Recorded Future Reviews

Recorded Future is accessed through a web service portal. It is a cloud-based service, hosted either on Amazon or Microsoft. Their services employ sophisticated data mining techniques, resulting in a clear semantic ontology. This is known as "chain link" intelligence referencing in 33 languages.

I use Recorded Future to monitor topics of interest, not only for brand recognition but also for cyber threat intelligence. The solution helps me understand emerging security threats and provides insight into activities such as supply chain delays or shortages of materials. I have also used the solution for open-source intelligence and criminal forensic investigations, as well as data feed analysis to determine evidence that can be used to support high-level business and M&A activities.

Data curation is a service I wrote about in a white paper a decade ago. Active data curation is a specific nuance in different datasets. The Fourth Amendment states that a search or seizure must be conducted with legally entitled authorities and permits. As a consumer of a data set, I have no legal proxy control over the way the data was collected. All of the Amendments do not apply to me as a consumer of a product that is for sale to anyone willing to pay for the fees. Data enrichment processes can be used to collect original data sets, such as from social media platforms, to create a corpus of knowledge for exploration. Companies can do background investigations using similar techniques as Recorded Future, with no outward appearance of the functions being done. Law enforcement can do searches without tipping off targets of their investigation. Data fusion is the process of taking fifty different datasets and using them to create a single, unique dataset to understand an event. Cybersecurity requires understanding every moving piece and part. Recorded Future can do historical analysis to see the difference between them and other structured approaches. By 2025, we can have a recorded history of what has been going on to predict the future and likely outcomes.

Recorded Future has some important strengths. It has a long history of success in the market and is known for excellent threat intelligence. Its team is skilled at using AI to search for and report on threats. For many years, it was seen as the best in the industry.

While I don't think the tool is weak, its position isn't as dominant as it once was. Other companies like CrowdStrike and Mandiant are now challenging them in many areas. One downside is that Recorded Future can be complex for customers to use and understand. This isn't easy for clients to navigate.

From my understanding, Mandiant has been offering lower prices on many large client cases over the past year. They've been challenging the pricing model and setup of companies like Recorded Future. This has been difficult for the tool , as they were used to being almost alone in the market. After being bought by Google, Mandiant has gained a lot of power and seems to have more flexibility in pricing.

My main criticism of Recorded Future has been the complexity of its licensing model and the difficulty clients have understanding the different modules. This complexity likely stems from Recorded Future's historical position as a dominant market player, which allowed them to create numerous add-on modules. The pricing for these systems and services is generally quite high.

Initially, these systems required significant manual work, justifying the high costs. However, today, the process is becoming increasingly automated. This puts price pressure on all providers, including Mandiant and others. Despite the challenging market with frequent cyberattacks, I think it will be difficult for these companies to maintain the high prices they've charged in the past.

Being a financial organization, we had a lot of domains, and we were using a lot of public-facing applications. We had listed our public IPs over there, and if any of our licensed applications were found on some sort of dark web or anonymous or rogue IP, or a fake application was being run by using our domain name or using our logo or trademark pictures without authorization, Recorded Future reported it to us.

We were using the cloud service. We were just using it as SaaS.

In one particular case, an impersonation attempt was made on social media sites. Our executive's name was being used, and people were offering jobs. Fake IDs were created on behalf of our executive management, and they were offering jobs or offering different services on behalf of our organization. We took it up with Recorded Future. We reported their IDs. If it was on Twitter or Facebook, they took it up with them, and they blocked and took down their IDs. This was one of the cases that we experienced.

Other than that, we saw an application that was published on Play Store, which was using our graphics and logos. It was also like an impersonation attempt. The application was using our logo and offering services on our behalf. We requested Recorded Future. They were very responsive. They initiated a request with Google, and they took it down within a few days.

I am currently working with Recorded Future's cloud solution. We provide Recorded Future to our customers as a reseller. We provide the customers with support on the API integration and the bidirectional integration. Mainly, people want the Threat Intelligence Cloud from Recorded Future.

Most of the threat intelligence cloud platforms are one-directional solutions, and they just fix the feeds from the cloud, so once they need to build a bidirectional tool, the product should have a third-party tool as a TIF solution or an open-source platform, like OpenCTI, or MISP platform, which is also an open-source platform. The open-source platforms allow Recorded Future to have bidirectional to compare the internal IOCs with the external IOCs and get the common IOCs so that the users can have a good visibility of their internal environment and see what the most APT has targeted in your environment. Recorded Future has developed a browser plug-in that is supported on most browsers, like Google Chrome, Edge, and Mozilla, that allows them to compare the feeds through the different platforms and multi-security control platforms to allow them to compare the threat intelligence feeds and the external feeds through the internal feeds. Once users open any vulnerability management or an SIEM solution and install the plug-ins through the platform or through the browser, so they need to open it through the web console, and the web console will have the bidirectional operation at the end of the the graphic user interface through the client itself through the browser.

I am working on various alerts related to brand impersonation, typosquatting, abuse domain, and other similar cases. Since the use cases are built-in, I have not created any custom rules.

Recorded Future is essentially a shared intelligence platform that allows us to collect data from various sources, such as social media. Recorded Future's approach is based on entities. For instance, I have added my domain name, "abc.com," to the watch list. The platform triggers alerts whenever it is detected on social media platforms like Twitter or GitHub repositories. So, if anyone uses my domain name "abc.com," Recorded Future detects it and sends me an alert, and I can investigate if it's suspicious activity.

The solution helps us check recent threat or attack-based activity on our company domain.

The tool is helpful in vulnerability assessment of zero-day vulnerabilities and phishing domains. The solution provides information on any domains of the organization that has undergone phishing or any other cyberattacks.

We're using this product to support our front team with regard to threat intelligence and provide brand protection and prevent cyber threats. It also provides a strategic perspective for the company executives.

I like the ability to conduct and build any query I want without any limitations. It also provides a variety of sources which is great.