Recorded Future Inc

Recorded Future is the largest pure-play threat intelligence business in the world and, since December 2024, the cybersecurity intelligence engine inside Mastercard's Security Solutions franchise. The company industrialised a discipline that was historically artisanal: it continuously ingests and machine-processes open web, deep web, dark web and technical telemetry into a persistent knowledge graph — the Intelligence Graph — and layers analyst-authored assessment from its in-house research arm, Insikt Group, on top. The output is sold as modular SaaS subscriptions to over 1,900 enterprise and government customers across 75–80 countries, including the governments of 45 nations and more than half of the Fortune 100. Its differentiation is breadth of collection plus independence from any single security stack, which lets it sit alongside CrowdStrike, Palo Alto and Microsoft rather than compete for the same control-plane budget. Under Mastercard, its strategic burden has shifted: it must now also convert intelligence into payment-fraud prevention at network scale.

What the company does

Recorded Future operates a threat intelligence platform. The core technical proposition, unchanged in principle since the founders' 2007 patent filing (granted 2013 as US8468153B2, "Information service for facts extracted from differing sources on a wide area network"), is automated, continuous collection of text, technical and image data from an extremely wide source aperture, followed by machine extraction of entities, events and temporal relationships, and then presentation of the resulting structure to human analysts through a SaaS portal.

The company's own current characterisation, used consistently across its 2025–2026 press releases, is that it is "the world's largest threat intelligence company," providing "a comprehensive and independent threat intelligence platform" whose "Intelligence Cloud offers end-to-end intelligence across various domains, including cyber, supply-chain, physical, and fraud." Recorded Future states the Intelligence Graph contains in excess of 200 billion nodes of threat data and that it serves over 1,900 organisations across 80 countries (Gartner MQ announcement, May 2026 — note the country count has been revised upward from the 75 cited at acquisition in 2024).

Two elements distinguish the collection posture. First, the temporal dimension: the original "Temporal Analytics Engine" framing — extracting not just what is being said but when events are asserted to have happened or are predicted to happen — remains the conceptual spine of the product. Second, the human layer: Insikt Group, established May 2017 ("insikt" is Swedish for insight, a nod to the Swedish founders), produces finished analytic product, and its public research output functions as both a credibility engine and a demand-generation channel.

Independent characterisation

Recorded Future is best understood as a data-and-analysis utility, not a security control. It does not block, quarantine, patch or remediate in its own right. It supplies decision-grade context that other tools and other humans act upon. This is commercially double-edged. On the upside it is stack-agnostic, so it can be sold into any environment and integrated with any SIEM, SOAR, EDR or firewall — historically its integration partnerships with Splunk (2016) and Palo Alto Networks (2016) were foundational, and its 2026 posture extends this to Model Context Protocol (MCP) server access so that customer-side AI agents can query the Graph directly. On the downside, intelligence has historically been a line item that CISOs cut first under budget pressure, and it is structurally vulnerable to being bundled for free by platform vendors — CrowdStrike, Microsoft and Google all attach threat intelligence to platform subscriptions.

The company's strategic response, visible from October 2025 onward, is to move from insight to action: Autonomous Threat Operations (ATO), launched at Predict 2025, is explicitly positioned as converting intelligence into "automated, continuous defensive actions across the entire security ecosystem," and the company claims it compresses a threat hunt from roughly 27 manual steps to as few as five largely automated ones. This is an attempt to escape the "advisory tool" budget category and enter the "operational tooling" category, where retention and expansion economics are better.

Revenue model

Value chain position

Recorded Future sits upstream of security operations and downstream of raw internet telemetry. It is a collector, refiner and distributor of a commodity input (raw signal) into a differentiated output (contextualised intelligence). Under Mastercard ownership it has acquired a second value-chain position it did not previously occupy: an input into a payment network's fraud-scoring engine. Mastercard Threat Intelligence, launched at Money20/20 USA in October 2025, fuses Mastercard's transaction-network visibility with Recorded Future's curated cyber intelligence and is sold to issuing and acquiring banks and merchant compliance teams — a customer set Recorded Future did not previously reach at scale.

Customer types and end-markets

Stated strategy

Recorded Future's corporate mission, used consistently in its own materials, is "Secure our World with Intelligence." Colin Mahony's stated rationale for joining and leading the company is built around this mission, leveraging the Intelligence Cloud and the company's risk mitigation and remediation capabilities.

