Recorded Future Reviews

We're using this product to support our front team with regard to threat intelligence and provide brand protection and prevent cyber threats. It also provides a strategic perspective for the company executives.

I like the ability to conduct and build any query I want without any limitations. It also provides a variety of sources which is great.

I think the user experience could be improved. I'd also like to see an improvement in the visibility of malware and international APT attacks. Those are the two important things for me right now. In any future release, I'd like to see a greatly simplified ability to extract data from their tickets. 

I've been using this solution for five years. 

The solution is stable. 

The solution is scalable; we have three users in the company and around 20-30 users among our customers. 

The technical support is quite good. 

The implementation is not overly simple but not overly complex either. Deployment takes a few minutes. 

The solution is very expensive, costing several thousands of dollars per year. The cost depends on the model you buy and the API but I think it's worth the investment. 

I recommend this solution as it's currently the best on the market for threat intelligence. It's not perfect, though, so I rate it eight out of 10. 

Recorded Future integrates well with other security solutions in a security stack. It is one of the best things you can spend your money on to obtain better results that are more tailored to your organization.

From the feedback I've received from my clients, the most valuable feature is the ability to personalize the solution. The ability to have a customized dashboard makes it easy for leadership and management to obtain details. Intelligence analysts or security engineers care about the actions and results, whereas the leadership care about graphs and reports. Recorded Future helps my clients create reports and also determine how the intelligence that is generated is consumed. They can easily show the benefits to the leadership without them having to invest 10 hours a week into transferring numbers into a graph or into creating reports.

At present, my clients need to be trained by me or another organization on how to use Recorded Future and how to get the best out of it as an analyst, engineer, and administrator. It would be better if clients could directly learn these things without having to go through me or other organizations.

I've been using Recorded Future for three years. I have worked with it deployed both on-premises and on AWS cloud.

The uptime of the solution is great. I've encountered only a few situations in the past where I needed to use Recorded Future and it wasn't immediately accessible. However, I was able to access it after about three hours.

It's definitely scalable.

My experience with technical support has been okay.

I found the initial setup to be easy. On-premises deployments take a few hours, and cloud deployments may take longer. Depending on the client and their level of expertise, the integration of the solution may taka a few months to two years. 

I usually deploy the solution myself for my clients.

The biggest disadvantage of Recorded Future is the cost here in Eastern Europe. The solution is correctly priced for big companies who have the money to invest in such solutions. Also, the solution is useless on its own, which means that you have to invest in other solutions with which Recorded Future can be integrated.

At present, Recorded Future can cost 60,000 euros per year. I am able to offer my clients a 5% to 10% discount, but in this region, the cost is still prohibitive even with the discount.

If Recorded Future were more flexible in terms of price, there would be better sales opportunities in Europe and Eastern Europe, in particular, because we have more small- and medium-sized companies here.

Recorded Future is a great tool overall for threat intelligence. I think it's one of the best to add to an organization's security stack. However, the licensing costs are extremely high for small- to medium-sized companies. As such, I would rate it at nine on a scale from one to ten, with one being the worst and ten being the best.

Recorded Future has some important strengths. It has a long history of success in the market and is known for excellent threat intelligence. Its team is skilled at using AI to search for and report on threats. For many years, it was seen as the best in the industry.

While I don't think the tool is weak, its position isn't as dominant as it once was. Other companies like CrowdStrike and Mandiant are now challenging them in many areas. One downside is that Recorded Future can be complex for customers to use and understand. This isn't easy for clients to navigate.

From my understanding, Mandiant has been offering lower prices on many large client cases over the past year. They've been challenging the pricing model and setup of companies like Recorded Future. This has been difficult for the tool , as they were used to being almost alone in the market. After being bought by Google, Mandiant has gained a lot of power and seems to have more flexibility in pricing.

My main criticism of Recorded Future has been the complexity of its licensing model and the difficulty clients have understanding the different modules. This complexity likely stems from Recorded Future's historical position as a dominant market player, which allowed them to create numerous add-on modules. The pricing for these systems and services is generally quite high.

Initially, these systems required significant manual work, justifying the high costs. However, today, the process is becoming increasingly automated. This puts price pressure on all providers, including Mandiant and others. Despite the challenging market with frequent cyberattacks, I think it will be difficult for these companies to maintain the high prices they've charged in the past.

The solution has a good technical team. It's part of the package that customers buy into. Each client has an account manager and direct access to live customer support. The team responds fast. 

Positive

I'd still recommend Recorded Future for large organizations, but they must understand the business model and pricing. The quality of Recorded Future, Mandiant, and CrowdStrike seems quite similar, though I'm not a deep technical expert. The choice depends on the customer's needs - not all customers need every feature.

I can't definitively say which is better regarding AI technology as I haven't technically compared them myself. The solution might be advantageous due to their extensive experience in the area. However, with Google's resources behind Mandiant, they likely have significant capabilities, too. Google's resources are probably on par with Microsoft's, so they could easily ramp up their technology if needed.

