Intelligence Analysis Tools: 10 Platforms Ranked for 2026
By Jan Suski. I go deep on every review, checking every number against its source and digging up details other coverage misses, a habit from six years of SEO and link building for tech companies. Bylines at Surfer, Brand24, and Senuto. How the scoring works.
· Prefer this source on Google
Quick comparison of intelligence analysis software
The views column counts link chart, map and timeline views named on each vendor's own product pages or documentation, read October 2026. Prices are vendor list prices, UK G-Cloud 14 catalog prices, or a Vendr median where the row says so.
| # | Provider | Analysis views documented | Entry price on record | Best fit |
|---|---|---|---|---|
| 1 | Linkurious Enterprise | 3 of 3: graph, map, timeline | €490 per user per month (Cloud) | Fraud, AML and investigation teams |
| 2 | Esri ArcGIS AllSource | 3 of 3: link chart, 2D/3D map, timeline | Quote; Esri median $25,281 a year* (Vendr) | Location-first military and police analysis |
| 3 | GraphAware Hume | 3 of 3: graph, geospatial, temporal | £150,000 a license a year (G-Cloud 14) | Agencies standardizing on Neo4j |
| 4 | DataWalk | 3 of 3: link, geospatial, time series | Quote only | Self-run data fusion on air-gapped networks |
| 5 | Siren | 3 of 3: graph browser, map, timeline | Quote only, priced per data node | Teams already running Elasticsearch |
| 6 | Palantir Gotham | 2 of 3: Graph, Gaia map | £66,000 a unit (G-Cloud 14) | Defense programs with classified networks |
| 7 | i2 Analyst's Notebook | 2 of 3: link chart, temporal | Quote only, 4 subscription plans | Police analysts building link charts |
| 8 | Gephi | 2 of 3: graph, dynamic timeline | $0, GPL open source | Free network layout and metrics |
| 9 | Maltego | 2 of 3: graph, map | Free Basic; €3,000 per user per year | OSINT investigators who chart as they collect |
| 10 | Silobreaker | 0 of 3 named on product pages | Quote only | Threat intelligence reporting teams |
Medians marked * are anonymized buyer-reported contract values published by Vendr. The GraphAware Hume and Palantir Gotham prices come from the UK government's G-Cloud 14 catalog. Everything else is the price the vendor publishes itself.
Where these figures come from
Analysis-view counts come from each vendor's own product pages and documentation, read in October 2026. The Hume and Gotham prices are G-Cloud 14 catalog listings on the UK government's Digital Marketplace, quoted the way each listing words them: £150,000 a license a year for Hume, which also needs a separate Neo4j license, and £66,000 a unit for Gotham, a unit the listing leaves undefined.
The Esri median marked * is Vendr's anonymized buyer data for every Esri product across 32 purchases, a vendor-wide proxy, since Esri publishes no AllSource list price. DataWalk, Siren, i2 and Silobreaker publish no price at all, so those four rows say quote only.
Maltego also tops the open source intelligence tools ranking, judged there on collection. Silobreaker appears in the risk intelligence software ranking, which covers alerting, and Nuix Neo's entry in the digital intelligence platforms ranking runs Linkurious graph analysis for device forensics. This page judges all three on analysis.
The governance side of the same records sits in the data intelligence tools ranking, and forecasting in decision intelligence platforms.
Intelligence analysis tools take raw data from case files, phone records, financial transactions, social media and public records, resolve the people and places in it, then lay the result out as a link chart, a map and a timeline an analyst can turn into actionable intelligence. The analyst's job is finding the needle in a haystack. The software's job is shrinking the haystack.
This page ranks ten intelligence analysis software platforms against five criteria a buyer can check on vendor pages before a demo. Every price, user count and deployment claim links to the page it came from: vendor pricing pages, the UK government's G-Cloud 14 catalog and Vendr's anonymized purchase data.
It's written for crime analysts, national security teams, financial investigators and corporate security teams choosing intelligence analysis tools for real casework. Three adjacent jobs have their own pages: open source intelligence tools for collection, digital intelligence platforms for device forensics, and risk intelligence software for alerting.
Ownership in this category changed hands twice since 2022. Harris Computer bought i2 from IBM in January 2022, and Neo4j closed its purchase of GraphAware on 5 August 2026. Prices moved too: two of the ten now list a figure on a public procurement framework.
Evaluation criteria for intelligence analysis tools
Five criteria decide the shortlist, and the ranking below applies them in this order. Each resolves to a count or a yes you can confirm on the vendor's own pages in under ten minutes. Where two tools tie on all five, the lower figure on record wins.
