How it compares

A small UK team weighing this up usually looks at three other things: an external scanner, an enterprise intelligence platform sold by the module, and what Microsoft now includes with Defender. Here is the honest row by row, including what ThreatCast does not do.

The three we are compared with

Intruder: External vulnerability scanning. about $239 to $499 a month source
SOCRadar: Threat intelligence, attack surface and dark web, sold as modules. from $3,950 a year per module; $25,000 to $40,000 for the same scope source
Microsoft Defender TI: Actor and CVE intelligence inside Defender XDR. included with E5 and Defender for Endpoint P2 source

Prices are each vendor's published list price as read on 15 October 2026; they change, so check the source. ThreatCast is £149 to £699 a month for every row below marked yes.

Capability by capability

Capability	ThreatCast	Intruder	SOCRadar	Microsoft Defender TI
Company threat level from fixed rules, with the reasons	Yes	No	Partly	No
Exploited CVEs matched to the technology you declare Microsoft covers Microsoft products; Intruder covers hosts it scans	Yes	Partly	Add-on	Partly
CVEs confirmed on your devices through your EDR or scanner	Yes	Yes	Add-on	Yes
Actors ranked for your sector and country	Yes	No	Yes	Yes
Ransomware claims in your sector and naming your suppliers	Yes	No	Yes	No
Stealer logs and leaked credentials for your domains	Yes	No	Add-on	No
Lookalike domains, with whether each can send mail	Yes	No	Yes	No
Your own domains checked from outside (DMARC, certificate, headers, exposed services)	Yes	Yes	Yes	No
Continuous port and vulnerability scanning of your hosts ThreatCast reads Shodan InternetDB; it does not scan	No	Yes	Yes	No
Suppliers rated from public sources and re-checked daily	Yes	No	Add-on	No
Would we catch it: your top threats against your own detection rules	Yes	No	No	No
Generated detection queries (KQL, Sigma, EDR)	Yes	No	Partly	Partly
Indicator block queue with approval and push to Defender	Yes	No	Add-on	Partly
AI explanations with a monthly cap and an audit entry for every call	Yes	Partly	Partly	Partly
Executive page, board pack, decision log and proof of value	Yes	Partly	Partly	No
Takedown requests for lookalike domains Planned: a prefilled abuse report to the registrar	No	No	Yes	No
Works with a non-Microsoft stack	Yes	Yes	Yes	No

Yes: included at the entry tier. Partly: present but limited. Add-on: a separately priced module. No: absent.

If you already have Microsoft E5 or Defender for Endpoint P2

Microsoft now includes its threat intelligence with Defender XDR, and it is good on Microsoft products: actor profiles, CVE intelligence, hunting. Keep it. ThreatCast adds what it does not look at: your suppliers, lookalikes of your domains, leaked credentials for your staff, the parts of your stack that are not Microsoft (your firewall, VPN, backup and mail gateway vendors), a threat level your board can read, and detection queries for Sentinel written from the threats ranked for you. Both run side by side; the Defender connector brings device confirmations in.

What ThreatCast does not do

It does not scan your hosts for open ports and vulnerable versions. It reads what Shodan already knows and what your own scanner or EDR reports. If you have nothing scanning from outside, Intruder is a good fit alongside it.
It does not file takedown requests for you yet. It tells you which lookalikes can send mail and gives you the registrar; a prefilled abuse report is on the roadmap.
It is not a managed service. Nobody watches your alerts overnight; it makes a small team's own hours count.

Run the free check on your domain See the demo

The three we are compared with

Intruder: External vulnerability scanning. about $239 to $499 a month source

SOCRadar: Threat intelligence, attack surface and dark web, sold as modules. from $3,950 a year per module; $25,000 to $40,000 for the same scope source

Microsoft Defender TI: Actor and CVE intelligence inside Defender XDR. included with E5 and Defender for Endpoint P2 source

Prices are each vendor's published list price as read on 15 October 2026; they change, so check the source. ThreatCast is £149 to £699 a month for every row below marked yes.

Capability by capability

Capability	ThreatCast	Intruder	SOCRadar	Microsoft Defender TI
Company threat level from fixed rules, with the reasons	Yes	No	Partly	No
Exploited CVEs matched to the technology you declare Microsoft covers Microsoft products; Intruder covers hosts it scans	Yes	Partly	Add-on	Partly
CVEs confirmed on your devices through your EDR or scanner	Yes	Yes	Add-on	Yes
Actors ranked for your sector and country	Yes	No	Yes	Yes
Ransomware claims in your sector and naming your suppliers	Yes	No	Yes	No
Stealer logs and leaked credentials for your domains	Yes	No	Add-on	No
Lookalike domains, with whether each can send mail	Yes	No	Yes	No
Your own domains checked from outside (DMARC, certificate, headers, exposed services)	Yes	Yes	Yes	No
Continuous port and vulnerability scanning of your hosts ThreatCast reads Shodan InternetDB; it does not scan	No	Yes	Yes	No
Suppliers rated from public sources and re-checked daily	Yes	No	Add-on	No
Would we catch it: your top threats against your own detection rules	Yes	No	No	No
Generated detection queries (KQL, Sigma, EDR)	Yes	No	Partly	Partly
Indicator block queue with approval and push to Defender	Yes	No	Add-on	Partly
AI explanations with a monthly cap and an audit entry for every call	Yes	Partly	Partly	Partly
Executive page, board pack, decision log and proof of value	Yes	Partly	Partly	No
Takedown requests for lookalike domains Planned: a prefilled abuse report to the registrar	No	No	Yes	No
Works with a non-Microsoft stack	Yes	Yes	Yes	No

Yes: included at the entry tier. Partly: present but limited. Add-on: a separately priced module. No: absent.

If you already have Microsoft E5 or Defender for Endpoint P2

What ThreatCast does not do

It does not scan your hosts for open ports and vulnerable versions. It reads what Shodan already knows and what your own scanner or EDR reports. If you have nothing scanning from outside, Intruder is a good fit alongside it.

It does not file takedown requests for you yet. It tells you which lookalikes can send mail and gives you the registrar; a prefilled abuse report is on the roadmap.

It is not a managed service. Nobody watches your alerts overnight; it makes a small team's own hours count.

How it compares

The three we are compared with

Capability by capability

If you already have Microsoft E5 or Defender for Endpoint P2

What ThreatCast does not do

Loading the page

How it compares

The three we are compared with

Capability by capability

If you already have Microsoft E5 or Defender for Endpoint P2

What ThreatCast does not do