PassiveTotal provides access to the most comprehensive internet data sets available to map threat infrastructure and provide unparalleled context and intelligence to internal events and incidents, automatically aggregating and correlating data about a security event that would otherwise take an analyst days or hours of manual analysis. For over 13,000 users, PassiveTotal simplifies and accelerates event investigation and intelligently consolidates and analyzes data from multiple data sources into a single pane of glass. Of 320 surveyed PassiveTotal users, 84% find PassiveTotal more comprehensive than other security data sources.
One of the unique capabilities that sets PassiveTotal apart is its ability to alert analysts of infrastructure changes based on collected data sets and most recent scans. PassiveTotal has continued to build on this monitoring framework and supports a wide range of query types focused on newly observed host domains and WHOIS registrant data. Additionally, PassiveTotal is the only platform in which users looking to monitor specific indicators or keywords can be alerted when changes are detected.
For years, PassiveTotal has provided analysts with tools to classify or tag infrastructure items. Now, it’s the only platform offering full collaboration in threat hunting in the form of “projects,” which give users the option to create public or private projects with names, descriptions, collaborators, and monitoring profiles.
Evidence of RiskIQ’s persistent progress is shown by a year-over-year bookings growth of 80 percent across every product in the platform in the first half of 2016. Now, more than 200 enterprise customers, including eight of the 10 largest financial institutions in the U.S. and five of the nine leading internet companies in the world, rely on RiskIQ to protect their digital attack surface.
How we are different
-For over 13,000 users, PassiveTotal simplifies and accelerates event investigation and intelligently consolidates and analyzes data from multiple data sources into a single pane of glass. The world-class platform addresses a larger number of threats in less time than the traditional manual processes employed by investigators. The data that PassiveTotal aggregates and correlates is routinely used by analysts in investigations and can be integrated into other security platforms. Additionally, PassiveTotal supports out-of-the-box integrations with Splunk, QRadar, Maltego, and Phantom, with new integrations being regularly developed
-One of the unique capabilities that sets PassiveTotal apart is its ability to alert analysts of infrastructure changes based on collected data sets and most recent scans. PassiveTotal has continued to build on this monitoring framework and now supports a new range of query types focused on newly observed host domains and WHOIS registrant data. PassiveTotal is the only platform in which users looking to monitor specific indicators or keywords can be alerted when changes are detected.
-One of the primary byproducts from infrastructure analysis is almost always a set of indicators that tie back to a threat actor or group of actors. For years, PassiveTotal has provided analysts with tools to classify or tag infrastructure items. Now, it's the only platform offering full collaboration in threat hunting in the form of "projects," which give users the option to create public or private projects with names, descriptions, collaborators, and monitoring profiles. Visiting a project’s details shows a listing of all associated artifacts and a detailed history that retains all the context needed for one analyst to pick up where another left off. Threat actor profiles can be built within PassiveTotal and serve as a “living” set of indicators. As new information is discovered or found, it can be added to that project.
About this category: Threat Detection and Response
The Cybersecurity Excellence Awards recognize products that detect and respond to threats across an organization. It is the broad detection category, for products that draw on several data sources or fit no narrower category.
An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against organizations of similar size and region. Entry packages, sponsorship and public votes do not affect the jury's scores.
Community Choice voting for the 2020 season closed on July 10, 2020.
What is the Community Choice Award?
A separate award decided by public vote, independent of the jury awards. Each completed share of a profile on LinkedIn, Facebook or X counted as one vote.
2027 award season
Nominations closeFebruary 27, 2027
Jury winners announcedWeek of March 22
Community Choice voting closesJuly 10, 2027
Nominate in this category
Enter a nomination in Threat Detection and Response. Review takes about one business day.
Help This Nominee Win a Community Choice Award Vote by sharing this page:
4
Community
Votes
Cast your vote by sharing this nominee’s profile on LinkedIn, Facebook, or X, using the buttons above. Each completed social share adds one Community Choice vote.
Votes cast by July 10, 2027 will determine the Community Choice winners (independent of the jury awards). Winners will be announced before Black Hat USA.
What is the Community Choice Award? →
Community Choice is a separate award track from the jury-selected Cybersecurity Excellence Awards. Jury winners are chosen by expert judges, while Community Choice winners are determined by public voting. A nominee may be honored by the jury, the community, or both.
2020 winners in Threat Detection and Response
To keep judging fair, each entry is judged against peers in its segment, so a category can have more than one Gold winner.
