Sign inSee what's exposedCompare
Intelsieve and Flare
Flare.io is a threat intelligence platform built around identity — leaked credentials, breached identities and exposed secrets collected from the clear and dark web. It also monitors external attack surface. Intelsieve is external attack surface management first, with leaked logins as one of six exposure groups, and an analyst checks every finding before it reaches you. Here is how they differ.
Every claim in the Flare column was read from Flare’s own pages and their AWS Marketplace listing on 16 October 2026, and is quoted or paraphrased from them.
At a glance
What it is
External attack surface management for the domains you own: every host found, every finding checked by an analyst
A threat intelligence platform with “unmatched visibility across the dark and clear web into credentials, breached identities, leaked secrets, and other threat vectors”
What the product is organised around
Your estate. Six exposure groups across the hosts and services we find under your domains
Identity. Flare describes itself as building the “Identity Exposure Management category” and names identity as “the frontier of cybercrime”
What you are billed for
Domains. Every subdomain, host and service underneath a domain is included and never billed separately
Identifiers — search terms such as domains, keywords, executive names and email addresses. AWS Marketplace defines them as “the units monitored for credential and identity exposure”
External attack surface monitoring
Yes, and it is the product. We scan the domains you add and everything underneath them
Yes. Flare says “we provide external attack surface monitoring”, covering domains and subdomains, with CVEs, open ports and SSH certificate checks per host
Where the host data comes from
Our own scanning of your estate
Flare says it will “query tools such as Shodan for all related IP addresses”, and lists Shodan among its sources alongside GitHub, public buckets and paste sites
Network security
Not our scope. We look at your estate from the outside
Out of scope. “Flare does not really do network security”; it positions itself as complementing those tools by monitoring the external side
Who decides what matters
An analyst, before a finding reaches you
The platform. Flare advertises “Automated Scoring and triage” for leaked credentials, active sessions, lookalike domains and breached identities, with AI used to prioritise
A person who reviews findings for you
Yes, an analyst replies, usually the same working day
Not offered. “We don’t offer a managed version of Flare, and only offer services for RFIs and takedowns. We don’t respond to incidents, analyze logs, or do assessments”
How much leaked-credential data is actually live
We do not publish a comparable figure. An analyst checks each credential finding before it reaches you
Flare reports that “just over 1% of validated credential events turned out to be true positives, meaning the exposed account and related credentials were still active in the customer’s environment”. They present full automation as the answer to that ratio
Alerts
Email, Slack and webhook on paid plans, when something changes
Email, Slack and Azure Sentinel, configured per identifier. “Each time a new document is found on the clear and dark web, we send alerts”
API and integrations
API access and SIEM export (JSON and CEF) on paid plans
A REST API, plus ready-made integrations with SIEM/SOAR (Splunk, Azure Sentinel), messaging (Slack, Microsoft Teams) and ticketing (Jira, ServiceNow)
Takedowns
Not offered
Offered as a paid service, purchased separately from the subscription
Pricing published
Yes: $100/month (Standard, up to 2 domains), $250/month (Business, up to 6 domains)
Not on their own site — flare.io/pricing returns a 404. Their AWS Marketplace listing shows annual contracts at $18,000 (Starter), $32,000 (Essentials), $57,000 (Core) and $118,000 (Enterprise)
Free option
Free tier: 1 domain, weekly scan, every host counted, five examined, findings unverified
A two-week free trial with “NO PAYMENT INFO REQUIRED”, but you “must have a video call with Flare to verify your identity before starting”
Team size it suits
Built for teams without an analyst of their own — ours does that part
“Teams with at least three members benefit from the deep coverage on specific sources”
Which one fits
When Flare is the better choice
- You want depth in cybercrime sources rather than depth on your own estate. Flare monitors “58,000+ Telegram channels, threat actor forums, marketplaces, and stealer log repositories”, and that is a different and much larger collection job than scanning the domains you own.
- You have analysts to do the triage. Flare is built for them — their own guidance is that “teams with at least three members benefit from the deep coverage on specific sources”, and the platform is designed so junior analysts can search illicit sources safely.
- You want exposure data piped into tooling you already run. Flare offers a REST API and prebuilt SIEM/SOAR, messaging and ticketing integrations, and positions itself to “plug in underneath the stack you already run”.
- You want automated remediation rather than a human verdict. Flare connects to Entra ID so exposures can be validated and remediated automatically, which is genuinely faster than any analyst-reviewed process and is explicitly their design goal.
- You need takedowns, requests for intelligence, or executive and brand protection beyond your own infrastructure. Flare sells takedowns and RFIs as services and monitors executive credentials and impersonating domains.
- You are an MSSP wanting to resell intelligence work. Flare runs a service-credit model for MSSPs who “want to offload intel work to us”.
When Intelsieve fits
- You want to know which exposures on your own domain still need fixing, rather than subscribing to a view of the cybercrime economy.
- You do not have an analyst to triage alerts, and would rather the verdict arrived already made. Every finding on a paid plan is reviewed by a person before you see it, and comes back as still needs fixing, already fixed, or doesn’t apply to you.
- Leaked logins matter to you, but not enough to buy a separate product for them. With us they are one of six exposure groups inside attack surface management, included on Standard and Business.
- Volume is the problem you are trying to avoid. Flare reports that just over 1% of the credential events it validates turn out to be true positives — accounts still active in the customer’s environment — and their answer is to automate the remediation so no person has to read the rest. Ours is to have an analyst read it. Both are reasonable; pick the one that matches how you want to spend attention.
- You want to see the price before you talk to anyone, and to start at a scale that does not require an annual contract.
- You want a record you can hand to an insurer, a board or an auditor: a verdict per finding, rather than a feed you have to summarise yourself.
See what we find on your domain
Start free with one domain. Nothing to install.