# Companies using ThreatConnect

402 companies use ThreatConnect, based on their job posts and their employees' public profiles. From October 2025 to August 2026, 217 job posts named it. Security Analyst roles mention it most.

Data as of November 9, 2026. Source: Sumble.

## Which companies name ThreatConnect in the most job posts?

Among the companies with the most job posts naming ThreatConnect are UST (29), Cyware (26) and Deloitte (20). Booz Allen Hamilton is the newest of the five companies in the table, with its first job post naming it in May 2025.

| Company | Job posts | Recent job post |
|---|---:|---|
| [UST](https://sumble.com/orgs/ust-2) | 29 | "…Alto Cortex XSOAR, Tines, Splunk Phantom, IBM Resilient, Cyware, Microsoft Logic Apps, ThreatConnect to streamline response activities." (SOAR Automation Engineer, Oct 23, 2026) |
| [Cyware](https://sumble.com/orgs/cyware) | 26 | "Experience with Threat Intel Vendors/Tooling such as: MISP, Anomali Threatstream, ThreatConnect, Threat Quotient" (Solution Engineer, Jun 12, 2026) |
| [Deloitte](https://sumble.com/orgs/deloitte) | 20 | "Knowledge of Microsoft Entra ID (formerly Azure Active Directory), Amazon Web Services (AWS) CloudTrail, GuardDuty, Virtual Private Cloud (VPC) Flow Logs, Microsoft AIR, Qualys, and ThreatConnect" (Tier 2 Security - Assistant Manager - Hyderabad, Jun 7, 2026) |
| [Booz Allen Hamilton](https://sumble.com/orgs/booz-allen-hamilton) | 20 | "This role manages and operationalizes ThreatConnect to enrich SOC investigations, identify emerging threats, and maintain high‑quality intelligence workflows." (Cyber Threat Intelligence Analyst, Mid, Oct 1, 2026) |
| [eSentire](https://sumble.com/orgs/esentire) | 19 | "Experience with threat intelligence platforms (TIPs) such as Recorded Future, Mandiant Advantage, ThreatConnect, or Anomali." (Senior Product Manager, Threat Intelligence (Tel Aviv, Israel), Jun 16, 2026) |

## Is hiring for ThreatConnect growing?

Job posts mentioning ThreatConnect went from 0.08 to 0.12 in every 10,000 job posts, comparing March to May with June to August 2026. These are small numbers of job posts, so a few companies can move them.

| Month | Job posts naming it | All job posts | Per 10,000 job posts |
|---|---:|---:|---:|
| Oct 2025 | 18 | 1,413,673 | 0.13 |
| Nov 2025 | 31 | 1,822,119 | 0.17 |
| Dec 2025 | 14 | 1,236,103 | 0.11 |
| Jan 2026 | 27 | 1,828,002 | 0.15 |
| Feb 2026 | 16 | 1,856,647 | 0.09 |
| Mar 2026 | 15 | 1,850,711 | 0.08 |
| Apr 2026 | 12 | 1,728,886 | 0.07 |
| May 2026 | 15 | 1,821,509 | 0.08 |
| Jun 2026 | 26 | 1,909,496 | 0.14 |
| Jul 2026 | 28 | 1,815,180 | 0.15 |
| Aug 2026 | 15 | 1,835,698 | 0.08 |

## How many companies named ThreatConnect in a job post for the first time in recent months?

ThreatConnect showed up in job posts at 26 companies for the first time from June to August 2026, and 13 in the three months before. Over the 11 months from October 2025, 75 companies posted their first job naming it.

| Period | Companies naming it in a job post for the first time |
|---|---:|
| March to May 2026 | 13 |
| June to August 2026 | 26 |
| October 2025 to August 2026 | 75 |

Companies whose first job post naming it appeared in that period. Recruiters, staffing firms and job boards are left out.

## How do we know which companies use ThreatConnect?

294 companies name ThreatConnect in job posts they wrote, and employees' profiles add 108 more. 24 show up in both job posts and employees' profiles.

| How we know | Companies | Share |
|---|---:|---:|
| Job posts name ThreatConnect | 294 | 73% |
| Employees' profiles list ThreatConnect | 108 | 27% |

## What size are the companies that use ThreatConnect?

Companies with more than 5,000 employees are 1.6 times as common among ThreatConnect users as on the typical tech page, at 38%. 72 of its companies have fewer than 50 employees.

| Size | Share | Typical tech page |
|---|---:|---:|
| Under 50 employees | 18% | 22% |
| 50 to 999 | 29% | 38% |
| 1,000 to 5,000 | 16% | 17% |
| Over 5,000 | 38% | 23% |

## Where are ThreatConnect companies based?

ThreatConnect is concentrated in the United States, home to 61% of the companies that use it. India is less common than usual, at 4.6% against 6.9% on the typical tech page.

| Country | Companies | Share | Typical tech page |
|---|---:|---:|---:|
| United States | 235 | 61% | 43% |
| United Kingdom | 18 | 4.6% | 6.4% |
| India | 18 | 4.6% | 6.9% |
| Brazil | 12 | 3.1% | 2.8% |
| France | 12 | 3.1% | 4.6% |
| Canada | 11 | 2.8% | 3.6% |

## Which teams work with ThreatConnect?

ThreatConnect work is spread across teams. SOC leads, at 19 companies.