The strategic thesis as articulated by CEO Mahony in 2026 has three explicit customer outcomes: stopping threats pre-attack; running intelligence autonomously at a scale no human team can match; and making every security control the customer already owns more effective. This is a precise and commercially deliberate formulation. The third clause in particular is a bundling defence — it positions Recorded Future as multiplying the value of CrowdStrike, Palo Alto and Microsoft deployments rather than competing with them, which is the only tenable position for a standalone intelligence vendor against platform incumbents.

Mastercard's stated strategic rationale, from Johan Gerber at completion, is that "adding Recorded Future's AI-driven threat intelligence capabilities to our cybersecurity services, identity solutions and real-time fraud scoring will enable us to better support our customers." Mastercard framed the acquisition as bolstering "the insights and intelligence used to secure today's digital economy — in the payments ecosystem and beyond."

Critically, both parties committed publicly to preserving independence. Ahlberg at announcement: "We will remain an independent and open intelligence platform, operating as an independent subsidiary of Mastercard." Mastercard confirmed at close that the company "will continue to operate as a separate entity." As at September 2026, that commitment has been honoured — Recorded Future retains its own brand, CEO, product roadmap, customer conferences and press function.

Announced strategic initiatives, last 24 months (September 2024 – September 2026)

Sustainability / ESG commitments

No standalone Recorded Future ESG commitments, targets or reporting are publicly disclosed.

Cost programmes with targets

None disclosed. No restructuring programme, headcount reduction target, or cost-out programme has been announced for Recorded Future by either the company or Mastercard.

Management's medium-term financial targets

None disclosed for Recorded Future. No revenue target, margin target, ARR target or customer target has been issued since the acquisition. The last quantified target-adjacent disclosure of any kind was the November 2022 ARR milestone.

The relevant guidance is Mastercard's. For 2026, Mastercard has guided to continued net revenue growth and outlined expected operating expenses, with management characterising the macroeconomic environment as supportive. Michael Miebach's framing on the FY2025 results: "Focused, agile, and diversified, we're well positioned for the opportunities ahead in 2026." Recorded Future is one contributor within Value-Added Services and Solutions, which grew 23% as reported and 21% currency-neutral in FY2025.

All products are delivered from the Recorded Future Intelligence Cloud on the Intelligence Graph substrate. The company states the Graph contains in excess of 200 billion nodes (May 2026). Pricing is modular and tiered by module and data volume; no specific price points are publicly disclosed for any module. Target customer and capability descriptions below are drawn from the company's product pages and launch releases.

Platform foundation

Recorded Future Intelligence Cloud / Intelligence Platform The unified SaaS environment. Continuously collects from open web, deep web, dark web and technical sources; applies machine learning and natural language processing to extract entities, events and temporal relationships; renders the result in a portal with search, alerting, dashboards and API access. This is the substrate on which every module below runs. Launch lineage: originating platform 2009–2012; substantially re-released May 2022 with expanded brand, identity and attack surface capability; continuously versioned since.

Intelligence Graph The persistent knowledge graph. Claimed scale: 200+ billion nodes of threat data (2026). The differentiator is temporal structure — the Graph records not merely relationships but when assertions were made and when events are asserted to occur.

Recorded Future AI Launched April 2023 on a trained OpenAI GPT model, combining Insikt Group analysis with over 100 terabytes of text, image and technical data. As of 2026 it has evolved into an agentic layer: it automatically routes analyst questions to the appropriate tools and agents via built-in agent invocation, and exposes the Intelligence Graph beyond the platform through a Recorded Future MCP server and an accompanying set of MCP tools, so that customer-side AI agents can query Recorded Future intelligence wherever they operate. Target customer: CTI analysts and SOC teams; explicitly positioned to satisfy "even the most skeptical CTI analyst."

Autonomous Threat Operations (ATO) — flagship Launched 8 October 2025 at Predict 2025; general availability reached approximately February–March 2026. ATO converts real-time threat intelligence into continuous, automated threat hunts across heterogeneous customer environments. The company's headline capability claim is the reduction of a threat hunt from roughly 27 manual steps to as few as five largely automated ones. In the first month of GA, Recorded Future reported that early adopters had "exponentially increased the number of threats hunted without increasing analyst workload," citing a global biotechnology customer describing significantly reduced manual effort. Positioning per CEO Colin Mahony: stopping threats pre-attack, running intelligence autonomously at a scale no human team can match, and making every existing security control more effective. Target customer: enterprise SOC and threat-hunting teams. This is the company's principal growth vector.