Link chart, map and timeline in one workspace
Link analysis shows who connects to whom. Geospatial analysis shows where. Timeline analysis shows the order things happened in. A tool scores 0 to 3 here, counting only views the vendor names in its own documentation, and the ranking sorts on this count first.
Entity resolution or unstructured data ingest
Three records spelling one suspect's name three ways produce three nodes on a chart until something merges them. A tool passes if it documents entity resolution or extraction from unstructured data such as reports, emails and transcripts. Manual merging is where human error creeps into intelligence products.
Disconnected, air-gapped or on-premises deployment
Intelligence agencies and police forces hold sensitive data that can't sit in a vendor's multi-tenant cloud. The test is a yes: does the vendor document an air-gapped, classified, on-premises or desktop deployment?
A price on record before the first sales call
A list price, a public procurement framework price or a Vendr median all count. Four of the ten fail this one, and the devil's in the details on the six that pass: one price is per user per month, one is per "unit", one needs a second database license.
A published scale figure
A user count, an organization count, a record volume or a node limit, published by the vendor. It's the tie-breaker between tools that look identical on the first four, and it tells a buyer if anyone else is running the thing at volume.
The 10 best intelligence analysis tools, ranked
Linkurious Enterprise
Best fit
Fraud, anti-money-laundering and investigation teams that want a graph, a map and a timeline in one screen, plus a price before the first call.
Linkurious sits on top of a graph database and turns it into an investigation workspace. It connects to six: Neo4j, Amazon Neptune, Memgraph, Azure Cosmos DB, Google Cloud Spanner and BigQuery, according to its homepage, which also claims 10,000+ users and lists its work with the ICIJ on the Panama Papers.
The version 4.3.13 user manual carries a Geography section that draws nodes on a geographic map and a Timeline filter for temporal data, which is how Linkurious clears the three-view test.
Key features
- Entity Resolution AI that merges duplicate records into one node (self-managed tier)
- Geo mode for plotting entities with coordinates
- Timeline filtering across dated nodes and edges
- Alerts & case management for triaging flagged patterns
- Copilot, a natural-language assistant documented in the 4.3 manual
- Connectors for 6 graph and cloud databases
Pricing
Linkurious Enterprise Cloud lists €490 per user per month, with 8% off on yearly billing and a 30-day free trial. The self-managed Decision Intelligence Platform, which runs on-premises, is quote only.
Five analysts on Linkurious Enterprise Cloud cost €29,400 over 12 months at the monthly rate, or €5,880 a seat.
Pros
- Per-seat price and 30-day trial published, so a pilot can hit the ground running without a procurement cycle
- Graph, map & timeline views in one product
- Runs on the graph database a team already pays for
- Self-managed edition deploys on-premises
Cons
- The €490 Cloud tier leaves out entity resolution AI, alerts, case management, webhooks, the REST API and custom plugins
- Cloud trial data is deleted within 45 days of canceling
- The full-featured self-managed tier has no list price
- Only 1 review on G2, which leaves little independent evidence
That lone G2 review, from a senior engineer at a small firm in January 2022, praised that an "End user can easily visualise their data without any knowledge with development", then named the two complaints a buyer should test: "Cost of licensing is huge compare to other tools" and "Only graph data can be used by this software". Source: G2.
Why it's ranked #1. Linkurious is the only tool here meeting all five criteria; it beats ArcGIS AllSource on the fifth with a published 10,000-user figure, where Esri publishes no AllSource-specific count, and nothing ranks above it.
Esri ArcGIS AllSource
Best fit
Military intelligence, police & security teams whose intelligence starts with location and has to run on an air-gapped network.
Esri describes AllSource as "intelligence analysis software for investigative, geospatial, and link analysis" on its product page. One desktop application combines link analysis, 2D and 3D mapping, timeline analysis and imagery exploitation, and Esri states it runs "fully in air-gapped and disconnected networks without internet access".
Geospatial intelligence is the point of it. AllSource puts satellite imagery, video, sensor feeds & unstructured text on the same map as a link chart, then adds movement and pattern-of-life analysis for mission planning. It reads shapefiles, KML, CSV and XML, which matters when data sources come from several agencies at once.