When discussing AI in these threat intelligence setups, clarifying what we mean is important. Often, it's a system of rules analyzing abnormalities and triggering actions. I frequently ask what people mean by AI in different contexts because it often comes down to rules: if certain events occur or parameters are exceeded, what actions should be taken? These systems analyze data in real-time and feed it to the Security Operations Center to create a more efficient setup with fewer false positives.

False positives are a major challenge, especially for smaller companies. If they don't have well-trained IT staff, dealing with numerous false positives can be more trouble than it's worth. I've seen smaller organizations struggle with this - sometimes, it's almost better for them not to have these systems if they can't understand and manage them effectively.

I rate the overall product as nine out of ten. 

I am working on various alerts related to brand impersonation, typosquatting, abuse domain, and other similar cases. Since the use cases are built-in, I have not created any custom rules.

Recorded Future is essentially a shared intelligence platform that allows us to collect data from various sources, such as social media. Recorded Future's approach is based on entities. For instance, I have added my domain name, "abc.com," to the watch list. The platform triggers alerts whenever it is detected on social media platforms like Twitter or GitHub repositories. So, if anyone uses my domain name "abc.com," Recorded Future detects it and sends me an alert, and I can investigate if it's suspicious activity.

One of the most valuable features of Recorded Future is its ability to detect credential sales on the dark web for websites. It can collect data from various sources, including social media and the dark web. If any suspicious activity is detected, such as the sale of website credentials, I can investigate it and report it to the relevant team. For example, if my domain is sold on the dark web, Recorded Future can detect it. 

Recorded Future's threat intelligence platform covers everything from social media to the dark web, allowing for comprehensive recovery and protection of compromised credentials.

I have been using Recorded Future for four months and am still exploring its features. As for improvements, I would suggest enhancing the alert system. For example, when investigating alerts related to my domain "abc.com," I noticed that the system sometimes detects false positives. It detects other words that contain the letters "abc" like "ablex" or "ableg" which can be misleading. It would be helpful if the system could improve its accuracy and only detect alerts that are truly relevant to my domain.

I would recommend adding a feature that can specifically detect my domain name, "abc.com," and not just words containing "abc" or similar letters. It would further reduce false positives and improve the overall accuracy of the system.

I have been using it for almost four months. I am using the latest version.

I would rate the stability a nine out of ten.

I would rate scalability a two out of ten.

We have it deployed on the cloud. As an analyst, I investigate alerts and escalate them to other teams. I have no idea about integrations, but I find it to be a very friendly tool for a threat intelligence platform.

Recorded Future covers the whole area of social media in terms of threat detection. I would suggest it to everyone as it is a very user-friendly platform that detects all things related to your domain, from the dark web to social media.

Overall, I would rate the solution an eight out of ten.

We use Recorded Future for threat intelligence.

The most valuable feature is Recorded Future's protection of exposed customer data on the hardware side.

When you add one website to Recorded Future, it should automatically call all other websites and social media platforms.

I deployed Recorded Future for a client. They've used the product for more than three years. 

Every cloud solution is stable. Recorded Future also has auto-scaling. 

Recorded Future is a scalable product. 

Setting up Recorded Future is straightforward.  It's a cloud-based service, so you only need to contact their team and ask them to create an instance. Everything is hosted on their cloud so it takes no time to deploy.

We see an ROI from using Recorded Future. It has dark web monitoring, which our previous solution lacked.

We have a yearly subscription. The license is based on the modules and features you use. For example, it's a different cost if you want to cover the dark web and deep scanning. 

I rate Recorded Future seven out of 10. I can recommend Recorded Future, depending on a company's budget and the features it needs. 

We used Recorded Future to find many things like passwords captured in the dark net and websites selling other information regarding our domains. We use the solution to search for our brand or other institutions on the darknet.

Recorded Future helps our organization to be a step ahead of future attacks.

The most valuable feature of Recorded Future is how it detects everything regarding our domain.

Recorded Future is a very expensive solution, and its pricing could be improved.

We recently acquired Recorded Future.

Recorded Future is a stable solution, and we haven't experienced any downtime with it.

Recorded Future is a scalable solution. Around five users are using the solution in our organization. We are spread across the country and have around 30,000 endpoints for Recorded Future.

We are still learning how to use the solution. I think Recorded Future has a normal deployment or a normal learning curve.

It takes around three months to deploy the solution.

Before choosing Recorded Future, we evaluated other options like Mandiant and FortiRecon. We chose Recorded Future because it gives much better results.

Organizations must have at least two dedicated technicians working with the solution since the learning curve is a little big. To use the solution to its maximum capacity for the first year, having at least two technicians working with Recorded Future is better.

Overall, I rate Recorded Future ten out of ten.

As an analyst serving several clients, our team relies on Recorded Future to receive timely alerts related to using underground screen searches. This involves using an algorithmic code feature to gather the specific data we need, which then triggers an alert for us. When we receive the alert on the platform, we assess it to determine if it pertains to our client's needs. If it does, we report our findings to the client.

