Actor Tracking & Notebooks
Auto-built profiles for the adversaries that matter, seeded from the MITRE ATT&CK group catalog and refreshed continuously.
Learn more18 sensors. IT to grid.
Eighteen protocol sensors, from SSH to the substation.
ThreatSpire now impersonates real OT gear — Modicon PLCs, SIPROTEC relays, SIMATIC I/O, and power-grid personas — so attackers reveal intent before they touch production.
console.threatspire.com / ctiledger
Built natively on the MITRE ATT&CK® framework
180+ tracked adversary groupsEvery claim source-linkedEvidence-first by designMulti-tenant & SSO-ready
The problem
Threat intel shouldn't die in a PDF.
Reports are scattered across vendors and channels. Claims are made without sources. Findings rarely reach the people who decide what to hunt, block, or escalate — and by the time they do, the next campaign is already moving.
"Threatspire has saved me over 60% in time researching threats to our organization"
Carl Doss, CTO — The Joselyn Foundation
The platform
A console for analysts, not a dumping ground for feeds.
AI Threat Actor Reports
One-click, CTID-style Threat Actor Profile Reports — executive summary, confidence-rated assessments, MITRE TTP tables, and evidence with clickable sources, drafted by AI and grounded in citations.
Targeted-Industry & TTP Analytics
Charts that show who an actor is hitting and how — industries derived by AI from the evidence itself, techniques sourced from MITRE ATT&CK group data.
Intelligence Requirements
Turn your org's standing questions into tracked, signal-driven RFIs. The Requirement Agent drafts judgments and recommended actions for analyst review.
Learn morePer-User Workspaces & Sharing
Every analyst gets their own workspace. Share requirements, cases, and IOCs at view, comment, or edit level — with comment threads and a full admin audit log.
Honeypot Sensor Fleet
Eighteen protocol sensors from IT to the plant floor: SSH, Telnet, HTTP/HTTPS, RDP, SMB, SIP/VoIP, MySQL, MSSQL, Redis, LDAPv3/AD, DNP3, Modbus/TCP, IEC 60870-5-104, IEC 61850 MMS, PROFINET, BACnet/IP, OPC-UA, and generic TCP/UDP.
IOC & Case Management
Validate, enrich, and manage indicator lifecycle. Investigations become shareable cases with Diamond Model analysis.
Learn moreSecure Multi-Tenant
SSO, MFA, role-based access, and strict per-tenant isolation built in from day one.
Agentic Dark Web Monitoring
AI agents sweep dark web markets, forums, and leak sites around the clock for your leaked credentials, exposed intellectual property, and brand mentions, then triage every hit for analyst review.
New · Announcing
Agentic dark web monitoring, working while you sleep.
ThreatSpire now deploys AI agents that sweep dark web markets, forums, paste sites, stealer-log channels, and ransomware leak sites around the clock. Every hit is triaged, correlated to your organization, and routed into the console with evidence and recommended next actions. No feeds to tune, no queries to write. The agents do the digging; your analysts make the call.
- Continuous agent sweeps, not daily digest feeds
- Every finding source-linked and confidence-rated
- Confirmed exposures escalate straight into your requirements and cases
Included in ThreatSpire platform plans
The Dark Web Agent fleet
Specialized agents each run their own collection plan, then hand off verified findings the same way a junior analyst would. You review the evidence, not the raw chatter.
Leaked credentials
Combolists, stealer logs, and breach dumps tied to your domains, screened and validated before they reach you.
Intellectual property
Source code, schematics, and internal documents offered for sale or posted to leak sites and paste dumps.
Brand & executive impersonation
Lookalike domains, fake support channels, and fraudulent social profiles impersonating your people.
Ransomware & actor chatter
Leak-site listings and forum chatter naming your organization, mapped to the actors behind it.
New · Announcing
Introducing Hospital Honeypot — deception for healthcare's most attacked devices.
Eight fully-simulated clinical devices. Real protocols. Zero real patient data. Every captured attack flows straight into your ThreatSpire threat intelligence pipeline — built on ThreatSpire, not bolted onto it.
Why it matters
Healthcare is the most targeted critical-infrastructure sector on the internet — and the devices attackers go after aren't laptops, they're the ones keeping patients alive. Dialysis machines, infusion pumps, anesthesia systems, and medication cabinets increasingly run on the same networks as everything else, often with decades-old protocols and little to no authentication. Most security teams have no way to see an attack against one of these devices coming until it's already happened.