Intelligence modules

SecOps Intelligence Real-time intelligence for security operations centres: indicator enrichment, alert triage and prioritisation, correlation against the Graph. Target customer: SOC analysts, incident responders. Integration-dependent — designed to enrich SIEM/SOAR/EDR workflows rather than replace them.

Threat Intelligence (core CTI) Adversary tracking, infrastructure mapping, campaign and TTP analysis, finished Insikt reporting. Target customer: dedicated CTI teams, threat hunters, intelligence directors.

Brand Intelligence Mass-scale machine learning detects internet-wide threats to a brand's logo, typo-squatted domains and malicious domains; surfaces threat detail in real time and supplies validation and response playbooks. Significantly enhanced in the May 2022 platform release. Target customer: brand protection, fraud, marketing security and legal/takedown teams. This is also the module extended through the 2026 Wipro alliance, which added brand monitoring to Wipro's managed portfolio.

Identity Intelligence Detection of compromised credentials and exposed identities across the open and dark web. Target customer: IAM and SOC teams.

Vulnerability Intelligence Risk-scored vulnerability context — real-world exploitation evidence, exploit availability, adversary interest — designed to prioritise patching beyond CVSS. Target customer: vulnerability management and IT operations. Strategically important given the company's own research history on the manipulation of national vulnerability databases.

Attack Surface Intelligence / External Attack Surface Management (EASM) Discovery and continuous monitoring of internet-facing assets, including unknown and shadow infrastructure. Target customer: security architecture, cloud security, M&A due diligence teams.

Third-Party Intelligence Continuous risk monitoring of vendors, suppliers and partners. Target customer: third-party risk management, procurement, supply chain security. Increasingly relevant under EU NIS2 and comparable supply-chain regulation.

Geopolitical Intelligence Nation-state, conflict, sanctions and political-risk intelligence. Target customer: corporate security, executive protection, strategy and risk functions, government. This module is the commercial expression of the company's most publicly visible research (RedEcho, CNNVD/MSS, Chinese influence operations) and underpins its annual State of Security Report.

Payment Fraud Intelligence Intelligence on stolen card records, card testing, digital skimming, fraud infrastructure and the fraud services economy. Led by Ilya Volovik. This module is the direct commercial bridge to Mastercard. Its annual payment fraud report (published March 2026) found that the number of stolen credit card records accessible for sale fell by almost 20% in 2025 versus 2024, while flagging the increasing industrialisation of fraud support services and technology.

Malware Intelligence Announced 29 April 2025 with patent-pending capability, marketed under the claim that Recorded Future AI "passes the Malware Turing Test." Automates malware threat identification, accelerates threat tracking and streamlines incident response. Target customer: malware analysts, DFIR teams.

Joint product with parent

Mastercard Threat Intelligence Launched 28 October 2025 at Money20/20 USA; announced separately for Asia-Pacific the same month. Not a Recorded Future-branded product but the principal joint offering. Combines Mastercard's global fraud insights and payment-network visibility with curated cyber threat intelligence from Recorded Future's platform. Disclosed feature set: real-time card testing detection to block fraudulent test transactions before losses occur; digital skimming intelligence to counter card-related malware; merchant threat intelligence to accelerate incident response; weekly reports on emerging payment-ecosystem vulnerabilities; and payment intelligence reports containing fraud trend analysis and case studies. Target customer: payment fraud and merchant compliance teams at issuing and acquiring banks. Disclosed early results: during market testing, the intelligence supported takedowns of malicious domains that had affected nearly 9,500 e-commerce sites and, per one regional account, domains linked to approximately $120 million in payment fraud. Supporting market data cited at launch: 60% of global fraud leaders are notified of cyber breaches only after fraud losses begin (67% in APAC); 83% of APAC financial institution leaders report frustration at the lack of real-time CTI integration; 89% of APAC institutions report faster fraud defence responses following integration.