Key features
- Link charts & network analysis on the same canvas as the map
- 2D & 3D maps with imagery, video and satellite imagery exploitation
- Timeline, movement and pattern-of-life analysis
- Geoprocessing models for repeatable workflows
- Prebuilt connectors, APIs and SDKs for third-party systems
Pricing
Esri publishes no AllSource list price. It sells AllSource as a single-use annual subscription, a perpetual license with maintenance, and, since the October 2025 sales update, an add-on to Creator user types and above. Vendr's anonymized buyer data for Esri, covering all Esri products, shows a median of $25,281 a year across 32 purchases, ranging from $2,442 to $103,121.
Pros
- All three analysis views plus imagery in one application
- Documented air-gapped operation for classified environments
- Three purchase routes, including a perpetual license
- Reads the standard GIS formats most agencies already hold
Cons
- No AllSource-specific price, so the Vendr median is a vendor-wide proxy
- The add-on route requires a Creator user type underneath it
- Advanced extensions sit behind separate charges, per a Capterra reviewer
A Hacker News commenter describing analyst work in April 2018 laid out the old toolchain AllSource folds together: "you use i2 to visualize it, you use ArcGIS to map it, then you use Word to write a report about it." Source: Hacker News. The licensing model draws the sharpest complaint:
"The base licence is steep enough, but every critical extension [...] sits behind an extra paywall. The named-user subscription model traps you; stop paying and you lose access to both tools and stored projects."
Keith K., engineering surveyor, Capterra, 19 May 2026. Source
Why it's ranked #2. AllSource ties GraphAware Hume on the first four criteria and wins the tie-break, with Esri's $25,281 Vendr median below Hume's £150,000 license; it trails Linkurious, which publishes a 10,000-user scale figure.
GraphAware Hume
Best fit
Police forces & national security agencies that already run Neo4j and want an analyst front end on it.
Hume is a graph intelligence analysis platform from GraphAware, which Neo4j bought in a deal that closed on 5 August 2026. Hume now runs as a standalone Neo4j business unit led by GraphAware CEO Michal Bachman, with named deployments at the European Commission and the Western Australia Police.
GraphAware documents temporal and geospatial analysis on top of its graph view, tracking a phone or a vehicle's position as it changes over time. The product page says Hume ingests structured and unstructured data and lets analysts follow multi-hop connections without writing a query.
Key features
- Graph exploration across multi-hop connections with no query language
- Geospatial & temporal analysis of location and movement data
- Structured and unstructured data ingest
- Alerts on patterns found in the graph
- Support for ISO GQL through the Neo4j platform
Pricing
The G-Cloud 14 listing prices Hume at £150,000 a license a year, deployable in public, private, community or hybrid cloud. The same listing says a buyer needs two licenses, Hume and Neo4j, and offers a free trial for "a mutually agreed limited time period".
Pros
- Graph, map and timeline analysis in one platform
- A price on a public framework, rare at this tier
- Open-standard query support, positioned against closed platforms like Gotham
- Named public-sector deployments in Europe and Australia
Cons
- £150,000 a year before the separate Neo4j license
- No published user or customer count
- Ownership changed in August 2026, so the roadmap is two months old
The acquisition drew a skeptical read on Hacker News in June 2026, where one commenter wrote that "Neo4j has been the master of flip flops." Source: Hacker News.
Buyers signing multi-year terms should keep an eye on which roadmap survives the merger.
Why it's ranked #3. Hume matches AllSource on four criteria and loses the tie-break at £150,000 a year; it beats DataWalk on the fourth criterion because Hume's price sits on a public framework and DataWalk quotes privately.
DataWalk
Best fit
Agencies that want a Palantir-style data fusion platform they can install and run themselves, including on classified networks.
DataWalk combines internal databases, spreadsheets, public records and social media into a single database organized as a knowledge graph, per its intelligence analysis page. Its defense page claims "billions of records" on commodity hardware, across open, classified and air-gapped networks, and says it "does not require forward-deployed engineers".
DataWalk's G2 listing describes turning raw, dispersed data into "actionable insights for decision-making". It pitches itself at "a small fraction of the price of Palantir Gotham" and ships new releases every 2 to 3 months, per its Palantir comparison page. That page carries no figure behind the price claim, and talk is cheap until a quote lands.
Key features
- No-code data fusion and ontology mapping
- Link analysis, geospatial mapping and time-series analysis
- Entity extraction, data matching, text translation & anomaly detection
- Cell-level security on every record
- MCP integration for LLM-generated report summaries
Pricing
Quote only. DataWalk sells commercial off-the-shelf software from a single code base and publishes no figure.
