Bitsight Cyber Threat Intelligence (formerly Cybersixgill)
Cybersixgill's dark-web intelligence, now sold as Bitsight CTI
Overview
Bitsight Cyber Threat Intelligence is the product Cybersixgill became after Bitsight bought it in December 2024. It collects from the clear, deep and dark web and alerts on compromised credentials, exploited vulnerabilities, ransomware groups and brand impersonation, tied to each customer's own attack surface. It is delivered through a portal, APIs, data feeds and MCP servers, priced on request.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 14 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- Monitor the clear, deep and dark web
- AI-powered portal search
- Attack Surface, Identity, Adversary, Vulnerability, Sectoral and Third-Party Intelligence
- MITRE ATT&CK heatmap and Bitsight Pulse
- Continuous monitoring and rapid response
- API/MCP integration
- Single- or multi-tenant deployment
- Identify credential exposure
- Reclaim accounts
- Query with AI
What you can produce with Bitsight Cyber Threat Intelligence (formerly Cybersixgill)
- Alerts on compromised credentials from infostealer logs, breaches and dark-web markets
- Vulnerability prioritisation scored on exploitation chatter and ransomware targeting, mapped to MITRE ATT&CK
- Ransomware-group and adversary tracking with victim sector and geography analysis
- Brand and executive impersonation monitoring
- Threat findings correlated with the customer's own internet-facing assets
- Intelligence delivered by portal, REST API, data feeds and MCP servers into SIEM and SOAR tools
- Analyst services including custom reports, dark-web purchases and threat-actor engagement
Cybersixgill's underground collection lives on as Bitsight Cyber Threat Intelligence. The modules cover leaked credentials, ransomware and adversary tracking, exploitation-weighted vulnerability scoring and brand impersonation, and the data reaches analysts through a portal, APIs, feeds and MCP servers for AI agents. Linking threats to a customer's own internet-facing assets is the gain from the merger.
The Cybersixgill name now survives only on a legacy login and old terms, and every package is priced on request by licence count. Worth evaluating for teams with analysts to act on it; not a self-serve tool.
What we found
Cybersixgill, which began in Tel Aviv in 2014 as Sixgill, built its business on automated collection from underground sources: dark-web forums and markets, invite-only messaging groups, paste sites and code repositories. Bitsight, the Boston security-ratings company, agreed to buy it for $115 million on 14 November 2024 and closed the deal on 11 December 2024, promising to keep its presence in Israel. Cybersixgill then had more than 80 staff, according to that announcement.
The brand has since been folded in. Cybersixgill's domains now redirect to a Bitsight page headed "Cybersixgill is now part of Bitsight", which keeps a login for legacy customers and links to the old Cybersixgill terms. The product is sold as Bitsight Cyber Threat Intelligence, and the generative-AI layer launched as Cybersixgill IQ is now presented as Bitsight AI.
Bitsight's product page splits the service into modules for compromised credentials, attack-surface exposure, vulnerability prioritisation, adversaries and ransomware groups, brand and executive impersonation, sector-specific threats and third-party exposure. Its vulnerability module scores CVEs by exploitation chatter and ransomware targeting, not only CVSS. Bitsight says it crawls more than 1,500 underground forums and marketplaces and holds over 170 billion compromised credentials. Those are vendor figures, not audited ones. Delivery runs through the portal, APIs, data feeds and MCP servers for AI agents, with SIEM and SOAR integration.
The deal's logic shows in the packaging. Threat data is tied to each customer's own internet-facing assets, and a dark-web module also feeds Bitsight's third-party risk products. Paid services include buying leaked data back from underground markets and engaging threat actors directly.
Nothing has a public price. Bitsight's pricing page sells Threat Intelligence by licence count, with brand and identity modules as add-ons, all on request. It suits analyst teams that already run intelligence processes; buyers expecting a standalone Cybersixgill contract will be negotiating with Bitsight.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
About this listing
This entry was compiled from publicly available data including Bitsight Cyber Threat Intelligence (formerly Cybersixgill)'s official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Bitsight Cyber Threat Intelligence (formerly Cybersixgill) unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Bitsight Cyber Threat Intelligence (formerly Cybersixgill) directly →
Spotted something out of date? Suggest an update →
Related reading
Cybersecurity
Unit 42 Links Fortinet Path-Traversal Bug to Memory-Only FortiGate Implant in Telecom Intr...
Cyber Threat Intel
The FBI Seized a Chinese Contractor's Hacking Tools Used Against Taiwan, Japan and the US
Cyber Threat Intel
Hijacked Domain Registries Let Attackers Get Real HTTPS Certificates for Google Domains
Alternatives to Bitsight Cyber Threat Intelligence (formerly Cybersixgill)
More in Security & Safety