Services

Disclosure status

Recorded Future has never published audited financial statements. It is not, and has never been, an SEC registrant. Since December 2024 it has been a consolidated subsidiary of Mastercard, which does not disaggregate it. Accordingly:

The only public revenue-scale datapoints

Recorded Future disclosed revenue/ARR reference points, USD millions. Blank cells indicate no disclosure for that year — they are not zeros and should not be interpolated. Note that the 2020 and 2022 figures are ARR (annual recurring revenue) as press-released by the company; the 2024 figure is "annual revenue" as reported by trade press citing the company's own website at the time of the Mastercard announcement. These are not strictly like-for-like.

Derived observations, stated as derivations rather than disclosures:

• The implied compound growth of the disclosed ARR/revenue points from 2020 ($140m) to 2024 ($300m) is approximately 21% per annum. One secondary source (businessmodelcanvastemplate.com, March 2026) characterises late-2024 ARR as having "surpassed $300 million with year-over-year growth above 20%," which is consistent with that derivation but is not a primary disclosure and should be treated as commentary.
• The 2020 disclosure was accompanied by a stated growth rate of approximately 50% year-over-year, implying roughly $93m ARR in 2019. Growth therefore decelerated materially — from ~50% in 2020 to ~20% by 2024. This is the single most important unstated fact about the business's financial trajectory, and it materially informs the valuation discussion below.
• On the disclosed $300m revenue base, the $2.65bn headline transaction value implies an EV/revenue multiple of approximately 8.8x. At the 2019 Insight transaction, $780m against an inferred ~$93m ARR implies roughly 8.4x. The multiple was therefore broadly flat across five years while the absolute value tripled — i.e. Mastercard paid for the revenue build, not for multiple expansion.
• Enterprise value grew from $780m (2019) to $2.65bn (2024), a 27.7% compound annual increase over 5.5 years.

Conflict flag: one aggregator (LeadIQ, August 2026) estimates Recorded Future's annual revenue at "$500M–$1B"; another (levels.fyi) bands it at "$100M–$250M." Neither is sourced to the company. Both are inconsistent with the last company-adjacent disclosure of approximately $300m in 2024. Treat aggregator revenue bands as unreliable.

Purchase accounting — the hardest financial data that exists

Mastercard Incorporated, identified intangible assets acquired in 2024 acquisitions (Recorded Future represents $2.7bn of $2.8bn total 2024 acquisition consideration, so this allocation is overwhelmingly Recorded Future). Source: Mastercard FY2025 Form 10-K, Note 2, Acquisitions. Acquisition date fair values, USD millions; weighted-average useful lives in years.

Supporting disclosures:

• Total cash consideration for all businesses acquired by Mastercard in 2024: $2.8 billion; of which Recorded Future (RF Ultimate Parent, Inc.): $2.7 billion (FY2024 Form 10-K, Note 2).
• Goodwill of $1.7 billion is "primarily attributable to the synergies expected to arise after the acquisition date." None of the goodwill is expected to be deductible for local tax purposes (FY2024 Form 10-K) — a real cash-tax negative for Mastercard.
• Purchase accounting was still being finalised as at 30 September 2025 (Q3 2025 Form 10-Q) and was completed in the FY2025 Form 10-K.

Analytical commentary on the purchase price allocation

The allocation is unusually informative given the absence of everything else.

The customer relationship asset dominates. At $781m — 57% of identified intangibles and roughly 29% of total consideration — with a 15-year weighted-average useful life, Mastercard's valuers concluded that Recorded Future's installed base is both large and extraordinarily sticky. A 15-year customer-relationship life is at the upper end of what is typically assigned in enterprise software; it implies a modelled annual attrition rate in the mid-single digits or lower. This is the strongest available third-party evidence that Recorded Future's net revenue retention is healthy, and it corroborates the government and Fortune 100 concentration in the customer base, where switching costs and procurement inertia are high.

The technology asset is comparatively modest. $530m against an 8.9-year life. In a business whose entire narrative is proprietary collection and graph technology, the valuers assigned less to technology than to customers. Two readings are available. The charitable one: much of the platform's value is in continuously refreshed data and human analysis rather than in code that can be capitalised. The less charitable one: the technology moat is judged to be shorter-lived than the customer moat — reasonable in a market where every platform vendor is racing to bundle intelligence.