Pros
- All three views plus text analysis in one platform
- Air-gapped and classified deployment documented
- Scales by adding cluster nodes on commodity hardware
Cons
- No public price
- 12 G2 reviews averaging 4.7, several from non-intelligence roles
- Interface complexity, per a G2 reviewer
- One reviewer named "Resource Intensive and cost" as dislikes
A developer reviewing DataWalk on G2 in August 2023 liked that "we can import data as is without cleansing, and do the cleaning part in the website/tool itself". A controller writing in October 2023 found the opposite side of a dense product:
"The interface of DataWalk sometimes feels overwhelming and complex making navigation and utilization of its features a bit difficult."
Tony G., job costing and budget controller, G2, 4 October 2023. Source
Why it's ranked #4. DataWalk documents three views and air-gapped deployment, beating Siren on the fifth criterion with its "billions of records" figure; it trails Hume because DataWalk keeps its price private and Hume lists £150,000.
Siren
Best fit
Security, fraud & cyber threat teams with an Elasticsearch cluster that want link analysis over data they've already indexed.
Siren's version 16.0 platform guide documents a graph browser with shortest-path and common-communicator analysis, map visualizations with GeoServer support, timeline visualizations, entity resolution and "360 dashboards". Siren Federate is a plugin installed in an Elasticsearch cluster, and Siren Investigate installs on-premises or on Kubernetes.
The Siren homepage lists 15 integration partners, including Moody's Analytics, Dun & Bradstreet, Dow Jones, LexisNexis, Chainalysis and Esri, and offers a free technical trial.
Key features
- Graph browser with shortest path and common communicator detection
- Map visualizations with region layers and marker clustering
- Timeline & Timelion time-series visualizations
- Entity resolution across search results
- Interactive dashboards, including 360 and flex layouts
Pricing
Quote only, with a free technical trial. A G2 reviewer reports pricing per Elasticsearch data node, which ties the bill to how much data a team indexes, so iron out the details on node count before signing.
Pros
- Three views and entity resolution, documented in versioned docs
- Runs on-premises or on Kubernetes
- 15 named data partners, from corporate registries to blockchain analytics
Cons
- Requires an Elasticsearch cluster
- Per-data-node pricing grows with index size
- No public price and 3 G2 reviews
A G2 reviewer in IT services wrote in October 2025, "I've been a customer of Siren in 3 roles spanning 10 years", then named the catch:
"Downsides are only really with the limitation of the backend technology choices (Elasticsearch). This can be mitigated with a wide range of JDBC connections to integrate other data sources, but you still need an ES cluster. Its also priced per data node, so that needs to be considered."
Verified user, information technology and services, G2, 15 October 2025. Source
Why it's ranked #5. Siren documents all 3 views and entity resolution, beating Palantir Gotham on the first criterion, where Gotham's catalog names two; it trails DataWalk, which publishes a scale figure Siren lacks.
Palantir Gotham
Best fit
Defense & intelligence programs with budget for deployment engineering and a need to run on classified networks.
Gotham's G-Cloud 14 service definition names its applications: Graph for network analysis, Gaia for geospatial command and control, Video, Dossier, Browser and Object Explorer. It lists deployment into "classified and multi-level security environments", DoD Impact Level 5 and SOC 2 Type 2.
Palantir's public Gotham API documents object resolution, defined as "the act of combining two or more Objects", plus map exports to KMZ and WFS.
Customers Palantir reported in its Q2 2026 business update, alongside $809 million in Q2 2026 US government revenue, up 90%.
Key features
- Graph application for link analysis across the object model
- Gaia for geospatial command and control
- Object resolution through the API
- Video for full-motion video analysis
- Dossier & Slides for writing and briefing intelligence reports
Pricing
The G-Cloud 14 catalog lists Palantir Platform: Gotham at £66,000 a unit, with no free trial.
The G-Cloud listing doesn't define the unit, so ask what one covers before comparing it to a per-seat price.
