Sold by: SOCRadar Cyber Intelligence Inc.
SOCRadar Extended Threat Intelligence unifies Cyber Threat Intelligence, Digital Risk Protection, and External Attack Surface Management in a single AI-powered platform. Continuously monitor the surface, deep, and dark web for threats to your brand, assets, and credentials.
4.6
Overview
SOCRadar XTI is an AI-powered Extended Threat Intelligence platform that gives security teams a unified view of external risk. It combines three capabilities that are usually sold separately: Cyber Threat Intelligence (CTI), Digital Risk Protection Services (DRPS), and External Attack Surface Management (EASM).
The platform continuously collects and analyzes data across the surface, deep, and dark web (forums, marketplaces, paste sites, Telegram channels, and leaked databases), then enriches and prioritizes it with cross-source confidence scoring so analysts focus on what matters. Core modules include Dark & Deep Web Monitoring, Brand Protection, Attack Surface Management, Vulnerability Intelligence, Supply Chain Intelligence, and VIP/Fraud Protection, alongside takedown services and IOC enrichment APIs.
SOCRadar integrates with leading SIEM and SOAR platforms, enabling automated enrichment and response workflows. The result is reduced alert noise, faster investigations, and proactive defense against external threats without adding operational overhead.
Highlights
- Extended Threat Intelligence in one platform: Cyber Threat Intelligence, Digital Risk Protection, and External Attack Surface Management, with AI-driven prioritization and cross-source confidence scoring.
- Surface, deep, and dark web monitoring for leaked credentials, brand abuse, fraud, and supply-chain risk, backed by takedown services and threat-actor context.
- Custom scope, module bundles, volume and multi-year enterprise pricing are available through AWS Marketplace Private Offers. Contact sales@socradar.io to request a tailored private offer for your organization.
Details
Categories
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
SOCRadar XTI Platform (Annual) | Annual access to the SOCRadar Extended Threat Intelligence Platform, with a flexible scope defined through a customer-specific agreement with Private Offer for the selected contract term. Customers can license one or more modules, including Cyber Threat Intelligence, Dark & Deep Web Monitoring, Brand Protection, and External Attack Surface Management, or opt for API-only access, such as IOC Enrichment and Reputation APIs. Customers can license exactly what they need. | $100,000.00 |
Advanced Brand Protection - Business | SOCRadar Brand Protection monitors social media, third-party apps, and the dark web to protect digital assets and brand reputation. Detects phishing domains, impersonation, and exposed credentials with real-time alerts and takedown management. Business tier: 50 IPs, 10 VIP accounts, 3 domains, 10 brand keywords, 5 mobile apps, 5 social accounts, 1 user. | $28,750.00 |
Advanced Dark Web Monitoring - Business | Advanced Dark Web Monitoring continuously scans dark web marketplaces and forums for leaked credentials and sensitive data, with early warnings and customizable alerts. Business tier: 1 domain, 1 seat; blackmarket, employee data breach, stealer/botnet tracking, hacker discussions, Telegram & Discord, ransomware activity, and VIP monitoring. | $9,100.00 |
Cyber Threat Intelligence - Essential | SOCRadar Cyber Threat Intelligence (CTI) gathers, analyzes, and acts on data from open sources, social media, and the dark web - threat hunting, threat-actor tracking, real-time alerts, and SIEM/SOAR integration. Essential tier: 1 seat, 50+ feed sources, 100 threat-hunting rules, 6000+ combolists, 1000 threat-search credits/yr, 100 malware-analysis credits/yr. | $14,750.00 |
External Attack Surface Management - Business Edition | SOCRadar External Attack Surface Management (EASM) discovers and monitors internet-facing assets (websites, cloud, APIs) with automated discovery, risk scoring, and real-time alerts to reduce exposure. Business Edition: 100 assets, 1 user. | $4,000.00 |
Dimensions summary
You license this platform on an annual contract, and you can buy in two ways. The XTI Platform option gives you a flexible, custom scope through a Private Offer. You choose one or more modules, or opt for API-only access, licensing exactly what you need. Alternatively, you can buy four fixed single-module tiers: Advanced Brand Protection Business, Advanced Dark Web Monitoring Business, Cyber Threat Intelligence Essential, and External Attack Surface Management Business Edition. Each fixed tier sets defined limits, such as assets, domains, seats, and credits. All options bill per unit over the annual term.
Top-of-mind questions for buyers
Each fixed tier bills independently as its own unit with its own defined limits. Buying Brand Protection Business and Dark Web Monitoring Business, for example, adds each tier's price separately. To combine modules under one flexible custom scope instead, use the XTI Platform option through a Private Offer.
Limits map to distinct monitored items. Attack Surface Management Business Edition covers 100 internet-facing assets such as websites, cloud services, and APIs. Brand Protection Business counts 50 IPs, 3 domains, 5 mobile apps, and 5 social accounts. Each item consumes one unit against its category cap.
Fixed tiers set hard limits, such as 1 seat, 1 domain, or defined threat-search and malware-analysis credits per year. The description does not specify automatic overage billing. To raise limits or add flexible scope, move to the XTI Platform option via a Private Offer. Contact the vendor to confirm expansion mechanics.
socradar.io
Helpful?
Vendor refund policy
All sales of the SOCRadar XTI Platform are final and non-refundable, except where required by applicable law. For billing questions, contact support@socradar.io .