Goodwill is 63% of consideration. $1.7bn of goodwill against $2.7bn paid means Mastercard booked nearly two-thirds of the price as synergy and going-concern value not attributable to identifiable assets. That is a high ratio and it places the burden of proof squarely on the revenue-synergy thesis — specifically, on Mastercard Threat Intelligence and the ability to sell intelligence into the issuer/acquirer base. It also creates a meaningful future impairment exposure if that thesis underdelivers, though Mastercard's balance sheet scale ($14.6bn of goodwill and intangibles at end-2024, rising to $15.2bn by mid-2025) means any write-down would be embarrassing rather than destabilising.

The tax structure is unhelpful. Non-deductible goodwill means Mastercard receives no cash-tax shield on the largest component of the purchase price — a real economic cost of roughly the goodwill amount multiplied by the applicable tax rate in present-value terms, and a factor that should have depressed the price Mastercard was willing to pay rather than raised it. That Mastercard paid a full multiple anyway indicates strong strategic conviction.

Parent-level financial context

Mastercard Incorporated, selected consolidated metrics. FY2025 from the FY2025 Form 10-K and Q4/FY2025 earnings release; FY2021–FY2024 from the corresponding Forms 10-K. USD millions except EPS, percentages and where noted.

Additional FY2025 parent disclosures: operating margin 57.6% (up from 55.3% in FY2024); net revenue +16% as reported, +15% currency-neutral, including a 1 percentage point contribution from acquisitions; Value-Added Services and Solutions net revenue +23% as reported, +21% currency-neutral (Q4 alone: +26% and +22% respectively); total capital returned to stockholders $17.6bn; $16.7bn remaining under approved repurchase programmes as at 26 January 2026.

The FY2025 VAS growth rate of 21% currency-neutral is the most useful single proxy available for the environment in which Recorded Future is being managed. Mastercard has stated only that acquisitions added 1pp to total net revenue growth in FY2025 — on a $28.2bn FY2024 base, approximately $280m of inorganic revenue, which is directionally consistent with a first full year of a business generating around $300m annually, though the figure covers all acquisitions and includes partial-period effects.

Trends, inflections and drivers

Inflection 1 — the 2019 Insight recapitalisation. The transition from venture backing to PE control coincided with the highest-growth period in the company's disclosed history (~50% ARR growth into 2020) and a step-change in installed base, from "more than 400 organisations" to over 1,900. Insight funded a classic scale-up: headcount from ~430 (2019) to ~1,000 (2023), geographic expansion, and module proliferation.

Inflection 2 — growth deceleration, 2021–2024. The implied deceleration from ~50% to ~20% annual growth is not disclosed but is arithmetically difficult to avoid given the 2020 and 2024 datapoints. Drivers are almost certainly a combination of the law of large numbers, the post-2022 enterprise software spending correction, and — most importantly — competitive bundling. When CrowdStrike, Microsoft and Google began attaching threat intelligence to platform subscriptions, the standalone CTI budget line came under pressure. This deceleration is the most plausible explanation for Insight electing to exit at a flat multiple rather than continuing to hold.

Inflection 3 — the Mastercard acquisition, December 2024. This changes the financial logic of the business entirely. Recorded Future no longer needs to optimise for standalone ARR growth or exit-readiness. It can be run for strategic contribution to Mastercard's Security Solutions franchise, cross-sold into the issuer and acquirer base, and used to enrich fraud scoring in ways that generate revenue booked elsewhere in Mastercard. The disadvantage for external analysts is total loss of visibility; the advantage for the business is patient capital and a distribution channel of extraordinary reach.

Inflection 4 — ATO and the shift to operational tooling, October 2025 onward. If Autonomous Threat Operations succeeds in repositioning Recorded Future from advisory intelligence to operational tooling, the addressable budget line changes and the growth deceleration could arrest. The March 2026 adoption release is the only evidence to date and it is qualitative, not quantitative — no ATO customer count, revenue figure or attach rate has been disclosed.

Management guidance

Recorded Future issues no guidance. No revenue, ARR, margin, customer or product-adoption target has been published since the November 2022 ARR milestone.

Mastercard's FY2026 guidance calls for continued net revenue growth with defined operating expense expectations, against a macroeconomic backdrop management describes as supportive. Michael Miebach's FY2025 framing: "Focused, agile, and diversified, we're well positioned for the opportunities ahead in 2026." Value-Added Services and Solutions — the line containing Recorded Future — grew 23% as reported and 21% currency-neutral in FY2025, with Q4 acceleration to 26% and 22% respectively.