Pros
- Built for classified and multi-level security environments
- Entity resolution exposed through a public API
- A price on a public framework
- 1,007 customers across government and commercial work
Cons
- No timeline view named in the catalog
- "Unit" pricing that can't be compared until Palantir defines it
- Deployment leans on Palantir engineers, per a Hacker News user
- Exported files need Palantir to edit, per a 2017 Hacker News commenter
A Hacker News commenter called Gotham "the best tool I've seen for exploring graphical (i.e. nodes + edges) data" in May 2016 (source). A G2 reviewer in June 2023 called it "a bit pricy and has a lot of setting cost upfront" (source). The longest complaint is about what customization costs, the part where Gotham can cost an arm and a leg:
"You have to deeply invest in Palantir, and have them build in the customization necessary to really make it shine within your department. Unfortunately that ups the price significantly, so many agencies are buying essentially the off-the-shelf version and then complaining that it doesn't do what they need it to do."
ideophobia, Hacker News, 19 April 2018. Source
Why it's ranked #6. Gotham beats i2 on the fourth criterion with a £66,000 G-Cloud price, where i2 quotes privately; it trails Siren on the first, since Gotham's catalog names 2 of the 3 views.
i2 Analyst's Notebook
Best fit
Police & crime analysts who build link charts on a desktop and share chart files with forces that use the same tool.
i2 is the incumbent, and every UK police force already knows the ropes. i2 spent more than a decade inside IBM before Harris Computer, part of Constellation Software, bought it in January 2022. Version 10 is current.
Share of UK police forces running i2, per its about page, which also claims 1,000+ organizations in more than 140 countries and 70% of NATO member states.
The plans page sells four subscriptions, Core, Collaborate, Connect and Pro, and lists unstructured data processing "supporting over 200 languages". The product page names temporal analysis and social network analysis; mapping sits outside that list.
Key features
- Link charts with social network analysis measures
- Temporal analysis for the order of events in criminal activity
- Drag-and-drop data importer for structured data
- Unstructured text processing in 200+ languages
- Live connections to external repositories on the Connect and Pro plans
Pricing
Quote only. All four plans include upgrades, fix packs, on-demand training and year-round support, and none shows a price.
Pros
- Install base covering every UK police force
- Unstructured data processing in 200+ languages
- Four tiers from single user to enterprise
- Runs as a desktop application
Cons
- No map view among documented features
- No public price on any of the four plans
- 3 Capterra reviews, two of them from 2018
The same 2016 Hacker News thread that praised Gotham named i2 as its only rival: "The only other thing in the space worth using is IBM's Analyst's Notebook." Source. An IT consultant on Capterra in February 2018 warned it's "Not for an average company it requires a lot of resources and expertise." Source: Capterra.
Why it's ranked #7. i2 documents link and timeline views plus text processing in 200+ languages, beating Gephi on the second criterion; it trails Palantir Gotham, which carries a £66,000 framework price where i2 shows none.
Gephi
Best fit
Analysts, researchers & students who need to lay out and measure a network on their own laptop for nothing.
Gephi is open-source network analysis software under the GPL, free, and in development since 2008. Its desktop page puts current capacity at "up to 100,000 nodes and 1,000,000 edges" and describes a timeline for dynamic graphs. Gephi.org says the Gephi paper has been cited by more than 10,000 peer-reviewed publications, and Gephi Lite 1.0 shipped in the browser on 8 October 2025.
Key features
- Up to 100,000 nodes and 1,000,000 edges on the desktop build
- Timeline for dynamic graphs
- Exports to PNG, PDF & SVG
- Reads most graph file formats, including GEXF and CSV
- Gephi Lite 1.0 for browser-based work
Pricing
$0. Donations are optional.
Pros
- Free with no seat limit
- Handles 100,000 nodes on a desktop
- Chart exports drop straight into intelligence reports
Cons
- No entity resolution or text extraction; data arrives pre-cleaned
- Still labeled beta on its own desktop page
- No case management, permissions or audit trail
A Hacker News user in August 2024 called it "somewhat old-school, but Gephi is by far the best graph visualization tool I've used that stays robust and usable at such scales" (source). An earlier user drew the limit: Gephi "becomes useless once you get to large graphs" (source, November 2014).
Why it's ranked #8. Gephi ties Maltego on all five criteria and wins the tie-break at $0 against Maltego's €3,000 plan; it trails i2, which processes unstructured text in 200+ languages, a job Gephi leaves to other tools.
Maltego
Best fit
OSINT and cyber investigators who want transforms that pull public data straight onto a link chart.
Maltego ranks first in our OSINT tools ranking as a collection tool. Judged as an analysis workspace it lands lower: Maltego's documentation shows Graph, Map and Table views side by side in the browser client, with a separate desktop client, and no timeline view.
The pricing page lists 100+ integrations to external data sources. Each transform run draws on a monthly credit allowance, so heavy intelligence gathering on social media and the dark web burns credits fast, and the free tier's 200 a month is a drop in the bucket.
