Threat Intelligence: Feeds, Platform Or Managed Service.

Threat intelligence is knowledge about who attacks, how and why, in a form that helps a decision. Companies usually buy it in one of three shapes. A feed is a stream of indicators such as bad IP addresses and file hashes. A threat intelligence platform (TIP) collects feeds, de-duplicates and scores them, and pushes them to your tools. A managed service adds analysts who research for you and write reports.

Start with Threat Intelligence 101 and Threat Intelligence Platforms 101 if the terms are new.

Match the product to the decision. Strategic intelligence helps leaders decide where to invest. Operational intelligence helps teams know about coming campaigns. Tactical intelligence describes attacker methods. Technical intelligence is the indicators your tools block on.

• Board and budget questions need strategic reporting.
• A SOC that triages alerts needs enrichment of indicators.
• A fraud or brand team needs findings about impersonation and leaks.
• An IT team needs to know which exposed assets and vulnerabilities attackers use.

Write down your three most frequent questions. A source that cannot answer them is the wrong source, however large it is.

Many mature teams mix: a few feeds, a platform to hold them, and a service or product for areas they cannot cover themselves, such as criminal forums or the dark web. Small teams usually start with a managed or product-led approach and add feeds later.

The cost of a feed is only the start. Add the analyst time needed to process it.

• Relevance to your sector, region and technology.
• Source transparency: where does each item come from and how old is it?
• Confidence and context on every item, not only a score.
• Integrations through API, STIX and TAXII, and your existing tools. See STIX and TAXII in the glossary.
• Noise: how many items would your team have to dismiss?
• Ability to export your data if you leave.

Use the evaluation checklist to score each candidate on the same sheet.

• Buying data before defining decisions. If no decision depends on the intelligence, it will not be used.
• Counting indicators instead of insight. Large volumes of indicators can hide the few items that matter to you.
• Forgetting processing cost. Feeds need analysts or a platform to filter, score and route them.
• Choosing a platform without an owner. A platform needs someone who feeds it, tunes it and reports on it.
• Ignoring sector and region. Intelligence that is not relevant to your business adds noise.

A useful habit is to track, for each source, how many items led to an action. Sources that never lead to action are candidates to cut at renewal.

Pick a few measures before the purchase and review them every quarter. Good examples are the number of intelligence items that led to a block, a patch or an investigation, the time from a report about your sector to a check of your own exposure, and the number of analyst hours spent on triage. Compare with your own starting point, not with anyone else’s figures.

Also ask your stakeholders whether the reports answer their questions. A board report that nobody reads is a sign that the intelligence is not matched to the decision. Review the mix of feeds, platform and service once a year, since team size and tools change.

Write down what you would do differently if the intelligence disappeared tomorrow. This simple test shows where the value really is.

Short definitions of the words used above, so that everyone in the buying team reads them the same way.

• Indicator. A trace of an attack, such as an address, a file fingerprint or a domain.
• Feed. A stream of indicators or reports from one source.
• Enrichment. Adding context to an item, such as who uses it and when it was seen.
• Strategic intelligence. Information for leaders about trends and risk.
• Operational intelligence. Information about coming or active campaigns.
• Tactical intelligence. Information about attacker methods.
• False positive. An alert that looks like a threat but is not.

List your technology, sectors, countries and the main brands and domains you own. Write the three questions you most often cannot answer today. Note which tools must receive the data, such as your SIEM or ticketing system.

Brandefense is an AI-driven threat intelligence platform that combines cyber threat intelligence, digital risk protection and external attack surface management, with third-party risk as a module of external attack surface management. It is one option to include in the comparison. Read about cyber threat intelligence, the platform or Request a demo. Analysts can read the SOC and CTI analyst page and security leaders the CISO page.

These public bodies are the references behind the criteria in this guide. Open them and cite the exact page you rely on in your own paper.

• NIST Cybersecurity Framework: the six functions and the outcomes under each.
• ENISA: European threat landscape reports and guidance.
• CISA: advisories and the catalog of known exploited vulnerabilities.
• MITRE ATT&CK: a shared language for attacker methods.