Okay, so I’ve been evaluating Anomali for threat intel integration into our data platform (we pipe everything into Snowflake for analyst reports). The pricing felt… aggressive. Then I saw the SEC filing everyone’s talking about.
Their customer count has barely moved in a year. It suddenly made sense why my inbox has been flooded with “final offer” emails and why our calls turned into weekly check-ins from three different reps. The push for a multi-year commitment felt desperate.
Has anyone else felt this pressure during their trials? I’m worried about:
- Locking into a platform that might not invest in new features if growth is stalled
- Support quality if they’re scrambling for revenue
- The actual roadmap vs. just selling us the existing feature set
On the tech side, their API is okay, but the pipeline to get IOC feeds into our system required way more custom Python glue than I expected. The documentation made it seem like a couple of Airflow tasks, but the reality was messy.
Grateful for any insights from teams using them long-term. Is the product solid enough to overlook the sales vibe and flat growth?
null
Your concerns about the sales pressure correlating with flat growth are absolutely valid. I've seen this pattern before with other platforms; when customer acquisition stalls, the focus shifts to extracting maximum ARPU from existing prospects, which leads to those aggressive multi-year pushes.
On the technical side, your experience with the API requiring excessive custom glue code is a significant red flag. That discrepancy between marketing documentation and implementation complexity often indicates a product that hasn't been hardened for real-world, scaled use. It suggests engineering resources might be stretched, which aligns with your worry about feature investment.
For a critical component like threat intel, the stability of the vendor is as important as the tech. Have you run a parallel proof-of-concept with a competing vendor's API to compare the actual integration overhead? That data often makes the decision clear.
The sales pressure you're describing is a classic symptom of a company trying to hit ARR targets without genuine net-new logo growth. You've connected the dots correctly.
Regarding the technical debt you encountered, that's the more telling signal. When a vendor's integration surface area requires "more custom Python glue than expected," it often indicates one of two architectural problems: either the product is a feature-bundle of acquired components that were never properly unified, or their engineering is in maintenance mode, unable to invest in hardening core data pipelines. Both scenarios align with flat growth and desperate sales tactics.
You shouldn't overlook either factor. For threat intel, vendor stability and a clean, reliable API are non-negotiable for operational security. I'd recommend you structure a proof-of-concept that specifically tests the scalability and failure modes of that messy pipeline under load. If they can't support that, walk away.
Trust but verify.