The retailer had trained its employees to spot phishing. It had run simulations. Then came a problem the training could barely touch: fake websites aimed at its shoppers. In an anonymized 2020 case study, SOCRadar described attackers registering as many as 50 lookalike domains in a single day. Ninety percent, the company said, targeted customers outside the retailer’s perimeter. The security boundary was doing very little for the people buying the goods.
THE SHORT VERSION
- SOCRadar watches the internet-facing risks attached to a business.
- Five modules connect exposed assets, stolen identities, brand abuse, attackers and vendors.
- Free tools open the door; paid subscriptions add capacity and workflows.
The shoppers were outside
That case explains SOCRadar more clearly than the phrase “Extended Threat Intelligence.” A company can control its own servers and still have its name printed above a criminal’s checkout button. A password stolen elsewhere can return as a login attempt. A supplier can expose a document that the company itself guarded carefully. Ownership and exposure have stopped being the same thing.
SOCRadar’s retail customer chose the platform after a 14-day trial, according to the case study. It wanted fraudulent-domain detection, compromised-credential alerts and intelligence it could feed into existing security tools. The document names no retailer, so treat it as a vendor account of the purchase. Still, the buying logic is concrete: training employees had left an entire population of potential victims beyond reach.
Co-founders Huzeyfe Onal and Ahmet Kurukose established SOCRadar in 2019. Onal, the CEO, brought experience from telecommunications and security roles; Kurukose became CTO. Their company’s mission centers on making threat intelligence accessible. Onal’s phrase, “companies of all sizes,” matters here. The business is selling a capability that smaller security teams may struggle to assemble themselves.
Five lenses, one investigation
The cloud platform now has five modules. Attack Surface Management discovers internet-facing assets and checks for exposures. Cyber Threat Intelligence supplies context about attackers, vulnerabilities and malicious infrastructure. Advanced Dark Web Monitoring follows leaks and underground activity. Brand Protection watches impersonation. Supply Chain Intelligence assesses vendors. Security operations teams, fraud specialists and managed security providers can approach the same problem from different directions.
THE OUTSIDE VIEW / FIVE CONNECTED LENSES
Consider an illustrative investigation: an analyst finds a suspicious domain, checks whether it imitates the brand, examines related infrastructure and assigns a response. That is the appeal of putting the modules together. SOCRadar also advertises connections to tools such as Splunk and Microsoft Sentinel. The intelligence needs to reach the place where work already happens.
Recorded Future and Flashpoint operate in overlapping territory, including external intelligence and AI-assisted analysis. SOCRadar’s distinctive package is the combination of these five modules, modular purchasing and a free entry point. Breadth alone cannot establish better detection. For a buyer, the useful comparison is whether the platform finds relevant evidence and gets it into the team’s workflow.
The discovery that became a dispute
On September 24, 2022, SOCRadar researchers informed Microsoft about a misconfigured endpoint. Microsoft secured it and acknowledged that business transaction data could have been accessed without authentication. The first failure was mundane: a configuration mistake. Microsoft said it found no indication that customer accounts or systems had been compromised.
The discovery became part of SOCRadar’s BlueBleed reporting. Microsoft disputed the reported scope, saying duplicate records inflated the numbers, and criticized a public search tool on privacy grounds. SOCRadar’s CISO told SC Media that separate branches could represent distinct entities. He also said the company deleted exposed data and subsequently removed filename metadata, leaving a domain-based yes-or-no check.
Finding an exposure is one job. Deciding what it means is another.THE BLUEBLEED LESSON
The disagreement is useful because it exposes the difficult part of this business. Collecting evidence does not settle attribution, impact or disclosure. A buyer should want the reasoning behind an alert, along with a way to challenge it.
Teaching the alarm to wait
SOCRadar’s August 2025 Agentic Threat Intelligence announcement addressed another bottleneck: analysts drowning in disconnected alerts. Its initial phishing workflow combined agents that compare logos, recognize text inside images, inspect website content and analyze alarms. Users can configure steps and scoring thresholds. A familiar-looking page becomes something to evaluate through several signals.
The shift responds to a limit of collecting more intelligence: somebody still has to decide which findings matter. In July 2025, the company had introduced an MCP Server to connect AI assistants with live platform data and tools. Together, the releases moved its pitch toward investigation and action. Configurability is valuable precisely because alarm thresholds require judgment.
Free is the front door
The commercial structure follows the same modular logic. As checked in October 2026, Cyber Threat Intelligence Essential listed at $14,750 annually; Advanced Dark Web Monitoring Essential at $4,550. Broader packages require quotes. Fixed packages have usage limits, and buyers should check integration entitlements. Free access offers a way to explore before committing.
Separate packages. Limits apply.
Funding helped finance expansion: $5 million from 212 in 2023, then $25.2 million in a 2024 Series B led by PeakSpan Capital with Oxx. That announcement separated more than 25,000 freemium customers from more than 600 active paid customers. The cohorts measure different things. In August 2026, SOCRadar reported over 50,000 organizations on its free version and No. 542 on the Inc. 5000.
Borrow the habit
The practical lesson is available before purchase. Inventory what outsiders can see. Test one consequential exposure. Decide who owns the response. Then evaluate whether the intelligence changes that person’s next action. A small team can use that sequence to scope a trial; a managed provider can supply the people who follow through.
The approach loses value when alerts have no owner, when evidence cannot be validated or when the problem sits entirely inside systems external monitoring cannot observe. SOCRadar’s promise depends on a handoff. Somebody has to close the exposed service, reset the credential or pursue the fake storefront. Seeing farther matters when it changes what happens next.