What is included in Kaspersky Threat Intelligence Bundle?

Threat Data Feeds – Machine-readable IoC streams for SIEM, firewall and proxy.
Threat Lookup – Web and API lookups for hashes, URLs, domains.
Threat Intelligence Reporting – APT, crimeware and ICS reports mapped to MITRE ATT&CK.
Threat Analysis – Research sandbox, attribution engine and similarity search for samples.
Digital Footprint Intelligence – Dark web monitoring for leaked credentials and exposed services.
Important – No endpoint agent, no protection component, no management console.

What are the main benefits of Kaspersky Threat Intelligence Bundle?

Kaspersky Threat Intelligence Bundle is a subscription to Kaspersky's threat intelligence services, delivered through the web-based Kaspersky Threat Intelligence Portal and a RESTful API rather than through software installed on your devices. Selected components, including CyberTrace, the research sandbox and the attribution engine, can instead be deployed on your own infrastructure.

Faster alert triage – Feed context lets analysts dismiss noise without escalation.
Existing tools reinforced – Feeds plug into ArcSight, QRadar, Sentinel and Splunk.
Attribution in minutes – Links a sample to known APT actors and campaigns.
Leak detection – Finds stolen employee credentials before attackers use them.
Phishing domain takedowns – Kaspersky manages the removal request end to end.
Private research access – Over 200 non-public reports a year, plus retrospective access.

Best antivirus? Why Windows Defender alone is not enough
Explains why built-in protection leaves gaps that additional security layers have to close.

Which company size is Kaspersky Threat Intelligence Bundle suitable for?

The deciding factor is not headcount but whether someone in the organisation reads and acts on intelligence. Feeds and reports create work rather than remove it: without a SIEM to receive the indicators and an analyst to judge them, the subscription produces alerts nobody closes.

Does Kaspersky Threat Intelligence Bundle meet the requirements of Swiss cybersecurity legislation?

The reporting obligation under the revised Information Security Act applies to operators of critical infrastructure in Switzerland, not to every company. Organisations in scope must report a significant cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. Where this subscription helps is the content of that report: Threat Lookup, the research sandbox and the attribution engine let an analyst classify a sample, name the malware family and map observed behaviour to MITRE ATT&CK while the clock is running. What it does not do is notice the incident in the first place, because it has no agent and receives no telemetry from your systems, and it neither stores logs, files the notification, nor establishes whether you are in scope. Detection, log retention and the reporting process itself have to come from your endpoint protection, your SIEM and your own documented procedures. This is general product information and not legal advice; whether your organisation falls under the reporting obligation should be clarified with a qualified adviser.

Does Kaspersky Threat Intelligence Bundle meet the requirements of European cybersecurity legislation?

No product makes a company NIS 2 compliant, because the directive addresses management accountability, processes and evidence rather than software features. NIS 2 requires measure categories including risk analysis, incident handling, business continuity, supply chain security, vulnerability handling and disclosure, and procedures to assess whether the measures actually work. This subscription supports incident handling by supplying context and indicators for triage, supports supply chain security through dark web monitoring of leaked credentials and brand abuse, and supports vulnerability handling through the reporting tracks and the vulnerability data in the feeds. It contributes nothing to business continuity, cryptography, access control, multi-factor authentication or staff training, and it generates no evidence about the state of your own controls. Those categories require separate products and documented internal processes.

What should you know about official assessments of Kaspersky?

Germany's Federal Office for Information Security (BSI) issued a formal warning against the use of Kaspersky products in March 2022 under §7 of the BSI Act, arguing that a manufacturer headquartered in Russia could be compelled to act against users. That warning is still in force, and Kaspersky is pursuing legal action against it. On 20 June 2024 the US Department of Commerce's Bureau of Industry and Security issued a Final Determination prohibiting Kaspersky from selling to US persons from 20 July 2024 and from supplying updates or operating the Kaspersky Security Network there from 29 September 2024; three group entities were added to the Entity List. Kaspersky rejects the reasoning, states that the decision was based on the geopolitical climate rather than an evaluation of its products, offered independent third-party verification of its code and updates, and stated that the US decision does not affect its ability to sell threat intelligence offerings and trainings in the United States. In Switzerland the position differs: BACS has issued no warning and no internal directive on Kaspersky, has said no misuse was reported to it, and stated that its technical assessment was not changed by the US ban. Independent recognition of the threat intelligence portfolio itself is unaffected by these measures, with Kaspersky named a leader in the Frost Radar for Cyber Threat Intelligence 2024 and covered in the SPARK Matrix for Digital Threat Intelligence Management. In practice this matters most for public sector tenders, for suppliers to US-linked organisations, and for group companies whose German parent follows BSI guidance; for a privately held Swiss company with no such contractual exposure, it may not affect the decision at all.

Norton vs. Kaspersky – Which antivirus program offers the best protection in 2025?
Compares the detection performance of both vendors against independent test results.

Does Kaspersky Threat Intelligence Bundle help with security questionnaires from large customers?

Partly, and in a narrower band than most buyers expect. It answers questions about which external threat intelligence sources you subscribe to, whether you monitor the dark web for leaked employee and customer credentials, whether you track your own externally exposed services, whether malware samples are analysed in a sandbox before a verdict is reached, and whether attacker behaviour is classified against MITRE ATT&CK. It answers nothing about endpoint protection, patch levels, disk encryption, multi-factor authentication, privileged access, backup and restore testing, log retention periods, or security awareness training, and it produces no audit evidence about your own environment. There is also a question increasingly common in questionnaires that this product raises rather than answers: some customers ask specifically whether software or services of Russian origin are in use, and a threat intelligence subscription is in scope of that question. To close the control gaps within the same family, an endpoint and XDR product from the Kaspersky range is normally the cheaper route than adding a second vendor; where vendor origin is itself the constraint in your questionnaires, the honest assessment is that this subscription's value is internal to your security team rather than something you can present externally.

Which limitations should you know before buying?

The clearest regional limitation is the United States, where the Commerce Department prohibition applies to Kaspersky products and services, although Kaspersky states that its threat intelligence offerings are not affected by it; organisations with US entities should clarify this before purchase rather than assume either reading. Kaspersky Threat Intelligence is a portfolio of individually licensable services, and retail bundle packages differ in which of them they contain, so confirm the exact component list of the package you are buying instead of assuming the full portfolio. Analytical reports within Digital Footprint Intelligence are an add-on rather than part of the base service. On-premises and air-gapped deployment is available for CyberTrace, the research sandbox and the attribution engine, but not for the portal-delivered services. The limitation that most often triggers a follow-up purchase is the absence of any protection layer: this subscription enriches decisions but blocks nothing, so it assumes you already run endpoint protection and a SIEM.

Frequently asked questions about Kaspersky Threat Intelligence Bundle

Do you need a SIEM to use the threat data feeds?

For the feeds, effectively yes, because they are machine-readable indicator streams meant to be matched against your logs. CyberTrace sits between the feeds and the SIEM, parses incoming logs, matches them against indicators and forwards only detection events, which reduces the load on the SIEM. The portal services such as Threat Lookup and the reports can be used manually through a browser without any integration.

Can the analysis components run without sending files to Kaspersky?

Yes, for the components designed for it. The research sandbox can be deployed on-premises so that samples are not exposed outside the organisation, and the attribution engine supports deployment in air-gapped environments, which also allows you to add your own actors and samples and to export YARA rules.

Can a service provider use this for several customers?

CyberTrace and Digital Footprint Intelligence both support multitenancy, which is intended for managed security service providers and for large organisations with multiple branches. Each tenant is handled separately, so one subscription can serve several customer environments without mixing their data.