Security Operations & Threat Intelligence Patents: Leaders & Trends 2026
- 42.3% concentration. The five leading assignees account for 4,517 of the 10,680 records in scope, but the remaining majority is split across a long tail of filers.
- Filing has cooled from its 2020 peak. Activity peaked at 1,583 records in 2020 and moved from 870 in 2021 to 687 in 2024, a 21% pull-back over that span.
- Claims cluster on transmission and processing, not on AI. H04L (digital transmission) and G06F (data processing) cover 51.6% and 35.7% of records respectively, while G06N (AI-based computing) sits at just 4.8%.
Filing growth compares 2021 (870 records) with 2024 (687) — a three-year span. 2024 is the most recent year we treat as complete: publication lags filing by roughly 18 months, so 2025 onwards are still filling in and any growth rate that ends there would understate the field. Top-5 share is the combined record count of the five largest assignees divided by all 10,680 records in scope (CR5), not by the ranked leaders only.
What this landscape covers
This dataset tracks patent families at the intersection of security operations and threat intelligence — detection, event analysis and response workflows — with the credential and cryptographic mechanics that gate access to protected systems: authentication tokens, encryption keys, identity authentication and key management. That pairing matters because a threat-intelligence claim rarely stands alone; it is almost always anchored to a specific mechanism for verifying or protecting an actor, a session or a data object.
Coverage runs from 2015 through the 2026 data cut-off, with 10,680 published records in scope. Publication lags filing by roughly 18 months, so the most recent one to two years in any trend understate real filing activity; 2024 is the most recent year that can be read as complete.
Filing trend and technology composition
Two views of the same 10,680 records: how filing volume has moved year over year, and which IPC subclasses carry the claims.
Filing trend, 2017-2026
Volume rose from 447 records in 2017 to a peak of 1,583 in 2020, then eased to 870 in 2021 and 687 in 2024 — a 21% decline over that three-year window. 2025 and 2026 figures (down to 112 in 2026) reflect publication lag rather than a real drop in filing.
Technology composition by IPC subclass
H04L (digital information transmission) appears on 51.6% of records and G06F (electric digital data processing) on 35.7%, confirming that most claims are framed as network or data-processing mechanisms. H04W (wireless networks, 28.0%) and G07F (coin-freed/vending apparatus, 7.4%) follow; AI-flagged G06N claims sit at only 4.8%, and shares overlap because records can carry multiple classes.
Shares are the percentage of the 10,680 records in scope. A patent can carry several IPC classes, so the shares add up to more than 100%.
Go deeper on Security Operations & Threat Intelligence Patent Landscape with Eureka
This page is one run against one query. Ask Eureka your own question about security operations & threat intelligence patent landscape and every answer comes back with the patent numbers behind it.
Try EurekaA representative claim and the most-cited prior art
US9118702B2 — System and method for generating and refining cyber threat intelligence data
Filed by BCE Inc. and published 2015-08-25, the patent describes a method of refining cyber threat intelligence by sending successive versions of a threat list to multiple intelligence sources, collecting each source's response, and using the combined responses to produce a revised, more accurate threat list.Abstract text shortened for readability; see the full record for complete claim language.
| # | Publication no. | Patent title | Citations |
|---|---|---|---|
| 1 | US5671279A | Electronic commerce using a secure courier system | 1,278 |
| 2 | US20090143141A1 | Intelligent Multiplayer Gaming System With Multi-Touch Display | 1,150 |
| 3 | US20180027006A1 | System and method for securing an enterprise computing environment | 1,146 |
| 4 | US20050187873A1 | Wireless wallet | 1,063 |
| 5 | US20020138582A1 | Methods and apparatus providing electronic messages that are linked and aggregated | 1,012 |
| 6 | US5276735A | Data enclave and trusted path system | 984 |
| 7 | US20190174449A1 | Technologies to authorize user equipment use of local area data network features and control the size of loca… | 891 |
| 8 | US20190149365A1 | Time domain resource allocation for mobile communication | 878 |
| 9 | US20070180490A1 | System and method for policy management | 866 |
| 10 | US20150033305A1 | Methods and systems for secure and reliable identity-based computing | 862 |
Citation counts reflect a searched corpus and favour older filings; treat them as a signal of influence on later filers, not of current commercial relevance.
Each row carries its publication number; clicking a row searches Eureka by that number.
Put your own technology through the same analysis
Eureka on the web
When you want the answer in the next five minutes.
The agent works the prompt against patents and technical literature, citing every source.
Run your analysis now →MCP server & REST API
When it has to run inside your own pipeline.
Patent search, landscape analysis and assignee resolution as MCP tools. Drop them into any agent framework, or call REST directly.
Browse MCP servers →What the filing data signals
Three patterns stand out once volume, timing and classification are read together.
A moderately concentrated leader group, not a monopoly
The top five assignees hold 4,517 of the 10,680 records in scope (42.3%), and the top ten add up to 48.6%. That leaves more than half the field to filers outside the ranked leaders, which is unusually open for a security-adjacent domain this mature.
Volume peaked in 2020 and has since normalised
Filing rose steadily to a 2020 peak of 1,583 records, then declined to 870 by 2021 and 687 by 2024 (-21%). Because publication lags filing by about 18 months, the 2025-2026 figures should not be read as a continuation of decline.
Claims are framed as transmission and processing, not as AI methods
Over half of records sit in H04L (digital information transmission) and over a third in G06F (data processing), while G06N (AI-based computing) covers only 4.8%. Threat-intelligence claims here are built around the mechanics of moving and processing security data, with AI framing still a minority approach.
Eureka can read the same corpus for gaps instead of for coverage: under-claimed branches adjacent to security operations & threat intelligence patent landscape, with the prior art for and against each one.
| Assignee | Co-assignee | Shared families |
|---|---|---|
| International Game Technology Inc | NGUYEN BINH T | 19 |
| Intel Corp | Intel IP Corp | 15 |
| International Game Technology Inc | WOLF BRYAN D | 12 |
| International Game Technology Inc | NGUYEN BINH | 12 |
| International Game Technology Inc | SCHNEIDER RICHARD J | 10 |
| Apple Inc | CHENG PENG | 9 |
| International Game Technology Inc | WOLF BRYAN | 9 |
| International Game Technology Inc | UNDERDAHL BRIAN | 9 |
Only 10 co-assignee pairs appear in this dataset, and the strongest links sit inside single corporate families (e.g. shared filings between related IGT and Intel entities) rather than across competitors — genuine cross-company co-filing is rare in this space.
Assignee landscape and recent momentum
The assignee ranking covers 100 companies drawn from the full set of 10,680 records. Recent-year figures should be read with the publication-lag caveat in mind: a steep year-over-year drop for the latest year often reflects filings still working through the pipeline rather than a real pullback.
One filer holds a clear lead
The top-ranked assignee accounts for 2,217 records on its own, well ahead of the fifth-place filer at 183 and tenth place at 115 — a steep drop-off after the leader that flattens quickly into the long tail.
Latest-year counts are down across tracked filers
Every tracked assignee shows a year-over-year decline in the latest year, from roughly -50% to -100%. Given the 18-month publication lag, this pattern is consistent with pipeline lag rather than a genuine stop in filing activity.
Filing is largely solo, with a few intra-family exceptions
Only 10 co-assignee pairs exist in the dataset, and the strongest of them link entities inside the same corporate group rather than independent competitors, suggesting most filers here protect their own claim space rather than pursuing joint filings.
| Assignee | Recent year | YoY |
|---|---|---|
| NVIDIA Corp | 10 | -66% |
| Apple Inc | 1 | -98% |
| Intel Corp | 1 | -83% |
| RELIAQUEST HOLDINGS LLC | 1 | -96% |
| Telefonaktiebolaget LM Ericsson (publ) | 1 | -50% |
| International Game Technology Inc | 0 | -100% |
| Intel IP Corp | 0 | — |
| International Business Machines Corporation | 0 | -100% |
Where to take this
The dataset points to specific next moves depending on whether you are scoping freedom-to-operate or looking for open claim space.
