If you believe MasterCard, it's Recorded Future.

Personally, I feel like that's asking who has the best lead balloon. It's not that it's completely impossible to get value there, but it's misguided.

I feel it'd be better to look at the processes that cause vulnerabilities, the vulnerabilities themselves and defenses to immediately detect and resond to problems.

As compared to CTI, which focuses on the payload that was used to exploit them, at best, or at worst: surfing message boards looking for people bragging about hacks or selling information obtained.