I have been working with these types of services and tools for a while. When compared to other tools, Recorded Future provides good alerts. For example, clients' credentials, documents posted from GitHub, and other testing sites.

The most valuable features of Recorded Future are the useful alerts it provides. If we are monitoring a domain, the solution will provide us with an alert in a prompt manner. It is simple for clients to receive alerts. The advanced search is useful for more accurate filter results.

The solution could improve in reducing the false positives. However, most of the other tools on the market have false positives. If they enhance their data algorithm, it could improve the accuracy of results and minimize false positives. Identifying patterns of false possibilities can aid in developing better reporting features that could potentially eliminate them in the future. This recording feature tool could benefit from adopting similar techniques utilized by other tools to enhance its functionality. By doing so, it could minimize the need for manual efforts in distinguishing true positives from false positives, ultimately reducing the workload.

In a future release, it would be beneficial if the vendor would add more features to create one full solution that can meet the needs of the whole cybersecurity incident purpose.

I have been using Recorded Future for approximately four years.

I have never experienced any downtime during our production hours. Maintenance work is typically scheduled during off-peak times, so it does not cause any disruptions. As a result, we can confidently rely on this tool for our work without any issues.

The solution provides beneficial results. 

I rate the scalability of Recorded Future a nine out of ten.

We faced some difficulties initially due to our unfamiliarity with the tool. However, after reaching out to their tech support team, we received excellent assistance from their cooperative staff. With their help, we were able to resolve our issues quickly and efficiently. However, there have been some times when the knowledge of the agent could have been better.

I rate the support of Recorded Future an eight out of ten.

Positive

I have previously used other tools, such as legacy tools.

The price of the solution is worth it. The overall performance of the solution outweighs the cost.

I rate Recorded Future nine out of ten.

Recorded Future covers a lot of different use cases. For example, we are using it for threat intelligence research. We do use the tool to make active research on what is found around the threat. We look at patterns, for example, and see what can be elaborated on from that. 

In another use case, we use it to get all the IOCs registered and use it after that to allow other intelligence technologies to feed into that to prevent any issues for customers.

We can also use it for active monitoring in the customer interface. We can monitor the business side of a campaign. We can monitor for specific threats or market activity on the dashboard. We can develop queries to run in a continuous mode in order to get the best reviews. 

With all the related IOCs we were able to provide really deep information about the impact, about where we are with the big campaign, and also provide tools that were a priority to be a preventative block on the customer side. It was helpful in that sense.

As a threat intelligence tool, it's very helpful.

The stability is very good.

Technical support has been helpful.

It's really easy to create dashboards and modify them to fit what you need.

The product is too big. The vast majority of data you have. You can run queries and you can get more data than you probably want, and you have to take a deep dive a lot of the time.

The solution would benefit from introducing automation. When you are running a query just to get the data you're looking for, the result comes back so big, as it will be able to return a lot of results from different sources. Sometimes it could be a bit messy. Automation would help streamline and simplify.

The tool can be pricey, especially for smaller companies.

I was working with the tool in November. I've used it in the last 18 months or so.

I have a good impression of the stability of the product. Any time that we needed it, it was there. It is always up and running and we didn't have any issues with it. There are no bugs or glitches, for example, and it didn't crash or freeze.

We haven't attempted to scale or optimize the solution. I can't say how easy or difficult the process would be.

We only have one license feed and have up to ten users on it. We're already beginning to increase usage a bit.

Technical support has been pretty good so far. I haven't had any issues with them. We're quite satisfied with the level of service provided.

I didn't previously use a different solution.

By the time I joined the company, the tool was already in place. Therefore, I can't speak to the initial implementation or deployment process. I can't say if it was difficult or simple or how long it took.

As a cloud solution, it doesn't require much maintenance. Anything else, such as automation using a document, would be on our side, and we'd update it as needed.

We haven't seen an ROI. The area that it was used for, as a report, initially was assigned to be used internally only and after that, we decided to try it out as a service to our customers. However, we never sold that service, so we never got a return immediately. 

The pricing is quite high compared to other intelligence tools.

The licensing is based on the user and also the amount of usage. It's expensive in terms of what you can get. You need to be a very sizable company in order to get any real value as it's quite a sizable tool. There are other tools on the market that are less expensive - especially for smaller companies.

There aren't any additional costs above the standard licensing fee, although there are some add-ons you can get that can expand the solution's capabilities. 

At the moment the solution is hosted on a SaaS. It's hosted on their own cloud that they are managing. We only have access to a part that is completely isolated from other customers and in another area. 

As far as I know, we are using the latest version of the solution. As it's cloud-based, it's constantly updated independently.

If a company is ready to introduce the solution, my main recommendation would be to have a really, really good threat intelligence team working on-site beforehand. If you don't have a good design or a good knowledge of threat intelligence you will never get the insights you need or use the tool to its full potential.

I'd rate the solution nine out of ten. It's quite an expensive solution. If it was less expensive, I'd likely rate it higher.