Recorded Future

From Wikipedia, the free encyclopedia
Recorded Future, Inc.
Company typePrivately held
IndustryCybersecurity, threat intelligence
FoundersChristopher Ahlberg,
Staffan Truvé
Number of locations
Washington, D.C.,
Gothenburg, Sweden,
London, United Kingdom,
Tokyo, Japan
Area served
ProductsIntelligence Cloud, Brand Intelligence, SecOps Intelligence, Identity Intelligence, Vulnerability Intelligence, Attack Surface Intelligence, Third-Party Intelligence, Payment Fraud Intelligence
Number of employees
1000 (July 2023)

Recorded Future is a privately held cybersecurity company founded in 2009, with headquarters in Somerville, Massachusetts.


In 2007, co-founders Christopher Ahlberg and Staffan Truvé, both Ph.D.s in computer science from Chalmers University of Technology, filed for Recorded Future's first patent (granted in 2013 as United States patent US8468153B2) – Data Analysis System with Automated Query and Visualization Environment Setup.[1] The patent was used for continuous collection and processing of data and information from sources across the open, deep, and dark web, facilitated by machine learning. Recorded Future was officially incorporated in 2009.[2]

The company received initial funding from Google and In-Q-Tel, which was reported in a July 2010 introduction to Recorded Future published by Wired.[3]

When it decided that its algorithms and visualization software matched needs within the intelligence community,[4] Recorded Future entered the cyber threat intelligence market in January 2012.

In 2014, the company launched Recorded Future Dark Web, integrating open and dark web sourcing as well as dark web forum access and analysis.

In 2016, Recorded Future was named a partner for threat intelligence by Splunk,[5] Palo Alto Networks,[6] and Vencore GEOINT.[7]

In May 2017, Recorded Future introduced Insikt Group,[8] the company's threat intelligence research arm. The word "insikt" is Swedish, a nod to Recorded Future's co-founders, and means "insight." Insikt Group is responsible for delivering analyst-generated assessments, insights, and recommended actions to customers and the public.

In May 2019, New York-based private equity firm Insight Partners acquired Recorded Future for $780 million.[9]

In November 2019, the company opened a second office in Somerville with the goal of building a "campus" in the Davis Square area. Recorded Future currently employs more than 430 people around the world.[10]

In 2020, the company announced the establishment of The Record from Recorded Future News, a cybersecurity focused news outlet.[11]

In April 2023, the company launched Recorded Future AI, built on a trained OpenAI GPT model which combines insight from Insikt Group with over 100 terabytes of text, images, and technical data, the Recorded Future Intelligence Cloud.[12]


The company specializes in the collection, processing, analysis, and dissemination of threat intelligence. Recorded Future uses machine learning and natural language processing methods to continuously collect and organize data from open web, dark web, and technical sources. The resulting information is displayed within a software-as-a-service portal.

Recorded Future's product is called the Recorded Future Intelligence Cloud.

Using what they call a "Temporal Analytics Engine," Recorded Future provides forecasting and analysis tools to help analysts predict future events by scanning sources on the internet, and extracting, measuring, and visualizing the information to show networks and patterns in the past, present, and future.[13] As of 2015, the engine was described as "Web Intelligence Engine."[14] Likewise, the Washington Post, in an article authored by Stewart Baker, the former General Counsel of the National Security Agency (1992–1994), which had described the company as a predictive analytics web intelligence firm deleted the term upon request of RF.[15] The software analyzes sources and forms "invisible links" between documents to find links that tie them together and may possibly indicate the entities and events involved.

