How we make this list: we compare pricing pages, product documentation and public user reviews. Rankite is independent; if a vendor ever pays for a featured spot, that listing is clearly labeled Partner.
Key takeaways
- Maltego is the default starting point: visual link analysis with hundreds of data transforms, plus a free Community Edition for small investigations.
- IBM i2 Analyst's Notebook remains the standard inside law enforcement and large enterprises that need proven, courtroom-friendly analysis workflows.
- Linkurious and Siren suit teams that want link analysis embedded in their own data platform rather than a standalone desktop tool.
- ShadowDragon and Lampyre serve OSINT-heavy investigators who pivot from public data sources into entity graphs.
- Gephi costs nothing and handles network visualization well, which makes it a smart companion tool even if you buy a commercial platform.
Quick comparison
| Tool | Best for | Starting price | Free plan |
|---|
 Maltego | visual OSINT and link analysis | See website | Yes |
 IBM i2 Analyst's Notebook | law enforcement and enterprise investigations | See website | No |
 Linkurious | graph visualization on your own data | See website | Free trial |
 Siren | investigative search across siloed data | See website | Free trial |
 ShadowDragon | OSINT identity resolution at scale | See website | No |
 DataWalk | large-scale entity resolution | See website | No |
 Palantir | intelligence and defense data fusion | See website | No |
 Lampyre | affordable OSINT investigation pivots | See website | Free trial |
 Gephi | free network visualization | Free | Yes |
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
The best link analysis software
Starting priceSee website
Free planYes
Maltego turned link analysis into something a single analyst can do without a data science team. You start with one entity, a name, a domain, an email address, and run transforms that pull related records from public and commercial sources. Each result becomes a node on the graph, and you keep pivoting until the picture of the network emerges.
The Community Edition is genuinely useful for learning and small cases, which is why Maltego shows up in so many investigator toolkits. Paid tiers add more transforms and collaboration. The cost to watch is data: many premium transforms bill per query, so a big investigation can burn credits fast. Set a budget before you hand it to a curious analyst.
What we like- Huge library of data transforms
- Intuitive graph interface
- Free Community Edition to start
Watch out for- Transform costs add up
- Desktop client feels heavy on large graphs
#2
IBM i2 Analyst's Notebook
Best for: law enforcement and enterprise investigations
Visit ibm.com
Starting priceSee website
Free planNo
Analyst's Notebook is the tool behind countless fraud, counterterrorism, and organized-crime investigations. Analysts build association charts and timelines by hand or from imported data, then use the software's analysis functions to find the shortest path between entities, spot common connections, and test hypotheses. Courts and agencies trust its outputs because the methodology is established.
IBM sells it as part of the i2 portfolio, which means enterprise sales cycles and pricing to match. Small teams will find it heavy. But for organizations that need defensible, repeatable investigative analysis with training and support behind it, i2 is still the reference point every other tool gets compared against.
What we like- Decades of investigative track record
- Strong timeline and association charting
- Integrates with i2 iBase
Watch out for- Enterprise pricing and procurement
- Interface shows its age
Starting priceSee website
Free planFree trial
Linkurious takes a different approach from Maltego: instead of pulling public data, it visualizes the data you already have. Connect it to Neo4j or another graph database and investigators get an intuitive interface for exploring connections, running graph algorithms, and building case views they can share. Banks use it for anti-money-laundering work, tracing funds across accounts and entities.
That means you need data infrastructure first. If your organization already stores relationships in a graph database, Linkurious is one of the fastest ways to put that data in front of investigators. If you are starting from a name and a search engine, Maltego or ShadowDragon fit better.
What we like- Connects to graph databases you already run
- Clean visualization for non-technical users
- Strong fraud and AML use cases
Watch out for- Needs a graph database underneath
- Less OSINT data built in
#4
Siren
Best for: investigative search across siloed data
Visit siren.io
Starting priceSee website
Free planFree trial
Siren pitches itself as the investigation platform for organizations drowning in disconnected data. It federates search across databases, documents, and open sources, then renders the results as link graphs analysts can explore. Because it builds on Elasticsearch, teams with Elastic experience can get productive faster.
