ThreatSpire logoThreatSpire©

18 sensors. IT to grid.

Eighteen protocol sensors, from SSH to the substation.

ThreatSpire now impersonates real OT gear — Modicon PLCs, SIPROTEC relays, SIMATIC I/O, and power-grid personas — so attackers reveal intent before they touch production.

See how it works
console.threatspire.com / ctiledger
ThreatSpire CTILedger showing Intelligence Requirements cards with linked threat actors, priorities, and an open Decision Layer panel
The ThreatSpire CTILedger Intelligence Requirements view with the Decision Layer panel open.

Built natively on the MITRE ATT&CK® framework

180+ tracked adversary groupsEvery claim source-linkedEvidence-first by designMulti-tenant & SSO-ready

The problem

Threat intel shouldn't die in a PDF.

Reports are scattered across vendors and channels. Claims are made without sources. Findings rarely reach the people who decide what to hunt, block, or escalate — and by the time they do, the next campaign is already moving.

The platform

A console for analysts, not a dumping ground for feeds.

Actor Tracking & Notebooks

Auto-built profiles for the adversaries that matter, seeded from the MITRE ATT&CK group catalog and refreshed continuously.

Learn more

AI Threat Actor Reports

One-click, CTID-style Threat Actor Profile Reports — executive summary, confidence-rated assessments, MITRE TTP tables, and evidence with clickable sources, drafted by AI and grounded in citations.

Targeted-Industry & TTP Analytics

Charts that show who an actor is hitting and how — industries derived by AI from the evidence itself, techniques sourced from MITRE ATT&CK group data.

Intelligence Requirements

Turn your org's standing questions into tracked, signal-driven RFIs. The Requirement Agent drafts judgments and recommended actions for analyst review.

Learn more

Per-User Workspaces & Sharing

Every analyst gets their own workspace. Share requirements, cases, and IOCs at view, comment, or edit level — with comment threads and a full admin audit log.

Honeypot Sensor Fleet

Eighteen protocol sensors from IT to the plant floor: SSH, Telnet, HTTP/HTTPS, RDP, SMB, SIP/VoIP, MySQL, MSSQL, Redis, LDAPv3/AD, DNP3, Modbus/TCP, IEC 60870-5-104, IEC 61850 MMS, PROFINET, BACnet/IP, OPC-UA, and generic TCP/UDP.

IOC & Case Management

Validate, enrich, and manage indicator lifecycle. Investigations become shareable cases with Diamond Model analysis.

Learn more

Secure Multi-Tenant

SSO, MFA, role-based access, and strict per-tenant isolation built in from day one.

Decoy personas

Your attacker doesn't see a honeypot. They see your vendor's equipment.

A generic ICS responder gives itself away the moment an attacker fingerprints it. Ask a real Modbus PLC who it is and it answers with a vendor and a model number. ThreatSpire's industrial sensors answer the same way — down to the identification objects operators actually query — so reconnaissance returns a plausible device instead of a tell.

Switch vendors from the console

Pick the persona that matches the plant you're defending. Changes are applied to your on-prem honeypot within about 30 seconds — no redeploy, no site visit, no SSH session.

BACnet/IP

UDP 47808
  • Tridium JACE-8000(default)
  • Siemens Desigo PXC

OPC-UA

TCP 4840
  • Kepware KEPServerEX(default)
  • Siemens SIMATIC S7-1500

Vendor-accurate across the ICS fleet

The rest of the industrial sensors ship with fixed decoy identities modelled on equipment you'd actually find on a plant floor or in a substation.

  • Modbus/TCPSchneider Electric Modicon M340
  • IEC 61850 MMSSiemens SIPROTEC 5
  • PROFINETSiemens SIMATIC S7-1500 CPU

Every sensor is capture-only. The decoys answer, log, and attribute — they never execute anything and never reach back into your network.

ThreatSpire Threat Actor Profile Report for TeamTNT with executive summary, key points, and MITRE TTPs

Evidence to leadership

From evidence to a report you can hand to leadership.

  • Executive summary, key points, and confidence-rated assessments written by AI — grounded only in cited evidence.
  • MITRE ATT&CK technique tables and indicator-of-compromise appendix, auto-assembled.
  • Export as PDF or Markdown with every source one click away.
See a sample report

How it works

From raw signal to defended decision.

  1. 01

    Ingest

    Pull in reporting, vendor feeds, and internal signal.

  2. 02

    Attribute

    Map activity to actors and MITRE ATT&CK techniques.

  3. 03

    Decide

    Surface priority questions and decision traces.

  4. 04

    Act

    Hand analysts evidence-backed answers.

Built for teams

One platform, shared across your analysts.

Workspaces with Mine / Shared views
Workspaces with Mine / Shared views
Honeypot hits become cases automatically
Honeypot hits become cases automatically
Decision Layer: judgment and action, separated
Decision Layer: judgment and action, separated

Why ThreatSpire

Built for analysts who have to defend their conclusions.

Evidence-first, always

No unsourced claims. Every assertion in ThreatSpire links back to the report, feed, or telemetry it came from.

  • Source-linked claims
  • Auditable decision trails

MITRE ATT&CK-native

Not bolted on. Actors, techniques, and detections share one shared vocabulary from the ground up.

  • Group catalog seeding
  • Technique-level coverage

AI-assisted, analyst-controlled

Drafts, gists, and report narratives generated with Amazon Bedrock stay grounded in cited sources — never hallucinated, always reviewable.

  • Human-in-the-loop drafts
  • Citations on every summary

Bring your threat intelligence into focus.

See ThreatSpire on your own actors and requirements.

Live · Signal Grid

Adversary telemetry from the ThreatSpire sensor mesh

Attacks logged

Unique adversaries

Countries of origin

Sensors live

Credentials captured

updated continuously