Tool profile
CybelAngel: cost, fit and limits
CybelAngel is an external threat intelligence platform made by the French company CybelAngel that combines attack surface management, leaked credential detection, dark web monitoring and brand protection with analyst support. The company is headquartered in France.
What to know first
CybelAngel sells packages named Essential, Core and Elite, and the vendor says pricing is built around the organization and quoted. Each package covers six areas, so the tiers differ by analysis depth and expert help instead of by feature. The company announced ISO 27001:2022 certification in early 2026 and holds SOC 2 Type I. Its AI claim is one proprietary model working with an analyst team.
CybelAngel at a glance
| Maker | CybelAngel, France |
|---|---|
| Free plan | No |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI Attack Surface Management Software in 2026, rank 8 of 10 |
| Website | cybelangel.com |
Who CybelAngel is best for
Brand and fraud teams
Lookalike domain detection and domain takedowns come in every package, which suits brands that suffer phishing sites and need removals handled.
Security teams without analysts
Core and Elite add on-demand testing, a customer success manager and managed service, so a small team can buy expert time with the data.
French and EU-based buyers
The vendor's privacy address is in Clichy, France, and it announced ISO 27001 certification through A-LIGN, which helps procurement reviews in Europe.
CybelAngel plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Essential | Quote | Self-service onboarding, continuous detection and reports on attack surface, credentials and brand, threat intelligence as a feed, one API key and a yearly business review. |
| Core | Quote | Essential plus enriched analysis, on-demand active testing, first vendor visibility, quarterly reviews, multiple API access and an on-demand customer success manager. |
| Elite | Quote | Core plus predictive threat intelligence, active testing including exfiltrated credentials, full vendor and dark web coverage, a dedicated analyst and monthly reviews. |
Checked November 2026.
What CybelAngel does
- Continuous external detection
- Every package includes daily scanning of the external surface and an automatic inventory of exposed assets, shadow IT and vulnerabilities. Daily scanning means a new exposure can surface within a day of appearing.
- Leaked credential and lookalike detection
- Packages include leaked credential and lookalike domain detection, with takedowns of domains and fileservers, covering brand abuse as well as technical exposure. Packages therefore cover brand abuse as well as technical exposure in one subscription.
- Analyst-led investigations
- Investigations, phishing and data breach analysis, threat actor profiling and crisis monitoring are add-ons paid with credits on any package. Because these services use credits, heavy investigation months cost more than quiet ones.
- Threat Note and reviews
- Each package ships a Threat Note and an Executive Business Review, with cadence rising from yearly on Essential to monthly on Elite. Higher tiers also add a dedicated analyst who reviews findings with the customer.
- Proprietary AI model
- The vendor says its AI model processes billions of data points daily and works with an analyst team, though the pages do not describe specific AI features.
How CybelAngel handles your data
The company announced ISO/IEC 27001:2022 certification by A-LIGN in February 2026, with a first surveillance audit planned for November 2026, and says it holds SOC 2 Type I. Its privacy policy gives an address in Clichy, France, says data is stored where possible in the user's region, lists Google as a hosting provider and states that platform data falls under a separate Data Processing Policy that we did not read. Specific retention periods are not given, and the policy does not say whether personal data trains AI models.
Where CybelAngel falls short in practice
- Quote-only pricing. The pricing page gives no figures, asset counts or user caps, and says packages are built around the organization. Expect a sales call before you learn the cost of a package.
- Add-ons draw on credits. Investigations and complex takedowns are credit-based add-ons on any package, so total spend depends on usage that the page does not quantify. The page lists no credit price or credit allowance per package, so a heavy year of investigations is hard to estimate.
- SOC 2 is Type I. The ISO 27001 announcement describes SOC 2 Type I only, which tests design at a point in time, so buyers who want Type II should ask the vendor.
Works with
Alternatives to CybelAngel
CybelAngel: common questions
How are CybelAngel's tiers different?
The tiers do not change what you can see. Essential is self-service with a feed, Core adds on-demand testing, enriched analysis and quarterly reviews, and Elite adds predictive intelligence, a dedicated analyst and monthly reviews. Package choice affects expert support more than data access.
Is CybelAngel ISO 27001 certified?
Yes. The vendor announced ISO/IEC 27001:2022 certification by A-LIGN on February 19, 2026. The article does not define the scope boundaries, and customers can request the certificate for details. The first surveillance audit is planned for November 2026, and the vendor says the certificate can be requested.
Does CybelAngel have a SOC 2 report?
The certification article says CybelAngel already holds SOC 2 Type I compliance. It does not mention a Type II report, so ask for current attestations and the date coverage if you need one. A Type I report covers control design at one date, whereas Type II covers operating effectiveness over a period.
Does CybelAngel handle takedowns?
Yes. Domain and fileserver takedowns are listed in every package. Investigations and complex takedowns are additional services paid with credits, and the page does not state credit prices. Ask what each takedown costs and how fast it happens before relying on the service for urgent phishing.
What data does CybelAngel monitor?
The product page lists attack surface management, data breach prevention, dark web monitoring, credential intelligence, brand protection and cyber threat intelligence. The pricing page groups them into six question areas covered by every package. Analyst reports and a Threat Note come with every package.