Clients initially included the financial sector with quantitative investors, with the company transitioning in 2013 to providing cyber security solutions, to companies such as SITA.[16]


The company was founded in 2009 by Christopher Ahlberg[14] and had 20 employees as of November 2011.[17] Google Ventures and In-Q-Tel invested "under $10 million each" into the Recorded Future shortly after the company was founded. Google published this on May 3, 2010[18] In-Q-Tel is an investment arm of the CIA.[19] As of 2015, it had partnerships with IBM, HP ArcSight, Cimation, Ethnographic Edge, Tiberium Security, and Malformity Labs LLC per its company profile published by Businessweek.[14]


Red Echo Report[edit]

In 2021, Recorded Future's Insikt Group identified the China-linked group RedEcho, which targeted 10 distinct Indian organizations in the power generation and transmission sector and two organizations in the maritime sector.[20]

China Vulnerability Database Report[edit]

In November 2017, Recorded Future published analysis asserting that the Ministry of State Security (China) influences or alters their National Vulnerability Database (CNNVD) to coverup espionage activities.[21] According to the analysis, "vulnerabilities commonly exploited by malware linked to Chinese APT groups" are incompatible with CNNVD publication practices. The company presented further analysis in March 2018, at the Kaspersky Labs Analyst Summit, presenting evidence that the Chinese government retroactively changed the original publication dates.[22][23]

Al-Qaeda report[edit]

In May 2014, Recorded Future released a report called "How Al-Qaeda Uses Encryption Post-Snowden (Part 1)."[24] Part 2 of the report was released on August 1, 2014, supposedly with a strengthened "earlier hypothesis about Snowden leaks influencing Al-Qaeda’s crypto product innovation." On the same day National Public Radio aired Recorded Future claims of "tangible evidence" that Edward Snowden harmed national security by prompting terrorists to develop more sophisticated encryption programs.[25] Glenn Greenwald and Andrew Fishman criticized Recorded Future's report did not prove causation between Snowden's leak and improved encryption by al-Qaeda.[26]

Occupy Wall Street Media Monitoring Report[edit]

In 2011, Recorded Future reported "gaining online momentum for the Occupy Wall Street movement. When we look more carefully at influencers in this discussion using our Influencer Map, we find that Iran Press TV is the second largest influencer after the U.S. media!"[27]

China Lockdown Protests Report[edit]

In December 2022, Recorded Future released a report detailing a network of bot account on social media that disseminated spam and irrelevant comments under legitimate posts about the 2022 protests in China, including posts with hashtags that contained the names of Chinese cities. The report suggests that the Chinese government is the most likely source of the spam attack. The bots used pornography or randomized word strings to divert discussions of protests, targeting Mandarin speakers on a variety of social media platforms.[28]


In April 2015, a coding website accused Recorded Future of violating internet privacy by analyzing private Facebook messages, which it denied. The accusation was disproven when the assumed private link for private Facebook chat was found posted publicly online via a server log.[16]

See also[edit]