Consensus growth expectations

No consensus exists for Recorded Future. No analyst covers it. The only external growth reference points are third-party market forecasts for the category: 12.7% CAGR to 2031 (Mordor, narrow definition) through 17.6% CAGR to 2030 (TBRC, broad definition). Recorded Future's own implied growth of roughly 21% annually over 2020–2024 was above the narrow-market growth rate, implying modest share gain over that period — though the derivation is coarse.

Bull case

1. The Mastercard distribution unlock is real, early, and quantifiable. Mastercard Threat Intelligence shipped within ten months of close, launched at Money20/20 USA and separately for APAC, with a hard early result: takedowns of malicious domains affecting nearly 9,500 e-commerce sites, and in one regional account, domains linked to approximately $120 million in payment fraud. Mastercard reaches issuers, acquirers and merchants in 200+ countries. The addressable buyer set for Recorded Future intelligence has expanded by an order of magnitude at effectively zero customer acquisition cost, and the underlying demand is quantified: 60% of global fraud leaders learn of breaches only after losses begin, rising to 67% in APAC, with 83% of APAC financial institution leaders frustrated by the lack of real-time CTI integration.

2. The channel pivot substitutes leverage for headcount at exactly the right moment. The Wipro alliance (June 2026) makes Recorded Future the strategic threat intelligence platform inside Wipro CyberShield, taken to market globally across cyber risk, third-party risk, brand, geopolitical and autonomous threat hunting — with Wipro also deploying it internally. The Pentera partnership (July 2026) closes the intelligence-to-validation loop. The MCP server makes the Graph callable by any customer-side AI agent. Together these convert a headcount-intensive direct sales motion into leveraged distribution, which is precisely the correct response to a business whose growth had decelerated to roughly 20%.

3. Category leadership has been independently certified at the exact moment the category consolidates. Gartner published its first-ever Magic Quadrant for Cyberthreat Intelligence Technologies in May 2026 and named Recorded Future a Leader — one of five among 18 evaluated. Inaugural Magic Quadrants reliably accelerate buyer concentration around named Leaders and squeeze the long tail. Recorded Future enters that consolidation with the largest independent installed base (1,900+ organisations, 80 countries, 45 governments, 50%+ of the Fortune 100), the deepest collection (200+ billion nodes), a customer relationship asset independently valued at $781m over 15 years, and a parent that can fund a decade of investment out of $11.7bn of annual operating cash flow.

Bear case

1. Growth had already halved before Mastercard bought it, and the cause is structural. ARR of $140m in 2020 growing ~50% year-over-year, versus ~$300m of revenue in 2024, implies deceleration to roughly 21%. Simultaneously, the customer count has been quoted as "over 1,900" continuously from September 2024 through May 2026 with no update. The cause is not cyclical — it is that Microsoft, CrowdStrike and Google can attach threat intelligence to platform subscriptions at effectively zero marginal price. Insight Partners sold at a flat 8.4x-to-8.8x multiple after 5.5 years, which is what a sophisticated seller does when it believes the multiple has peaked.

2. The differentiating bet is one year old, unquantified, and directly contested by a stronger opponent. Autonomous Threat Operations launched October 2025 and reached general availability around February 2026. Every disclosure about it is qualitative — "radically expanded," "exponentially increased," one anonymous biotechnology customer. No ATO customer count, attach rate, revenue contribution or pricing has been published. Meanwhile Gartner positioned CrowdStrike furthest right for Completeness of Vision among all vendors evaluated, and CrowdStrike's articulated strategy — agentic systems reasoning across threat data and exposure risk that hunt proactively and act across the kill chain — is the same thesis, executed by a company that owns the endpoint. Recorded Future is fighting the bundling problem with a product the bundler can also build.

3. $1.7bn of non-deductible goodwill rests on a thesis that a direct competitor is attacking head-on. Sixty-three percent of the purchase price was booked as synergy value with no tax shield. The synergy is cyber-fraud fusion. Gartner specifically credited Group-IB — a Leader in the same quadrant — with proprietary fraud telemetry and a Cyber Fraud Fusion model, plus particular depth in financial services, and with cost predictability including unlimited users, APIs, hunting rules and takedowns. That is a direct assault on both the strategic thesis and the modular pricing model. If Mastercard Threat Intelligence does not scale into a disclosed revenue contribution within two to three years, the goodwill becomes a live impairment question and the strategic narrative unravels.