The strength is also the commitment: Siren is a platform deployment, not a desktop app you install in an afternoon. Expect integration work and enterprise pricing. It fits intelligence units, large fraud teams, and cyber investigation groups that need one search box over everything they are allowed to see.
What we like- Federated search across many sources at once
- Built on Elasticsearch
- Link analysis plus records search
Watch out for- Deployment takes real effort
- Pricing is enterprise
Starting priceSee website
Free planNo
ShadowDragon is built for investigators who work primarily from open sources. Its Horizon platform resolves an identity from a single starting point, a name, handle, or email, then maps related accounts, contacts, and activity across hundreds of sources. Link analysis and timeline views turn those connections into case-ready visuals.
This is professional-grade tooling sold to law enforcement, corporate investigators, and intelligence teams, with pricing and access controls to match. It is not a casual research tool. Teams doing due diligence, threat investigations, or missing-persons work at volume will get the most from it; occasional users should start with Maltego Community Edition or Lampyre.
What we like- Broad coverage of social and web sources
- Fast identity resolution
- Built for professional investigators
Watch out for- US-focused data coverage
- Enterprise pricing with vetting
Starting priceSee website
Free planNo
DataWalk solves the problem that comes before link analysis: figuring out that records in twelve different systems describe the same person. Its entity resolution engine links structured and unstructured data at scale, then analysts explore the resulting network visually. Insurance fraud, public-sector investigations, and large corporate security teams are the typical buyers.
This is not software you evaluate in a week. Deployments are enterprise projects with services attached. But when the investigation spans millions of records and the question is which ones connect, DataWalk's resolution-first approach beats drawing graphs by hand.
What we like- Handles massive mixed datasets
- Strong entity resolution
- Visual link analysis on top
Watch out for- Enterprise-only pricing
- Long implementation cycles
Starting priceSee website
Free planNo
Palantir's Gotham platform is the heavyweight of investigative data fusion, used by intelligence agencies, defense organizations, and large enterprises to combine classified, commercial, and open data into a single investigative picture. Link analysis is one capability inside a much larger system for search, collaboration, and operational planning.
Almost nobody reading a software buying guide can buy Gotham casually. Pricing is enterprise, procurement is slow, and deployments involve Palantir engineers. It belongs on this list because it defines the top end of the category. Commercial fraud and corporate investigation teams should look at DataWalk or Siren for a reachable version of the same idea.
What we like- Unmatched data integration at scale
- Proven in intelligence and defense
- Strong access controls
Watch out for- Pricing is out of reach for most
- Long sales and deployment process
Starting priceSee website
Free planFree trial
Lampyre does the Maltego-style workflow, start from an entity and pivot through data sources into a graph, at a price smaller teams can justify. It adds searchable evidence triage and timeline export, which investigators need when a case moves toward reporting. For boutique investigation firms and corporate security teams watching budgets, it is worth a serious look.
The tradeoff is ecosystem depth. Maltego's Transform Hub has years of third-party integrations that Lampyre cannot match yet. If your cases depend on a specific data source, confirm Lampyre covers it before committing. For standard OSINT pivots across common sources, it does the job well.
What we like- Maltego-style pivots at a lower price
- Searchable evidence triage
- Timeline export
Watch out for- Smaller transform library
- Less brand recognition with clients
Starting priceFree
Free planYes
Gephi is the free, open-source answer to "I have a spreadsheet of connections and I need to see them." Import nodes and edges from a CSV, run a layout algorithm, and you get a publication-quality network visualization. Academics, journalists, and investigators use it to make sense of relationship data they collected elsewhere.
It does not fetch data for you, which is the main difference from the commercial tools here. Pair Gephi with manual research or a data-gathering tool and it handles the visualization layer brilliantly. Even teams that buy Maltego or i2 keep Gephi around for quick exploratory views and presentation graphics.