| Team | Companies |
|---|---:|
| SOC | 19 |
| CTI | 13 |
| Cybersecurity | 9 |
| Threat hunting | 9 |
| Threat intelligence | 9 |
| Cyber security operations | 5 |

## Which roles mention ThreatConnect most?

Security Analyst is the role behind 41% of the job posts that mention ThreatConnect. Security Engineer is second, at 9.7%.

| Role | Share | Oct 2025 to Aug 2026 | Mar to May 2026 | Jun to Aug 2026 |
|---|---:|---:|---:|---:|
| Security Analyst | 41% | 88 | 21 | 31 |
| Security Engineer | 9.7% | 21 | 3 | 3 |
| Information Security Engineer | 6% | 13 | 2 | 2 |
| IT Support | 5.1% | 11 | 5 | 1 |
| Financial Analyst | 3.7% | 8 | 0 | 1 |
| Researcher | 2.8% | 6 | 0 | 0 |

## Which companies started naming ThreatConnect in job posts recently?

From April to August 2026, 30 companies with 50 or more employees posted their first job naming ThreatConnect: 9 commercial, 8 mid-market and 13 enterprise. Rappi and Happiest Minds Technologies lead the new enterprise companies, with 4 job posts each from April to August.

| Group | Company | Job posts, April to August 2026 |
|---|---|---:|
| Commercial | [SISAP](https://sumble.com/orgs/sisap) | 3 |
| Commercial | [CLS Group](https://sumble.com/orgs/cls-bank) | 2 |
| Commercial | [NetCentrics](https://sumble.com/orgs/netcentrics) | 2 |
| Commercial | [SEK Security Ecosystem Knowledge](https://sumble.com/orgs/sek-security-ecosystem-knowledge) | 1 |
| Commercial | [Solo Network](https://sumble.com/orgs/solo-network-brasil) | 1 |
| Mid-market | [Lintasarta](https://sumble.com/orgs/lintasarta) | 2 |
| Mid-market | [Caja Los Andes](https://sumble.com/orgs/caja-de-compensacion-de-asignacion-familiar-los-andes) | 2 |
| Mid-market | [Koniag Government Services](https://sumble.com/orgs/koniag-government-services) | 2 |
| Mid-market | [Sands China](https://sumble.com/orgs/sandschina) | 2 |
| Mid-market | [FINRA](https://sumble.com/orgs/finra) | 1 |
| Enterprise | [Rappi](https://sumble.com/orgs/rappi) | 4 |
| Enterprise | [Happiest Minds Technologies](https://sumble.com/orgs/happiest-solutions) | 4 |
| Enterprise | [Maximus](https://sumble.com/orgs/maximus) | 3 |
| Enterprise | [Accenture](https://sumble.com/orgs/accenture) | 1 |
| Enterprise | [Citi](https://sumble.com/orgs/citi) | 1 |

Companies that named ThreatConnect in a job post for the first time between April and August 2026, ranked by their job posts in those months. AI-native companies get a group of their own, whatever their size. Recruiters and job boards are left out.

## What else do ThreatConnect companies use?

The tool most tied to ThreatConnect is Anomali. 41% of ThreatConnect companies use it, 553 times the usual rate for their size. Next is Recorded Future: 39% of these companies use it, against 0.15% of similar ones.

| Tool | Companies | Also name it | Typical | Times as common |
|---|---:|---:|---:|---:|
| Anomali | 61 | 41% | 0.07% | 553 times |
| Recorded Future | 58 | 39% | 0.15% | 253 times |
| MISP | 80 | 54% | 0.29% | 189 times |
| Shodan | 19 | 13% | 0.13% | 101 times |
| Velociraptor | 12 | 8.1% | 0.09% | 95 times |
| Swimlane | 11 | 7.4% | 0.09% | 84 times |
| Twistlock | 13 | 8.8% | 0.12% | 73 times |
| X-Ways | 14 | 9.5% | 0.14% | 70 times |

Shares are out of the 148 companies whose job posts name ThreatConnect, not counting firms whose job posts name almost every technology.

## Which project themes come up in ThreatConnect job posts?

Digital transformation is the broadest theme in ThreatConnect job posts (20); the most common specific one is Security Infrastructure Modernization, at 13. After that comes Cloud Migration, with 3.

| Project theme | Job posts |
|---|---:|
| Digital Transformation | 20 |
| Security Infrastructure Modernization | 13 |
| Cloud Migration | 3 |

- "Guide the migration from MISP to ThreatConnect (SaaS)" (Siemens, Head of Cybersecurity Platforms (f/m/d), Feb 1, 2026)

## About this data

Sumble built this page. Sumble gives sales, marketing and other GTM teams technographics and hiring signals for the companies they sell to: the technologies each company uses, which teams are hiring and for what, and who reports to whom. That helps a team know who to contact, why now, and what to say.

Sumble covers more than 3.6 million companies, 93 million job posts collected since 2022 and 194 million employee profiles, and tracks more than 37,000 technologies. It finds which technologies a company uses by reading its job posts and its employees' public profiles.

Sumble has a free plan, and the same data is available through its API and MCP server.

A company counts when its own job posts or its employees' public profiles name the technology. Hiring is that technology's share of all job posts collected each month. Quotes are copied word for word from the companies' job posts.

Every figure on this page comes from Sumble's own analysis, and you won't find it outside Sumble.