Catalysts and monitorables, next 12 months (to September 2027)

Analyst verdict

Recorded Future is a high-quality, genuinely differentiated asset that arrived at its natural strategic home at the right price, and it is now approximately two years into a transition whose outcome is not yet determinable from public information.

The quality is not in doubt. Seventeen years of continuous collection produced a 200-billion-node graph that no competitor can rebuild from a standing start. The customer base — 1,900-plus organisations, the governments of 45 countries, more than half of the Fortune 100 — was independently valued by Mastercard's auditors at $781 million over a fifteen-year life, which is about as strong an external endorsement of retention quality as exists outside disclosed net revenue retention. The entire nine-module portfolio was built organically on one substrate, which is rare and explains its coherence. And in May 2026 Gartner, publishing its first-ever Magic Quadrant for the category, named the company a Leader among five of eighteen.

But the numbers that exist tell a more sober story than the narrative does. Growth halved between 2020 and 2024. Insight Partners sold at essentially the same revenue multiple it paid, meaning five and a half years of ownership produced value entirely through revenue build and none through re-rating — the behaviour of a seller who thinks the multiple has topped. The customer count has not been updated in twenty-one months. And the cause of the deceleration is structural rather than cyclical: platform vendors can give intelligence away, and increasingly do.

Mastercard's answer to that problem is the correct one, and it is being executed competently. Distribution through a payment network reaching 200-plus countries, leveraged channel alliances with Wipro and Pentera, agentic distribution via MCP, and a repositioning from advisory intelligence to operational tooling through Autonomous Threat Operations. The integration has been notably disciplined: brand preserved, CEO succession cleanly sequenced, founder retained as intellectual figurehead, first joint product shipped within ten months, no layoffs, no restructuring, no attrition of the public research franchise.

The verdict turns on execution against a specific opponent. Sixty-three percent of the purchase price sits in non-deductible goodwill predicated on cyber-fraud fusion. CrowdStrike sits furthest right on Completeness of Vision with the same agentic thesis and the endpoint franchise to bundle it. Group-IB attacks the fusion thesis directly with its own Cyber Fraud Fusion model and cost-predictable pricing. Recorded Future has better collection, better independence and a better parent channel. It does not have a control plane, and it has not yet published a single number demonstrating that ATO is working.

Net assessment: a strong asset in a defensible but structurally pressured position, competently owned, with a credible transformation underway and no public evidence yet that it is succeeding. For any counterparty evaluating Recorded Future as a supplier, partner or competitor, the operative fact is that the company is now financially unbreakable and strategically contested — a combination that makes it a reliable vendor and a dangerous competitor, but one whose growth trajectory should be assumed to be materially slower than its marketing implies until it publishes a number that says otherwise.

End of dossier. All figures stated with fiscal year and currency. Source conflicts noted at the point of occurrence. No figure has been fabricated.

The template requests a minimum of 25 entries. Recorded Future, as a private subsidiary, issues a low volume of corporate press releases — its PR Newswire feed for the period contains approximately eight distinct English-language announcements, with the remainder being translations of the same releases into other languages. The register below contains 22 distinct, dated, verifiable developments. Padding to 25 would require including translation duplicates or unsourced items; that has not been done. Discrepancy flagged:* Recorded Future's own Gartner press release states the report evaluated 17 vendors; Group-IB's release and Gartner-derived coverage state 18 vendors. Both cite the same report (Nunez, De Sola Caraballo, Anderson, 4 May 2026). The discrepancy is unresolved in public sources; 18 appears in more independent accounts. Notable absences from the newsflow.* No layoffs, restructurings, litigation, regulatory actions, guidance revisions, or contract-loss announcements were identified in the period. For a company of this size in this industry, that is a quiet 18 months — consistent with a stable, well-capitalised subsidiary executing a product roadmap rather than a business under stress. It is also consistent with reduced disclosure obligation: as a private subsidiary, Recorded Future has no duty to announce adverse developments, so the absence of bad news is weaker evidence than it would be for a listed company.