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
SOCRadar provides 24/7 support to all customers. Email: support@socradar.io . Support portal: https://help.socradar.io . Subscriptions include onboarding assistance, a dedicated customer success contact. Standard response targets: critical issues within hours, standard requests within one business day.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
The AI-native CrowdStrike Falcon Platform provides comprehensive protection across all areas of enterprise risk - devices, identities, data, endpoints and cloud. Powered by a single agent, crowdsourced data, expert threat intelligence, and advanced AI, the Falcon Platform simplifies security operations and stops breaches.
Threater is the only active defense solution that blocks every threat from every path in your network at any scale in real time. Your security stack is better with Threater.
Powered by machine learning, decades of threat research, and petabytes of intelligence, SophosLabs Intelix gives your app superpowers to identify, classify, and prevent threats. Designed for easy integration into any application, augmenting your cybersecurity is only an HTTP request away.
GreyNoise empowers enterprise and government security teams with real-time, verifiable threat intelligence about activity targeting the network edge. Powered by the GreyNoise Global Observation Grid, it observes scanning, CVE exploitation, and threat actor campaigns at global scale, helping teams defend against novel exploitation, detect compromised assets, and triage and investigate critical alerts.
Customer reviews
Hospitality
Clear, Insightful Dashboard with Effortless Navigation
Reviewed on Oct 27, 2026
Review provided by G2
What do you like best about the product?
The way information is displayed on the dashboard and the ease of navigating between the various findings
What do you dislike about the product?
Given how long I’ve been using it, I can’t say there’s anything I don’t like.
What problems is the product solving and how is that benefiting you?
I have a clearer view of the level of exposure some of our services might face, which allows us to focus on prioritizing the most critical areas.
Oil & Energy
Excellent Threat Visibility in One Platform for Faster Monitoring
Reviewed on Oct 27, 2026
Review provided by G2
What do you like best about the product?
SOCRadar provides good visibility into external threats, particularly exposed assets, dark web activity, leaked credentials, and emerging threats. I especially appreciate having these capabilities consolidated into one platform, which makes monitoring more efficient and allows our small cybersecurity team to focus on the risks that require attention, all within a few clicks which would require several hours to achieve.
What do you dislike about the product?
Actually, we are now at the POC stage in which evaluating this SW tool. Accordingly the cost could be a real challenge to purchase the product. let see later!
What problems is the product solving and how is that benefiting you?
Basically, it allowed us to know what the outside world sees and knows about us as a firm, are there any leaked information assets etc which we are not aware of.
Anonymous
Strong Threat Visibility, but Vulnerability Alerts Need to Be Faster
Reviewed on Oct 25, 2026
Review provided by G2
What do you like best about the product?
I like the visibility SOCRadar Extended Threat Intelligence gives us across the organization. Getting first-hand information when an account password is leaked helps us act quickly, whether that means resetting the password or scanning systems for malware. It also helps improve our incident management. I like the attack surface management, vulnerability management, and compromised-credential detection features. Setup was quite easy and straightforward, and I deployed it myself.
What do you dislike about the product?
I think SOCRadar Extended Threat Intelligence’s notifications can be delayed. The PHP vulnerability came out around Wednesday, but we didn’t receive an alert until yesterday, and I expected it sooner. There’s a discrepancy in how quickly it reports existing vulnerabilities. Delays can be dangerous with zero-day attacks and leave us in the dark when we rely on SOCRadar for this information.
What problems is the product solving and how is that benefiting you?
With SOCRadar Extended Threat Intelligence, we get first-hand information when an account password is leaked, so we can act quickly by resetting it or scanning the system for malware. It improves our incident management and visibility across the organization.
Education Management
SOCRadar’s Accurate Alerts with Rich Detection Details Enable Efficient Mitigation
Reviewed on Oct 23, 2026
Review provided by G2
What do you like best about the product?
My org has a high number of users who generate a lot of leaked-credentials noise in other tools, but SOCRadar’s alerts are relevant and usually accurate. I also appreciated the unexpectedly detailed information included with some detections, such as machine names, IP addresses, and even the offending file path on the affected device, which makes isolation and remediation much more effective.
What do you dislike about the product?
I haven't come across any feature or functional issues that have had any impact on my productivity, but If I had to make one suggestion regarding the Exposed Credentials that I use most often, I would say that is would be nice to see a count or a list of previous detections for the same email address/username. That would help me to know if a particular user is at a higher risk due to repeated misuse of their email address/username on systems outside of our organization.
What problems is the product solving and how is that benefiting you?
We struggle with Leaked Credentials exposed on the internet. SOCRadar has given us greater insight into not only which users' credentials have leaked, but also clues as to the source of the leak - Infostealer on a device, breached 3rd party systems, etc. This enables us to know how to best mitigate potential problems, isolate/reset accounts, and even clean or reimage an infected device.
Research
Great Exposure Monitoring: Credential Alerts and Botnet IP Scanning
Reviewed on Oct 22, 2026
Review provided by G2
What do you like best about the product?
The exposed credentials feature and that it scans our IP addresses against botnets
What do you dislike about the product?
Most of the exposed credentials found are from old users and it finds passwords that are no longer in use. Once got a notification about a non-existent account on a machine that's not ours
What problems is the product solving and how is that benefiting you?
Attack surface management, risky users identification