendor identities - protect, prevent, and remediate compromised credentials and malware-infected users across your workforce and supply chain to reduce your attack surface with SpyCloud's holistic identity threat protection.
Customer reviews
Joevanne V.
Effortless Integration and Outstanding Support with SpyCloud
Reviewed on Jan 06, 2026
Review provided by G2
What do you like best about the product?
Spycloud was straightforward to implement and integrated seamlessly with AD. Our sales team provided excellent customer support, and impressively, the product was operational even before we finalized the purchase. The wide range of features focused on user identity has enabled us to monitor and address many compromised credentials within our environment. Product is also vert simple to use on a daily basis.
What do you dislike about the product?
I honestly can't think of anything I dislike about SpyCloud. It has fully addressed the use cases we required, and the team keeps enhancing the product by introducing new features.
What problems is the product solving and how is that benefiting you?
The Dark Web Monitoring feature and the reporting on user credential compromises are both valuable aspects. They help keep me informed about potential security risks related to my accounts.
Renu S.
Top-notch Cybersecurity Tool
Reviewed on Sep 27, 2023
Review provided by G2
What do you like best about the product?
One of SpyCloud's standout features is its straightforward and easy-to-comprehend user interface, which plays a pivotal role in mitigating the risk of account breaches.
What do you dislike about the product?
SpyCloud has been trouble-free for me up to this point
What problems is the product solving and how is that benefiting you?
SpyCloud works as a safeguard for my business's sensitive data, such as customer information, financial records, and intellectual property, from unauthorized access, theft, or manipulation.
Anshul M.
Great for checking your organization's exposure to threats
Reviewed on Apr 21, 2023
Review provided by G2
What do you like best about the product?
What I like most about SpyCloud is that it displays your personal as well as organizational risk posture in a clean and easy-to-understand UI. It greatly helps reduce the risk of Accounts being compromised.
What stands out most, however, is that they are very quick to report on the breached data, thereby enabling prompt action.
What stands out most, however, is that they are very quick to report on the breached data, thereby enabling prompt action.
What do you dislike about the product?
I haven't had any significant issues with SpyCloud so far.
What problems is the product solving and how is that benefiting you?
These days, cyber-attacks are more prevalent than ever and staying on top of breaches to minimize their impact is essential. SpyCloud helps our clients take care of that and prevent any significant fallout.
Information Services
Powerful protection against Account Take Over (ATO)
Reviewed on Aug 17, 2021
Review provided by G2
What do you like best about the product?
It expands your visibility of compromised user passwords beyond your own systems and applications. Like it or not, employees use a variety of third-party services and re-use passwords. This lets your know when their credentials are compromised and with their ADG product you can be alerted if the password matches your domain user passwords.
What do you dislike about the product?
As more organizations deploy MFA and other relatively effective ATO controls, the price point may make it harder for smaller organizations to justify.
What problems is the product solving and how is that benefiting you?
Monitor for known data breaches and protect against password re-use.
Computer Software
A way to stay on top of the latest data leaks
Reviewed on Apr 23, 2021
Review provided by G2
What do you like best about the product?
Spycloud makes it easy and clear to indentify comprimised passwords so we can take necessary action.
What do you dislike about the product?
Sometimes not all of the information from a breach is readily available.
What problems is the product solving and how is that benefiting you?
Spycloud helps us identify password reuse with users and alert us quickly when our information has been exposed.