Part of Defend, in progress — Threat Intel and Security are now part of Defend, not separate products. This area is still being built: some screens, menu names and actions described here may not be available yet, or may still show the older Threat Intel or Security names.
Overview
Threat intelligence is part of Defend. It watches for exposure outside your clients' networks, such as leaked credentials, and surfaces it so you can act before an attacker does. It used to be documented as a separate product called Threat Intel. That standalone product is retired, and its features now belong to Defend.
What it covers
- Dark web and credential exposure: the email addresses of the users you manage are checked against Enzoic's breach-exposure data. Your clients see their dark web results in HCP. See Dark web monitoring in Defend.
- Breach alerts: what an exposure finding contains and how to respond. See Breach alerts in Defend.
- Lookalike domains and supply-chain vendors (in progress): these were part of the retired standalone product and aren't backed by the current dark web integration. Treat them as in progress until they're rebuilt in Defend.
Data source: dark web and credential-exposure monitoring is powered by Enzoic, per account email only. There's no domain, keyword, or paste-site scanning.
Pricing
Threat intelligence is part of Defend in the all-inclusive platform plan. It has no separate per-user price.
How it connects to the rest of Defend
Credential-exposure findings sit alongside Defend's endpoint alerts. When breach-response automation is set up, events go to the platform Bus (threatintel.breach_detected and related events), and a PSA ticket can be opened automatically. See Threat intelligence integrations in Defend.
FAQ
Is Threat Intel a separate product?
No. It's part of Defend. Older Threat Intel links open Defend, and some screens may still show the older name while the move finishes.
Does it search the live dark web (Tor)?
No. It uses curated breach-exposure data from Enzoic, which does the dark web collection.
Who uses it?
MSP security staff who monitor client exposure and set up breach response, and your clients, who see their dark web results in HCP.