Key features
- Transforms that query 100+ data integrations from the graph
- Graph, Map and Table views shown together
- Browser & desktop clients, with .mtgx files moving between them
- Connector Builder for importing internal data
Pricing
Basic is free with 200 credits a month, and Basic+ gives 1,000 credits free to users who register with a government or organization email. Entry Standard costs €3,000 per user per year for 10,000 credits a month; Professional Standard and Professional Advanced cost €7,500 for 20,000 and 40,000 credits.
Pros
- A free tier and published paid tiers
- Collection & charting in the same window
- Map view beside the graph
Cons
- No timeline view among documented views
- Credit allowances cap how many transforms a month a seat can run
- Paid transforms behind the free tier, per a Capterra reviewer
A Hacker News user in July 2013 called it "an OSINT network analysis tool that is as good as anything I know about in civilian law enforcement" (source). A threat analyst on Capterra in April 2025 flagged the cost side: "A lot of the functions and transformations require a paid option." Source: Capterra.
Why it's ranked #9. Maltego beats Silobreaker on the first criterion with 2 views, graph and map, plus a €3,000 published price; it trails Gephi, which ties on all five criteria and costs $0.
Silobreaker
Best fit
Threat intelligence and security teams producing recurring intelligence reports from open, dark web and premium sources.
Silobreaker's product page says it collects "from millions of open, closed and premium sources" into a multi-domain ontology. It sells three solution lines, cyber threat intelligence, geopolitical risk and physical security, and launched Silobreaker AI, now listed as Mimir, on 6 November 2023.
Its own glossary says Silobreaker "centralizes, automates and analyzes vast amounts of data from diverse sources". Its three solution lines watch for emerging threats across cyber, geopolitical and physical risk, giving security teams situational awareness without a collection pipeline of their own.
The capabilities it names center on collection, PIR-guided workflows and AI-assisted analysis; a link chart, map or timeline isn't among them. The homepage cites a 90% cut in reporting time for a UK government department and supplier monitoring across 70,000 suppliers for a financial services firm.
Key features
- Collection from millions of open, closed and premium sources
- Priority intelligence requirement (PIR) guided workflows
- Silobreaker AI, now listed as Mimir, inside the intelligence engine
- Dark web monitoring for leaked credentials, per G2 reviewers
Pricing
Quote only, and Vendr's Silobreaker page carries no purchase data.
Pros
- Source coverage across open, dark web and premium feeds
- PIR workflows that match how intelligence teams set requirements
- Covers cyber, geopolitical and physical risk in one subscription
Cons
- No link chart, map or timeline view named on its product pages
- No public price
- Gaps in leaked-credential coverage, per a G2 reviewer
- Price and trial length criticized on G2
A DevOps engineer on G2 in January 2023 wrote that "It is expensive compared to the global market", and a cloud security reviewer in November 2023 reported "Sometimes some of the leaked credentials were not available on the Silobreaker". Source: G2.
Why it's ranked #10. Silobreaker documents ingest from millions of sources, which keeps it on the list, but it names 0 of the 3 analysis views and no price, so it ranks below Maltego's €3,000 graph-and-map workspace.
How intelligence analysis software turns disparate data into actionable intelligence
Intelligence analysis software does four jobs in sequence: collect, resolve, analyze, report. Each of the ten tools above leans toward one or two of them, and the ranking rewards the ones that cover the middle two without a second product.
Collecting from multiple data sources
Data collection is gathering information from multiple sources into one place. Maltego does it with transforms against 100+ integrations, Silobreaker with feeds from millions of open, closed and premium sources, and DataWalk by importing internal databases, spreadsheets, public records & social media into a single database.
Volume is the reason this moved off spreadsheets: DataWalk's defense page claims billions of records. Data collection and data analysis used to happen in separate products, and Maltego and Silobreaker still lean to the first while Gephi and i2 lean to the second.
Resolving entities in disparate data
Raw data from diverse sources repeats itself. One person shows up as a phone subscriber, an account holder and a vehicle owner, spelled three ways. Entity resolution merges those records into one profile; Gotham calls it object resolution in its API, Linkurious sells it as Entity Resolution AI, and Siren builds it into search. Without it, link charts count the same suspect three times.
Link analysis, maps and timelines
The visualization capabilities buyers compare are the three views from the first criterion. Link analysis finds hidden connections between entities; geospatial analysis shows patterns in location data, from terrain and routes in defense planning to incident clusters for public safety; timeline analysis puts temporal data in order, which is how analysts identify patterns of life. Five of the ten rank highest because they ship all three.
