ThreatBook (微步在线)

Name: ThreatBook (微步在线)
Brand: ThreatBook (微步在线)
Rating: 5 (292 reviews)

The Agentic Security Company. AI for Security, and Security for AI.

Est 2015|12 Ref Customers

LinkedIn 2K|Web traffic 220K|FTEs 110|HQ Downtown Core, Central Region, Singapore, SG

MarketsThreat Intelligence Platforms Endpoint Security (EPP/EDR)

Published Oct 12, 2026

01Common complaints

- If independently verifiable compliance artifacts are a precondition - Organizations that require public SOC 2 Type II or ISO 27001 certificates and will not accept documentation only provided under NDA may find procurement approval difficult based on publicly available information. - If the primary need is a simple enrichment utility rather than a platform - For hash/IP/domain lookups and ad hoc malware detonation, specialized enrichment utilities may be a lower-commitment option than a full TI platform. - If the organization prioritizes broad global intelligence modules and an established global reference base - Some global CTI vendors may be more appropriate for programs that require broad international analyst coverage and extensive third-party benchmarking. - If the SOC requires built-in automated containment from NDR - At least one user review indicated that automated isolation of compromised assets was not available in their experience; organizations requiring unified detect-and-contain flows should evaluate EDR/XDR platforms with native containment or plan integrations accordingly. - Current limitations acknowledged by the vendor - No explicit public "known issues" page was identified in the sources reviewed. - Practical limitations observed from reviews / public evidence - Limited public third-party review volume for some products, which reduces confidence in generalizing product experience across a broad customer base. - Containment expectations for NDR may not match all buyer requirements; at least one review reported the absence of automatic host isolation. - Roadmap (not yet available) - Roadmap information was not covered in the public sources reviewed and should be requested during procurement. - Security/compliance documentation gaps - SOC 2 and ISO certification details were not publicly discoverable in the reviewed sources; this can affect procurement in regulated environments.

Deal disqualifiers: what makes a POOR fit

Procurement requirements that mandate publicly verifiable SOC 2 or ISO certificates where the vendor cannot provide those documents.
Teams seeking transparent, self-serve pricing and minimal procurement friction.
SOCs that require automated containment from the NDR layer without additional tooling or integration.

Why some customers left for competitors (churn reasons)

There was not enough public evidence in the sources accessed to generalize vendor-specific churn drivers.

02Why they buy

- Notable capabilities supported by available customer evidence - Reviewers cite rapid visibility into network assets and dashboard-driven views in limited review samples. - Reviewers mention alert relevance and lower noise in the small set of reviews accessed. - Claims that require validation - Accuracy and false-positive rate metrics are sometimes quoted in vendor communications; these claims require methodology details and independent benchmarking during proof-of-concept and reference checks. - Areas where competitors may have advantages - Global enterprises may find broader international analyst coverage, third-party benchmarking, and larger English-language review volumes from some competitors.

Why customers chose this product over alternatives (what reviews imply)

TDP reviewers cited fast visibility into network assets, alert relevance, and straightforward deployments in the limited review sample.

03Field reports

- Vendor-published research and reports (not independent case studies) - The vendor publishes annual incident response reports and APT activity reports demonstrating research capability. These documents provide threat context but are not buyer-specific ROI case studies and generally do not contain independently audited outcome metrics for product deployments. - Claimed metrics that need verification - Social posts and vendor communications occasionally reference very low false-positive rates; such claims require methodology details and independent validation before they should be relied upon for procurement decisions. - What to ask for during reference checks (to validate real-world impact) - Baseline vs post-deployment alert volume and mean time to detect/respond (MTTD/MTTR). - Proportion of incidents confirmed using the vendor's tools versus other controls. - Tuning effort and staffing requirements incurred during and after deployment. - Operational outcomes such as reduced dwell time, improved asset inventory accuracy, and recurrence of similar infections.

Review platform coverage reality check

The vendor has a limited volume of English-language public reviews on mainstream Western review sites in the pages accessed, which limits statistical confidence.

G2 (ThreatBook TDP) — direct quotes (positive and negative)

- Positive (verified user): "TDP provides a… quick visibility on the whole network assets with… dashboard…" - Negative (same review): "…if any of the network assets are found to be compromised, we can't isolate the network assets automatically." - Positive (verified user): "Alerts accruracy… UI friendly… Deployment easily" - Negative (same review): "Theres some useless icon and buttons in the frontpage"

Gartner Peer Insights — access and quoting

Gartner Peer Insights pages for the vendor are accessible with product listings and summarized views; full review text may be gated. The vendor has published press materials referencing recognitions from Gartner Peer Insights; these vendor-authored notices should be treated as communications from the vendor and verified directly with the underlying third-party documentation where necessary.

PeerSpot — summary observations (use cautiously)

PeerSpot provides synthesized summaries of review themes (support quality, deployment ease, stability). These summaries are editorial aggregations and original reviews should be consulted when possible.

Community / social (Reddit, HackerNews) — limitations

Searches did not surface substantial vendor-specific user threads on Reddit or HackerNews during this run. Many retrieved threads relate to threat intelligence generally or other vendors and are not reliable evidence about this vendor specifically.

04Best fit

Company sizes

Mid-market to enterprise organizations.
Public review samples include a mix of mid-market and enterprise reviewers.

Industries and verticals where adoption is strongest (with customer examples)

China-based reporting cites customers across energy, finance, manufacturing, internet, and government, including multiple large organizations and state-owned enterprises. These mentions should be treated as time-bound reporting and verified during procurement.

Roles and personas

SOC leadership and detection engineering (NDR/TDP).
Threat intelligence analysts and incident response teams (TIP).
Endpoint security owners and IT security operations (OneSEC).

Pain points and challenges the product addresses

Improving detection and investigation efficiency through curated intelligence context.
Reducing SIEM noise via higher-fidelity alerts, according to reviewer comments in a limited set of samples.

Qualification criteria: what makes a GOOD fit

Organizations with a significant China footprint and regional intelligence needs.
Organizations seeking an integrated stack across network, endpoint, and threat intelligence.
Organizations with the ability to operationalize intelligence into detections and playbooks.

05The pitch

What the product does (core value proposition in objective terms)

- ThreatBook (微步在线) is a cybersecurity vendor focused on threat intelligence (TI) and detection/response products. Its portfolio spans: - Threat intelligence and investigation (Threat Intelligence Platform / TIP; referred to as "Advanced Threat Intelligence" on some pages). - Network detection and response / traffic-based detection (TDP). - Endpoint security (OneSEC, positioned as an EDR / endpoint security management platform). - DNS-based secure web gateway (OneDNS). - Cloud sandboxing / file analysis and a community intelligence portal. - API-based threat intelligence enrichment (cloud API for IP/domain/hash/file investigation and sandboxing).

Target market and market positioning

Targets enterprise and large organizations that require TI-driven detection and response across network, endpoint, and cloud environments; also serves smaller teams via SaaS/API offerings such as threat intel APIs and sandboxing.
Primary presence is in China, with initiatives toward international expansion.

Get a comprehensive analysis of ThreatBook (微步在线) including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →