Threat Intelligence day rates in the UK
A Threat Intelligence day rate is the headline price of a fixed-term contract, not a salary and not your take-home. For what a relevant attacker is doing, turned into something a SOC or a red team can use, clients in the UK currently advertise mostly between £500 and £900 a day.
Updated 1 November 20264 min read
What a Threat Intelligence day rate includes
The number in the advert is what the client or the agency is offering per day. It is not your pay. Outside IR35, you still have corporation tax, salary, dividends and expenses to decide. Inside IR35, umbrella or PAYE deductions come off before anything reaches you. The same £700 day reads very differently on the two sides.
Agencies sometimes quote a rate to you that is already their margin down from the client rate, and sometimes they quote the client rate and take the margin off afterwards. Ask which one you are being told. The figure we show is the one printed on the advert.
A working band, not a promise
Advertised Threat Intelligence day rates commonly sit between £500 and £900. That is the headline number, before tax, umbrella margin or the costs of a limited company. Geography still moves it. London, Manchester, Cheltenham-adjacent remote roles, Bristol and Edinburgh are where these contracts cluster, and London sits at the top of most bands. The rate on a specific advert is on the board when the recruiter published one. Where they wrote "competitive" instead, the role is harder to compare and usually not in a hurry to tell you.
If a Threat Intelligence advert has no rate, treat that as information. Roles with a published day rate are easier to compare and, on this board, sort to the top of the day. Live Threat Intelligence contracts show the current numbers beside the IR35 status.
Inside IR35 against outside
An inside Threat Intelligence contract needs a higher headline to match the take-home of an outside one. As a rule of thumb the gap is about 20 to 25 percent, and it moves with the exact rate, your salary mix and the tax year. Do not do it in your head. Use the IR35 calculator on the rate you have actually been offered.
Threat Intelligence contracts are genuinely mixed. Product companies and smaller clients more often advertise outside IR35. Large programmes, and anything with a body-shop agency in the chain, more often advertise inside. Treat "outside" as a claim to check, not as a promise, and price an inside offer against take-home rather than against the headline.
How to read an offer
Compare the offer with the band, then with the live rows, then with take-home. A £500 outside rate can beat a number that looks larger on an inside contract. Expenses, the length of the booking and whether you can overlap a notice period all belong in the same conversation.
Threat Intelligence contract jobs covers who is hiring. Threat Intelligence outside IR35 jobs covers the status. Wider benchmarks are on day rates by skill.
Live roles on the board
Nothing in this cut of the market is on the public board right now. New contracts land every hour, and the full Threat Intelligence list is the place to watch.
See live Threat Intelligence rates · Membership unlocks apply links and the first 48 hours