AI and automated tools in intelligence analysis
AI-powered analytics now ships across this list: Linkurious Copilot, Silobreaker's Mimir, DataWalk's anomaly detection and LLM report summaries. These automated tools run big data analytics and machine learning over vast amounts of records to identify patterns and proactively identify potential threats, then hand an analyst a shortlist to check.
The judgment stays with the analyst. The CIA primer's 12 techniques are written for people to run, and the software's part is feeding them evidence. Automation cuts the human error of reading 10,000 rows by eye, and an analyst still signs the assessment.
From analysis to intelligence reports
The end product is actionable intelligence for decision making: a finished assessment an investigator, a commander or a compliance officer can act on. Gotham ships Dossier & Slides for writing it up, i2 includes data sharing tools in every plan, and Gephi exports charts as SVG. Intelligence reports that carry their sources support decision making: readers make informed decisions and can check the chain of evidence.
Commercial teams use the same intelligence analysis software for a broad range of work. Fraud teams trace financial transactions to mitigate risks, compliance teams support investigations into sanctions exposure, and corporate security teams protecting critical infrastructure feed actionable insights into strategic decision making. Law enforcement remains the largest user group: i2 alone counts every UK police force.
Data management and access control decide who sees which sensitive information. DataWalk enforces cell-level security on every record, allowing users with different clearances to share one database, and Gotham's catalog lists multi-level security environments, enabling users at different classification levels to work in one deployment.
For intelligence agencies, that permission model matters more than the specific software brand on the login screen. Our data intelligence tools ranking covers the governance side of the same problem.
Intelligence analysis methodology, and where software fits
Intelligence analysis methodology is the set of steps and techniques that turn information gathered into a judgment decision makers can act on. Software speeds the middle of it. The critical thinking at both ends still belongs to intelligence analysts.
The US intelligence community describes six steps: planning, collection, processing, analysis, dissemination & evaluation. The 18 organizations in that community run the same loop. Processing and analysis are where the ten tools above earn their money, through entity resolution, link charts, geospatial analysis and timeline analysis.
Structured analytic techniques are the method part. The CIA's Tradecraft Primer, published March 2009, sets out 12 in three groups of 4:
- Diagnostic: key assumptions check, quality of information check, indicators or signposts of change, analysis of competing hypotheses (ACH)
- Contrarian: devil's advocacy, Team A/Team B, high-impact/low-probability analysis, "what if?" analysis
- Imaginative: brainstorming, outside-in thinking, red team analysis, alternative futures analysis
ACH is the one software touches most. It's a grid for testing hypotheses against evidence, and every piece of evidence in that grid has to trace back to a node, a record or a document. A link chart with entity resolution behind it makes the trace possible; a whiteboard makes it easier said than done.
Types of intelligence analysis tools
The ten split into four groups of intelligence analysis software, and most buying mistakes come from comparing tools across groups:
- Link analysis workbenches (i2 Analyst's Notebook, Gephi): a desktop chart an analyst builds by hand or by import. Cheap to start, hard to share at scale.
- Graph investigation platforms (Linkurious, GraphAware Hume, Siren): a shared web workspace over a graph database or search index, with alerts for potential threats and permissions per user.
- Data fusion platforms (Palantir Gotham, DataWalk): ingest from multiple data sources into one model, resolve entities, then analyze. Highest price, longest deployment.
- Geospatial and collection tools (ArcGIS AllSource, Maltego, Silobreaker): start from a map, a transform or a source feed, then add analysis on top.
Business intelligence tools such as dashboards and predictive analytics sit next to all four without replacing any. They forecast trends from historical data in rows and columns; intelligence analysis software models people, places and events as connected entities. Our guide to market intelligence vs business intelligence covers that split for commercial teams, and decision intelligence platforms cover the forecasting side.
Data sources: OSINT, public records and the dark web
The intelligence community names five collection disciplines: HUMINT from human sources, SIGINT from intercepted signals, GEOINT from imagery and geospatial data, MASINT from scientific and technical measurement, and OSINT from publicly available information. Commercial buyers of these tools mostly work with OSINT plus their own records.
Open source intelligence covers social media, websites, public records and the deep web. Recorded Future's OSINT tools guide dates Google dorks, crafted search queries for security investigations, to 2002, and expects machine learning to drive OSINT trend recognition. Dark web search services now reach content without a specialized browser.
Volume is the reason any of this needs software. Criminal networks that span drugs, fraud and money laundering leave their trail across disparate data held by different agencies.