Hospital Honeypot puts a decoy in front of the attacker instead — and feeds everything it captures directly into ThreatSpire, so it becomes part of your actual threat picture, not an isolated log file nobody checks.
Eight real device types, faithfully simulated
Kidney dialysis machine, MRI scanner, bedside cardiac monitor, medication dispensing cabinet, point-of-care analyzer, infusion pump, anesthesia machine, and nurse call system — covering diagnostics, life support, medication management, and clinical communications.
Real protocols, not toy emulation
DICOM for the MRI sensor, HL7 v2 over MLLP for the cardiac monitor, a POCT1-A2-inspired protocol for the point-of-care analyzer, an IEEE 11073 SDC-inspired protocol for anesthesia — attackers interacting with these sensors see the same protocol behavior they'd see on a real device, down to vendor-specific personas and realistic drifting vitals.
MITRE ATT&CK for ICS, mapped automatically
Every captured interaction — a status query, a brute-forced login, a parameter write, a connection scan — is automatically classified against MITRE ATT&CK for ICS, so what you get isn't raw logs, it's structured, analyst-ready signal.
Native ThreatSpire integration, required and built-in
Hospital Honeypot is a ThreatSpire product — it requires an active ThreatSpire subscription to run. Every event is pushed directly into your ThreatSpire tenant for actor attribution, IOC extraction, and alerting alongside the rest of your threat intel, with no separate console to check and no manual export step.
Zero real PHI, ever
Every patient name, session, and device identity is synthetically generated at runtime. Nothing real ever touches the codebase, the database, or an attacker's screen.
Deploy in minutes
Signed, notarized installers for macOS, plus .deb and .rpm packages for Linux. Install the binary, point it at your ThreatSpire tenant with your API token, and it's live.
Available to ThreatSpire customers.
Decoy personas
Your attacker doesn't see a honeypot. They see your vendor's equipment.
A generic ICS responder gives itself away the moment an attacker fingerprints it. Ask a real Modbus PLC who it is and it answers with a vendor and a model number. ThreatSpire's industrial sensors answer the same way — down to the identification objects operators actually query — so reconnaissance returns a plausible device instead of a tell.
Switch vendors from the console
Pick the persona that matches the plant you're defending. Changes are applied to your on-prem honeypot within about 30 seconds — no redeploy, no site visit, no SSH session.
BACnet/IP
UDP 47808- Tridium JACE-8000(default)
- Siemens Desigo PXC
OPC-UA
TCP 4840- Kepware KEPServerEX(default)
- Siemens SIMATIC S7-1500
Vendor-accurate across the ICS fleet
The rest of the industrial sensors ship with fixed decoy identities modelled on equipment you'd actually find on a plant floor or in a substation.
- Modbus/TCPSchneider Electric Modicon M340
- IEC 61850 MMSSiemens SIPROTEC 5
- PROFINETSiemens SIMATIC S7-1500 CPU
Every sensor is capture-only. The decoys answer, log, and attribute — they never execute anything and never reach back into your network.
Evidence to leadership
From evidence to a report you can hand to leadership.
- Executive summary, key points, and confidence-rated assessments written by AI — grounded only in cited evidence.
- MITRE ATT&CK technique tables and indicator-of-compromise appendix, auto-assembled.
- Export as PDF or Markdown with every source one click away.
How it works
From raw signal to defended decision.
- 01
Ingest
Pull in reporting, vendor feeds, and internal signal.
- 02
Attribute
Map activity to actors and MITRE ATT&CK techniques.
- 03
Decide
Surface priority questions and decision traces.
- 04
Act
Hand analysts evidence-backed answers.
Built for teams
One platform, shared across your analysts.
Why ThreatSpire
Built for analysts who have to defend their conclusions.
Evidence-first, always
No unsourced claims. Every assertion in ThreatSpire links back to the report, feed, or telemetry it came from.
- Source-linked claims
- Auditable decision trails
MITRE ATT&CK-native
Not bolted on. Actors, techniques, and detections share one shared vocabulary from the ground up.
- Group catalog seeding
- Technique-level coverage
AI-assisted, analyst-controlled
Drafts, gists, and report narratives generated with Amazon Bedrock stay grounded in cited sources — never hallucinated, always reviewable.
- Human-in-the-loop drafts
- Citations on every summary
Bring your threat intelligence into focus.
See ThreatSpire on your own actors and requirements.
Live · Deception Grid
Adversary telemetry from the ThreatSpire sensor mesh
Attacks logged
Unique adversaries
Countries of origin
Sensors live
Credentials captured
updated continuously