What we like- Completely free and open source
- Powerful graph layout algorithms
- Large user community
Watch out for- No data collection built in
- Learning curve on imports
Start with your data, not the feature list. If investigations begin from public sources and a name, you need OSINT collection plus visualization: Maltego, ShadowDragon, or Lampyre. If they begin from internal records, you need entity resolution and search across your own systems: DataWalk, Siren, or Linkurious on your graph database. Buying the wrong type means paying for data you cannot use or visualizing data you cannot reach.
Next, check who needs to defend the output. Law enforcement and regulated industries often standardize on IBM i2 because its methods are established and its charts are understood in court. Corporate and private-sector teams have more freedom to pick on usability and price.
Finally, count the humans. A single analyst can run Maltego or Lampyre tomorrow. Platform deployments like Siren, DataWalk, and Palantir need IT involvement, data pipelines, and training budgets. Match the tool's weight to your team's size or it will sit unused.
Deployment and data handling notes
Link analysis tools touch sensitive data by definition, so ask vendors direct questions before buying. Where is case data stored, and who can access it? Maltego's desktop client keeps graphs local, while cloud platforms hold your investigation on their infrastructure. For law enforcement and corporate investigations, local storage or a private deployment is often a requirement, not a preference.
Check data source terms too. OSINT platforms pull from hundreds of sources, and each has its own terms of use and rate limits. Confirm the sources your cases depend on are covered and that the vendor handles API changes when sources break. And if your team works across borders, confirm compliance with data protection rules like GDPR before analysts start pulling personal data into graphs.
Frequently asked questions
What is link analysis software?
Link analysis software visualizes relationships between entities like people, companies, phone numbers, domains, and bank accounts. Analysts use it to spot hidden connections in investigations, fraud cases, and intelligence work. Most tools combine data collection or import with graph visualization and analytical functions like shortest-path and common-neighbor analysis.
Do I need technical skills to use link analysis tools?
It depends on the tool. Maltego, Lampyre, and IBM i2 are built for analysts and require no programming. Platforms like Siren, DataWalk, and Linkurious need IT involvement to connect data sources, though analysts use the resulting interface visually. Gephi needs comfort with CSV imports but no coding.
How much does link analysis software cost?
Free options exist: Gephi is free and Maltego has a free Community Edition. Commercial desktop tools are typically subscription-based per analyst. Enterprise platforms from IBM, Palantir, DataWalk, and Siren are quote-based and can run into six figures annually including services. Data costs, like Maltego transform credits, add to the total.
Can link analysis software find hidden connections automatically?
Partly. Graph algorithms can surface short paths between entities, shared connections, and clusters that are hard to see in raw data. But the software finds candidate connections; the analyst still decides which ones matter. Entity resolution, deciding that two records describe the same person, remains the hardest part and the biggest source of errors.
Is Maltego enough for professional investigations?
For many OSINT-driven cases, yes. Maltego's transforms cover a wide range of public and commercial sources, and its graphs are clear enough for reporting. Teams that also need internal data fusion, large-scale entity resolution, or courtroom-standard charting usually add or switch to i2, DataWalk, or Siren.
How we chose
We mapped the category the way investigators buy: OSINT-driven tools, internal-data platforms, and visualization utilities. We checked each vendor's site to confirm the product is current, read documentation and public reviews, and favored tools with real adoption among investigators rather than slideware. We included free options where they genuinely compete. No vendor paid for placement, and we did not claim hands-on testing.
Sources we checked (12)
- https://www.technology.org/2026/04/29/the-top-10-osint-software-tools-for-research-and-investigation-2026/
- https://hackread.com/10-top-osint-tools-investigator-should-know-2026/
- https://zipdo.co/best/investigation-software/
- https://www.maltego.com
- https://www.ibm.com
- https://linkurious.com
- https://siren.io
- https://shadowdragon.io
- https://datawalk.com
- https://www.palantir.com
- https://www.lampyre.io
- https://gephi.org
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
Shihab Mia · Founder, Rankite
Shihab has spent more than a decade helping SaaS and e-commerce brands grow through search. He writes Rankite's software buying guides from pricing pages, documentation and public user reviews. More about Shihab.