  1. ^ "Information service for facts extracted from differing sources on a wide area network".
  2. ^ "Recorded Future acquired by private equity firm for $780 million". SearchSecurity. Retrieved 2022-06-24.
  3. ^ Shachtman, Noah (July 28, 2010). "Exclusive: Google, CIA Invest in 'Future' of Web Monitoring". WIRED.
  4. ^ Temple-Raston, Dina (October 8, 2012). "Predicting The Future: Fantasy Or A Good Algorithm?". NPR.
  5. ^ Kodama, Matt (February 22, 2016). "Announcing Recorded Future for Splunk". Recorded Future. Retrieved January 2, 2020. Enrichment dashboards show intel on-demand inside Splunk, while monitoring and correlation dashboards apply our threat intel to your events and infrastructure.
  6. ^ Wong, Glenn (April 4, 2016). "Announcing Recorded Future for Palo Alto Networks". Recorded Future. Retrieved January 2, 2020. We're very excited to join the Palo Alto Networks NextWave Technology Partners Program.
  7. ^ McKeon, Amanda (May 17, 2016). "Announcing Recorded Future and Vencore GEOINT Partnership". Recorded Future. Retrieved January 2, 2020. We're very excited to announce a partnership with Vencore to combine our unique open source intelligence (OSINT) datasets with its geospatial system integration and analytic capabilities.
  8. ^ Future, Recorded. "Recorded Future Launches Threat Research Arm to Enhance Threat Intelligence Offering". (Press release). Retrieved 2021-03-11.
  9. ^ Miller, Ron (May 30, 2019). "Insight Partners acquires threat intel company Recorded Future for $780M". TechCrunch.
  10. ^ Maffei, Lucia (October 28, 2019). "Threat intel firm to open new office, add 130 jobs in the Boston area". Boston Business Journal.
  11. ^ "Launching the Cyber Intelligence News Site The Record". Retrieved 2022-06-24.
  12. ^ eliasgroll (2023-04-11). "Recorded Future offers peek at the AI future of threat intelligence". CyberScoop. Retrieved 2023-07-14.
  13. ^ Holliday, Maynard; Holden, Chris (July 15, 2014). "Advanced Web-Based Temporal Analytics for Arms Control Verification and Compliance". Science & Diplomacy. 3 (3).
  14. ^ a b c "Recorded Future, Inc". BusinessWeek. Archived from the original on March 14, 2011. Retrieved July 29, 2010.
  15. ^ Stewart Baker (August 3, 2014). "As evidence mounts, it's getting harder to defend Edward Snowden". Washington Post. Retrieved 31 May 2015. "While this may seem like splitting hairs, in the world of data analysis software "predictive analytics" has specific technical meaning which implies something different. We use the term web intelligence to reduce this confusion."
  16. ^ a b Cale Guthrie Weissman (May 26, 2015). "Inside the company that can predict the future by analyzing every piece of information on the web". Business Insider. Retrieved May 31, 2015.
  17. ^ Cheshire, Tom (November 10, 2011). "The News Forecast". Wired UK. Retrieved December 25, 2011.
  18. ^ Mastrull, Amanda (May 4, 2010). "Google invests in company, Recorded Future, that tries to predict the future". The New York Daily News. Retrieved July 29, 2010.
  19. ^ Shachtman, Noah (July 28, 2010). "Exclusive: Google, CIA Invest in 'Future' of Web Monitoring". Wired. Retrieved July 29, 2010.
  20. ^ "China Appears to Warn India: Push Too Hard and the Lights Could Go Out". NY Times. March 1, 2021.
  21. ^ Recorded Future (November 20, 2017). "China's Ministry of State Security Likely Influences National Network Vulnerability Publications". Recorded Future. Retrieved November 17, 2017.
  22. ^ ALFRED NG (March 9, 2018). "China isn't being honest with its vulnerabilities database". CNET. Retrieved March 8, 2018.
  23. ^ Insikt (March 9, 2018). "China Altered Public Vulnerability Data to Conceal MSS Influence". Recorded Future. Retrieved March 8, 2018.
  24. ^ C (May 8, 2014). "How Al-Qaeda Uses Encryption Post-Snowden (Part 1)". Recorded Future. Retrieved August 14, 2014. The timeline above tells a compelling story showing how four to five months after the Snowden disclosures both mainstream AQ, as well as the break-off group ISIS, launches three new encryption tools.
  25. ^ Dina Temple-Raston (August 14, 2014). "Big Data Firm Says It Can Link Snowden Data To Changed Terrorist Behavior". Morning Edition. National Public Radio. Retrieved August 14, 2014.
  26. ^ Glenn Greenwald; Andrew Fishman (August 12, 2014). "NPR Is Laundering CIA Talking Points to Make You Scared of NSA Reporting". The Intercept. First Look Productions, Inc. Retrieved August 14, 2014.
  27. ^ Holden (October 1, 2014). "Iran's Growing Influence & Occupy Wall Street Protests". Recorded Future. Retrieved August 14, 2014.
  28. ^ Milmo, Dan (5 December 2022). "China accused of flooding social media with spam to crowd out protest news". The Guardian. Retrieved 5 December 2022.

External links[edit]