Organized crime groups under investigation in the EU, counted in Europol's SOCTA 2017. 45% were involved in more than one criminal activity, and 7 in 10 were active in more than three countries.
That's the case for entity resolution and data fusion. A suspect whose name appears in a phone record, a bank file and a vehicle registration is three disparate sources until software joins them, and uncovering hidden connections across large volumes of complex data is the work security teams and law enforcement buy intelligence analysis software for.
Intelligence analysis software pricing across the category
Six of the ten intelligence analysis software platforms carry a price on record, spanning $0 to £150,000 a year. The other four quote privately. Free and cheap options exist at the bottom, and each one cuts corners somewhere a funded unit can't afford to.
Outside the ten, two link analysis tools publish prices low enough to pilot on a team budget. SentVi, formerly Sentinel Visualizer, sells a desktop subscription at $499 for one month or $250 a month on a 12-month term, per its editions page. Kineviz GraphXR has a free tier and a Pro plan at $36 a month on its pricing page, with time and geospatial analysis included.
The hidden costs sit in three places:
- Second licenses: Hume needs a Neo4j license, Siren needs an Elasticsearch cluster, and AllSource's add-on route needs a Creator user type.
- Usage meters: Maltego bills credits, Siren bills per data node, and Linkurious bills per user per month.
- Services: Palantir's "unit" price says nothing about the deployment engineering Hacker News users describe as the real spend.
Common mistakes when buying intelligence analysis tools
The most expensive mistake is buying the off-the-shelf configuration of intelligence analysis software that only works after customization, which is the exact pattern described in the Palantir quote above. Ask for the services estimate in the same document as the license.
Testing on vendor demo data is the second. A tool that resolves the vendor's clean sample can fail on your three spellings of one name. Skip that test and the team is back to square one after signing.
Load 500 of your own records with known duplicates, and count how many the entity resolution catches.
The third is ignoring the exit. A Hacker News commenter discussing the NYPD's 2017 Palantir cancellation wrote that without the platform, a saved Gotham file lets an analyst view entities & relationships but not edit them. Buying with no open export puts all your eggs in one basket.
Ask every vendor for a full export in an open format, such as GEXF, CSV or GraphML, before you sign.
The last is paying for three views when your intelligence operations only need one. A unit mapping incidents for public safety gets most of its value from AllSource's map, while a fraud team chasing financial transactions through shell companies gets it from a graph platform like Linkurious.
Intelligence analysis tools FAQ
What are the 5 steps of the intelligence cycle?
Planning, collection, processing, analysis and dissemination. The US intelligence community adds a sixth, evaluation, on its How the IC Works page.
What are the 5 main intelligence collection disciplines?
HUMINT, SIGINT, GEOINT, MASINT and OSINT: human sources, intercepted signals, imagery and geospatial data, scientific measurement, and publicly available information.
What are intelligence analytical techniques?
Structured methods that make an analyst's reasoning checkable. The CIA's 2009 primer lists 12 in diagnostic, contrarian and imaginative groups, with analysis of competing hypotheses the best known.
Can I use OSINT tools for free?
Yes, within limits. Maltego Basic is free with 200 credits a month, Gephi costs $0, and Kineviz GraphXR has a free tier. Each caps volume or leaves out entity resolution, permissions and audit trails.
What does high quality intelligence analysis look like?
Every judgment traces back to a source, the assumptions are written down, and competing hypotheses were tested before one won. The CIA's quality of information check and key assumptions check are the two techniques that enforce it, and entity resolution keeps the underlying records honest.
What is the best intelligence analysis software?
On the five criteria here, Linkurious Enterprise, because it documents a graph, a map and a timeline, deploys on-premises, publishes a price and publishes a user count. For location-first work, ArcGIS AllSource is the pick.
Bottom line
Linkurious Enterprise wins on the criteria: three views, a €490 per-seat price and a 30-day trial, so a fraud or investigation team can test it on real data this month. ArcGIS AllSource is the pick when the map comes first and the network can't touch the internet.
Agencies already committed to a graph database should shortlist GraphAware Hume if that database is Neo4j, and Siren if it's Elasticsearch. DataWalk and Palantir Gotham suit programs that want data fusion at scale and have the budget for a long deployment, with DataWalk the one to price against Gotham.
i2 Analyst's Notebook remains the safe pick for police analysts who share chart files with other forces. Gephi and Maltego's free tier are where an analyst learns link analysis for nothing, and Silobreaker belongs on a threat intelligence team's list as a collection feed that pairs with one of the platforms above it.