Intel 471
Sells cybercrime threat intelligence gathered by human operators inside criminal forums.
On the record
Checkpoint: Thoma Bravo's ownership hits year 5, raising odds of a sale, dividend recap, or exit process
The call
Intel 471's human sources into criminal forums keep it relevant as AI eats the reporting layer, but Flashpoint's broader coverage and an approaching Thoma Bravo exit are the two things that will decide what this company becomes.
Intel 471 sends human researchers into dark-web criminal forums to gather real intelligence that companies use to protect themselves from hacks and fraud. This work is hard to copy because it takes skilled people who build trust in dangerous spaces over years, but competitors like Flashpoint, Recorded Future, and Mandiant are already doing the same thing, and Flashpoint reportedly covers more ground. The company is currently owned by Thoma Bravo, a private-equity firm, so what happens next depends less on whether Intel 471 can outrun its rivals and more on when Thoma Bravo decides to sell the company or cash out, which typically happens five to seven years after a buyout.
Why
01
AI pressure: LLM-based threat-intel assistants (Recorded Future's Gemini integration, Microsoft Security Copilot, Intel 471's own Pathfinder). AI summarizes and speeds up reporting on top of the data, it doesn't replace the humans who infiltrate criminal forums to get it. Could AI do the core job? Unlikely.
02
Bigger players: Flashpoint, and Google (Mandiant) and Mastercard (Recorded Future). Flashpoint already covers more ground, credential databases, brand protection, geopolitical tracking, while big platforms bundle threat intel into broader security suites. Could a giant copy it? Probably.
03
What protects it. Years of embedded human operators inside closed criminal forums that can't be scraped or automated, plus locked-in enterprise workflows.
What would change this call
Thoma Bravo announces a sale, dividend recap, or banker mandate for Intel 471 within 6-12 months. Shows whether the PE exit is a clean sale or a distressed fire-sale, shaping equity outcomes.
Intel 471 or Verity471 closes the coverage gap with Flashpoint in credential/brand/geopolitical data. Shows whether the named competitive disadvantage is narrowing or widening.
Recorded Future, Mandiant, or Google/Mastercard bundles underground HUMINT-style intel into their platforms. Shows whether giants are closing the HUMINT moat that currently protects Intel 471.
Intel 471 or Verity471 closes the coverage gap with Flashpoint in credential/brand/geopolitical data. Shows whether the named competitive disadvantage is narrowing or widening.
Recorded Future, Mandiant, or Google/Mastercard bundles underground HUMINT-style intel into their platforms. Shows whether giants are closing the HUMINT moat that currently protects Intel 471.
Key numbers
- ~$32.3M estimated revenue
- 154 to 194 employees
- 5 years under Thoma Bravo ownership
Named risks
- Thoma Bravo exit (secondary, dividend recap, or trade sale) after ~5-year hold could land as distressed outcome.
- Coverage gaps versus Flashpoint in credential database, brand protection, geopolitical tracking.
- CrowdStrike, Microsoft, Google bundling threat intel into broader platforms erodes standalone differentiation.
- Unresolved CEO transition date discrepancy (2023 vs 2025) suggests possible undisclosed governance issues.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Flashpoint | gaining on | Larger exposed-credential database, broader brand-protection and geopolitical coverage as of 2026-07-15 |
| Recorded Future (Mastercard) | contesting | Ships Pathfinder AI assistant with Mastercard-scale backing, noted 2026-06 |
| Mandiant (Google) | contesting | Gemini in Threat Intelligence adds NL query and APT summarization, 2026 |
| CrowdStrike | gaining on | Runs its own HUMINT teams infiltrating criminal forums, bundled into Falcon platform |
Questions people ask
- Is Intel 471 profitable?
- Yes. Owner Thoma Bravo described Intel 471 in a February 11, 2026 podcast as having 'disciplined, profitable growth' with 'exceptional retention' under private equity ownership since 2021, though exact profit figures were not disclosed.
- Who owns Intel 471?
- Private equity firm Thoma Bravo made a strategic investment in Intel 471, announced September 8, 2021 and closed September 27, 2021. Thoma Bravo still listed Intel 471 in its active portfolio as of February 18, 2026.
- Could AI replace Intel 471's threat intelligence?
- Not easily. CEO Jason Passwaters said in an August 20, 2025 interview that HUMINT infiltration of closed criminal forums can't be replicated by scraping. Verity471's AI Assistant, launched July 30, 2025, only aids summarization, not human collection.
- Who is Intel 471's biggest competitor?
- Flashpoint is the closest direct rival. A July 15, 2026 comparison found Flashpoint has a larger exposed-credential database and broader coverage of brand protection and geopolitical tracking than Intel 471.
- What is Intel 471's flagship product?
- Verity471, launched July 30, 2025, unifies the company's threat exposure, cyber threat intelligence, and threat hunting portfolios into one platform, adding an AI Assistant for summarizing and correlating intelligence reports.
- Has Intel 471 made any acquisitions?
- Yes. It acquired SpiderFoot for attack surface management in November 2022, then acquired Cyborg Security, maker of the HUNTER threat-hunting platform, in May 2024, forming the basis of its 471HUNTER product.
Timeline
- 2026-06-09Launched free CTI Maturity Pulse Check self-assessment tool based on CTI-CMM v1.3
- 2026-03-11Verity471 named finalist for 2026 SC Awards Best Threat Intelligence Technology
- 2026-02-11Thoma Bravo podcast describes Intel 471 growth as disciplined, profitable, high retention
- 2025-10-09Verity471 won Security-as-a-Service Innovation of the Year at CyberSecurity Breakthrough Awards
- 2025-07-30Launched Verity471 unified CTI platform with AI Assistant
- 2024-06-04Launched 471 Attack Surface Protection built on SpiderFoot acquisition
- 2024-05-01Acquired Cyborg Security, forming 471HUNTER threat-hunting product
- 2022-11-01Acquired SpiderFoot for attack surface management
- 2021-09-27Thoma Bravo strategic investment in Intel 471 closed
- 2014Intel 471 founded by Mark Arena and Jason Passwaters
Revision history
21 July 2026
First assessed. Protection under test. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Jason Passwaters, Intel 471 interview (2025-08-20)
- Thoma Bravo Makes Strategic Investment in Intel 471 (2021-06-29)
- Thoma Bravo Portfolio: Intel 471 (2026-02-18)
- Management and Employees List
- Intel 471 Named to the 2021 Inc. 5000 (2021-08-16)
- Intel 471 Applauded by Frost & Sullivan (2024-09-17)
- Behind the Deal Podcast with Thoma Bravo and Intel 471 (2026-02-11)
- ZoomInfo profile (2024-01-16)
- Intel 471 Teams
- TITAN Cyber Intelligence Platform
- Intel 471 Sets New Standard in Intelligence-Driven Threat Hunting (2026-03-06)
- Intel 471 Launches Attack Surface Protection (2024-06-04)