Check the leader's claim scope before filing near H04L or G06F
With over half of records sitting in H04L and over a third in G06F, a new filing in core transmission or data-processing mechanics is likely to run into dense prior art from the leading assignees.
Explore assignee claim maps in EurekaTest the under-claimed branches for a first-claim position
G06N, H04N and G07F overlaps carry noticeably thinner coverage than the core classes, which is where a narrowly drafted first claim has more room to stand.
Run a white-space search in EurekaRead citation leaders as influence, not current risk
The most-cited records in this set date back years; treat their citation counts as a map of which mechanisms shaped later filings, then verify current enforceability separately.
Pull citation trees in EurekaQuestions practitioners ask about this space
One assignee leads clearly with 2,217 of the 10,680 records in scope, well ahead of the fifth-ranked filer at 183 and the tenth at 115. The top five combined account for 42.3% of all records, and the top ten for 48.6%, so the field is moderately concentrated at the top but still has more than half its volume spread across a long tail of other filers. Anyone scoping freedom-to-operate should check the leader's claims first, then work down the ranking rather than assuming a single dominant blocker.
Filing rose to a peak of 1,583 records in 2020, then eased to 870 in 2021 and 687 in 2024, a 21% decline over that three-year span. Numbers for 2025 and 2026 look lower still, but publication typically lags actual filing by about 18 months, so those most recent years are undercounted rather than genuinely quiet. The fair read is a post-2020 normalisation, not a collapsing field.
Most claims are framed around digital transmission and data processing mechanics rather than artificial intelligence: H04L appears on 51.6% of the 10,680 records and G06F on 35.7%, with H04W (wireless networks) on 28.0%. G06N, the AI-based computing class, covers only 4.8% of records. That means the bulk of enforceable claim space here is about how security and authentication data moves and is processed, not about the specific AI model used to analyse it.
Classes like G06N (AI-based computing), H04N (pictorial/video communication) and G07F (coin-freed and vending apparatus) show materially lower record shares than the core H04L and G06F classes, at 4.8%, 3.5% and 7.4% of the 10,680 records respectively. That gap suggests AI-driven correlation methods and security event handling tied to video or vending/access hardware are comparatively under-claimed relative to core network transmission and processing approaches. A narrowly drafted claim in one of those overlaps has more room to stand without colliding with dense prior art.
Not really — only 10 co-assignee pairs appear across the full 10,680-record dataset, and the strongest links sit between entities inside the same corporate family rather than between independent competitors. Most filers in this space protect their own claim space through solo filings rather than joint development. That pattern is worth knowing before assuming a competitor's filing implies an external partnership.
Research Security Operations & Threat Intelligence Patent Landscape in depth with Eureka
Go past this page: query the whole security operations & threat intelligence patent landscape corpus yourself, in your own scope.
Every answer comes back with patent numbers you can open.
Disclaimer. This page is generated from Patsnap Eureka data drawn from a limited snapshot of global patent and scientific-literature records, and is provided for general information and reference only.
Patent data carries inherent limitations: recent filings (typically the most recent 18–24 months) are under-counted due to standard publication lag; counts may be reported at either a patent-family or a patent-record basis and are not always directly comparable; classification, applicant-name, and citation data may contain errors, duplicates, or omissions; and the underlying search query defines and constrains the scope shown. As a result, the analysis may be incomplete or inaccurate and may not reflect the full technology landscape.
Nothing on this page constitutes an exhaustive prior-art, novelty, freedom-to-operate, or validity search, nor does it constitute legal, financial, investment, or professional advice, and it should not be relied upon as such. Any patent, commercial, or strategic decision should be verified independently and reviewed with qualified patent, legal, and domain professionals. Patsnap makes no warranties, express or implied, as to the accuracy, completeness, or fitness for any particular purpose of the information presented.
Machine translation. Assignee and organisation names originally recorded in Chinese, Japanese or Korean have been rendered into English by an AI translation step so that the tables stay readable. These renderings are best-effort and may not match a company’s registered English name; the original name is what the underlying patent record carries, and it is what any Eureka query launched from this page uses.