Final week, Forrester revealed The Forrester Wave™: Exterior Menace Intelligence Service Suppliers, Q3 2026 | Forrester. Since our final analysis in 2023, the market has undergone a big transformation. This transformation has been pushed not solely by the rising sophistication and breadth of menace intelligence necessities, but in addition by the fast adoption of agentic AI as organizations race to counter the asymmetry between AI-powered attackers and more and more overstretched defenders.
What’s New In This Wave?
The prior iteration of the Wave, The Forrester Wave™: Exterior Menace Intelligence Service Suppliers, Q3 2023 | Forrester, evaluated 12 distributors towards 14 present providing standards, 6 technique standards, and a couple of market presence standards. The 2026 analysis displays a supercharged market. A number of distributors from the 2023 evaluation, together with Trellix, CybelAngel, Microsoft, Rapid7, and IBM, weren’t included within the newest analysis.
This iteration evaluates 10 distributors: CrowdStrike, Recorded Future, Google, Flashpoint, ReliaQuest, Netcraft, ZeroFox, Fortinet, TrendAI, and Doppel towards 17 present providing standards and throughout 6 technique standards. Members have been categorized as Leaders, Sturdy Performers, and Contenders based mostly on evaluation of tailor-made questionnaire responses from distributors, government briefings, product demos, and buyer reference interviews. Key takeaways from the analysis embody:
- Precedence Intelligence Necessities (PIRs) have moved from passive onboarding to energetic adoption. Earlier evaluations examined how suppliers gathered intelligence necessities. The newest evaluation evaluates how successfully Precedence Intelligence Necessities (PIRs) are embedded inside the platform, operationalized throughout workflows, and translated into actionable outcomes and tracked danger discount.
- Digital danger safety will get the depth it deserves. The analysis disaggregates Digital Threat Safety into distinct areas, together with model safety, government safety, and fraud intelligence. This helped seize the depth and maturity of vendor capabilities meaningfully. With rising sophistication of deepfakes, disinformation campaigns, social engineering, impersonation assaults, and geopolitical instability, organizations want intel suppliers to behave as area consultants to assist establish, analyze and reply accordingly.
- Agentic AI has turn out to be a product technique battleground. Whereas AI has been embedded throughout menace intelligence platforms for a number of years, this analysis locations higher emphasis on how distributors use AI to function at scale, notably throughout menace searching, detection engineering, and intelligence processing and evaluation. Simply as importantly, the analysis scrutinizes how distributors measure the effectiveness of their AI-driven capabilities and therefore demand proof of efficacy, operational influence, and return on funding (ROI); somewhat than an opaque promise of automation. The market stays sharply divided: some distributors proceed to deal with AI as a black field, and some present proof of continued transparency or customization. Most, nevertheless, fall someplace in between.
Menace Intelligence Shopper Market Dynamics
Right this moment’s Exterior Menace Intelligence Service Suppliers (ETISP) vendor methods typically fall into two camps:
- Pure-play menace intelligence platform participant that spans a number of use circumstances with various ranges of depth.
- Specialists that dominate a single intelligence area (or sub-domain).
The problem for patrons is that neither strategy ensures complete protection. Forrester’s analysis highlights three realities for safety leaders:
- Use-case excellence over platform breadth. Menace intelligence necessities fluctuate broadly throughout industries, geographies, and stakeholder teams. Company safety groups care about government safety, fraud groups concentrate on fraud intelligence, and cyber menace intelligence groups require wealthy assortment, evaluation, and operationalization capabilities. No vendor leads each class. Organizations should align vendor strengths to their most crucial use circumstances somewhat than chasing an all-in-one promise.
- A balanced roadmap beats an AI-only roadmap. AI is quickly changing into a aggressive differentiator, however differentiation shouldn’t be mistaken for worth. Distributors that make investments closely in AI-driven operationalization can ship vital advantages, however provided that these capabilities are constructed on robust intelligence assortment, correlation, and contextualization. Consider it as superior weaponry loaded with rusted ammunition. Prioritize distributors with a practical roadmap that balances intelligence enhancements with AI-powered execution, and demand transparency as an alternative of accepting AI as a black field.
- They should construct partnerships or in-house capabilities to shut vendor gaps. Each ETISP vendor has strengths and weaknesses. Some excel at intelligence assortment and enrichment however wrestle to translate intelligence into high-fidelity detection content material, insurance policies, or automated actions at scale. Whereas others shine in supporting capabilities however fall brief on visibility and operational areas. Safety leaders ought to assume that gaps will live on and plan accordingly. Therefore, enterprises should increase their intelligence suppliers with inner tooling and strategic partnerships. Whether or not it’s an in-house detection engineering instrument tailor-made to the enterprise’s expertise stack or a regional companion that executes takedowns the place vendor protection is restricted. Strong safety posture shall be achieved by organizations that flatter such gaps of their ETISP distributors.
For a better look into this analysis, scoring, and the general market, Forrester shoppers can learn the complete report: The Forrester Wave™: Exterior Menace Intelligence Service Suppliers, Q3 2026 | Forrester. Shoppers may also e-book an inquiry or steerage session with me if they’ve questions concerning the evolution of this market or want assist navigating it.
Be a part of us at Forrester’s Safety & Threat Discussion board from November 9–10. I’ll be main a session and a roundtable dialogue targeted on menace intelligence and its intersection with AI. Try the complete agenda to be taught extra about different classes on Zero Belief, securing AI, GRC, AppSec, and lots of extra subjects.