Partnerships
ThreatCluster exists because threat intelligence was priced out of reach for most of the people who need it. That is why the core tier is free, and it is why this page exists.
Some of the work that matters most in this field is done by people with no budget to do it: researchers, lecturers, national and sector CERTs, charities holding sensitive data with one part-time IT contractor, and the volunteers who run community defence projects. We would rather those people had the platform than not. Below are the routes in. Each one says what you get and what we ask for in return, because a partnership that only runs one way is a donation, and we would rather be honest about which is which.
Academic research
University research groups, doctoral and postdoctoral researchers, and institutional labs working on threat intelligence, security analytics, misinformation, extremism, ransomware economics or adjacent fields.What you get
- Full Business tier access for the research team, free for the duration of the project
- API access with research-appropriate rate limits
- Bulk and historical data export, including cluster, entity and IOC data
- A named contact who will answer questions about how the pipeline works, because methodology matters when you are publishing on it
- Where useful, co-authorship or a named data contribution
What we ask
- Cite ThreatCluster as a data source in published work
- Tell us what the data got wrong, since research-grade scrutiny is more useful to us than most feedback we receive
- A pre-publication heads-up where findings concern the platform itself
Teaching and student access
Lecturers and course leaders running CTI, SOC, threat hunting or incident response modules, plus student societies and competition teams.What you get
- Classroom accounts for an enrolled cohort, free for the academic year
- The same live data the professional tiers use, rather than a sandbox with stale content
- Sector threat models and hunt query exports for practical exercises
- A guest session on how the clustering and entity extraction actually work, remotely or in person where practical
What we ask
- Feedback on what worked in a teaching context and what did not
- Where you build course material around the platform, let us point other educators at it
Students working independently do not need a partnership. The free tier is genuinely free and there is no student verification to clear.
Non-profits and civil society
Registered charities, NGOs, civil society organisations, community groups, and the small IT providers who look after them.Organisations holding sensitive information about vulnerable people are frequently the least equipped to defend it, which is a poor arrangement and one we can partially fix.
What you get
- Free Researcher or Business tier access depending on organisation size, with no time limit
- Custom feeds scoped to your sector and suppliers
- Alerting on your domains and the vendors handling your data
- Onboarding help, because the constraint here is usually time rather than money
What we ask
- Nothing required
- If the platform helps and you are willing to say so publicly, that is welcome, but access does not depend on it
CERTs, ISACs and community defence
National and sector CERTs and CSIRTs, ISACs and ISAOs, volunteer defence projects, ransomware and leak site tracking initiatives, and non-commercial threat sharing communities.What you get
- Platform access appropriate to the organisation
- Direct feed and API access for onward distribution to your constituency, subject to a sharing agreement
- Co-published advisories where our reporting and yours overlap
- MISP-compatible feed and STIX exports built for onward sharing rather than internal use
What we ask
- Two-way sharing where your remit allows it
- Attribution on co-published work
We already co-publish joint advisories with Defused, Ransom-ISAC and detections.ai, so this track has precedent rather than being aspirational.
Data and intelligence partners
Feed providers, vulnerability and exploit data sources, DNS and infrastructure security projects, sinkhole and honeypot operators, and anyone holding a dataset that would make the clustering better or be made better by it.What you get
- Reciprocal data access on agreed terms
- Attribution wherever your data contributes to a cluster, entity profile or advisory
- Joint publication where the combined picture is stronger than either half
What we ask
- The same in return, in whatever form fits your licensing
If you run a public-interest security project and the answer to “would this be better if the two datasets met” is yes, that is enough to start a conversation.
Technology and integration partners
SIEM, TIP, SOAR and vulnerability management vendors, open source security tooling projects, and the MISP, OpenCTI and TheHive communities.What you get
- Technical support building and maintaining an integration
- API access for development and testing
- Listing and documentation on our side
- Input into export formats where your users need something we do not yet produce
What we ask
- A working, maintained integration and a named maintainer on your side
What we do not do
Worth stating plainly, because “partner” is a word that hides a lot.
- We do not sell placement. Nobody appears in a cluster, an advisory or a report because of a commercial relationship.
- We do not pay for coverage, and we do not accept payment for it.
- Partner access does not influence what the platform reports, including reporting about partners.
- We do not require exclusivity in any track.
Commercial partnerships
Reselling, white-labelled delivery and multi-tenant deployment are a different conversation and have their own page.
How to apply
Email [email protected] with which track fits, who you are, and what you would use the platform for. Two or three paragraphs is plenty.
Academic and non-profit applications are usually answered within a week. Data and integration partnerships take longer because they need a technical conversation first.
Partnerships FAQ
Is partner access really free for non-profits and researchers?
Yes, for the tracks described on this page, with no time limit for non-profits and for the duration of the project or academic year for research and teaching.
What counts as a non-profit?
Registered charities, NGOs and civil society organisations. If you are structurally non-commercial but do not fit those categories neatly, apply anyway and explain the situation.
Can students get access without a partnership?
Yes. The free tier requires no verification and no application.
Do you restrict what researchers can publish?
No. We ask for citation and a pre-publication heads-up where findings concern the platform itself, and neither of those is a veto.
Can partner organisations get the underlying data rather than just the interface?
Research, CERT and data partners get API and bulk export access. The scope is agreed per partnership.
Is there a referral or affiliate programme?
We run an invite-only referral arrangement for content creators. Get in touch at [email protected] if that fits.
If the work is worth doing, budget should not decide it
Tell us which track fits and what you are working on.
Content creators and referrers, get in touch at [email protected].