A great deal of what gets sold as threat intelligence is a list of IP addresses, domains and file hashes, delivered on a schedule, loaded into a blocklist, and never thought about again. That has some value. It is not intelligence, and treating it as though it were is how organisations end up paying subscription fees for years while their actual defensive decisions stay exactly the same.

The distinction is not academic. It determines whether the money buys you anything.

Why indicators are the weakest thing you can own

David Bianco's pyramid of pain is the clearest framing of this, and it has aged extremely well. It ranks what you might detect by how much it costs the adversary to change it:

  • File hashes — trivial. Recompile, or change a byte. Cost to attacker: effectively zero.
  • IP addresses — easy. Rotate infrastructure, which is cheap and often automated.
  • Domain names — slightly harder, but registration is cheap and fast.
  • Network and host artefacts — now it is annoying; the attacker has to change how their tooling behaves.
  • Tools — genuinely costly; they have to adopt or build something new.
  • Tactics, techniques and procedures — expensive. You are asking them to change how they operate.

Commercial feeds concentrate almost entirely in the bottom three tiers, because those are the things that can be enumerated and shipped automatically. It follows that blocking them imposes near-zero cost on a capable adversary — and that a feed is at best a filter for commodity noise, not a defence against anyone who has chosen you specifically.

If your intelligence programme would be unaffected by the adversary rotating a server, you are buying weather reports, not intelligence.

The three altitudes

"Threat intelligence" collapses three different products that serve three different audiences. Mixing them is why intel reports so often land on a desk and die there.

  • Tactical. Indicators and signatures, consumed by machines. Half-life measured in days. Useful for automated filtering and enrichment; useless as a strategy.
  • Operational. How specific adversaries actually behave — the techniques, tooling patterns, and sequences they favour. Consumed by detection engineers and hunters. Half-life of months to years, because TTPs are expensive to change. This is the tier that changes what your SOC can see, and it is the tier most under-bought.
  • Strategic. Which threats plausibly apply to your sector, geography, and business model, and how that is shifting. Consumed by people who allocate budget. Half-life of years. It answers "where should our next control investment go?"

An organisation buying only tactical feeds has bought the tier with the shortest shelf life and the least leverage, and typically wonders why intelligence feels like overhead.

The relevance test

The question that separates useful intelligence from interesting reading is uncomfortable and short: what would we do differently because of this?

A report on a campaign targeting industrial control systems is fascinating. If you run a SaaS product with no OT footprint, it should change nothing you do, and time spent reading it is time not spent on the threats that do apply. Relevance is not about whether the content is good — it is about whether it intersects your actual attack surface.

This is why mature programmes define priority intelligence requirements up front: a short, explicit list of the questions intelligence exists to answer for this organisation. For example: which techniques are being used against platforms like ours; whether our third-party dependencies are being targeted; whether credentials belonging to our domains are appearing in dumps. Everything that does not serve a stated requirement is, by definition, optional reading.

Writing those requirements down is most of the work, and it is free.

From intelligence to decision

Intelligence that does not terminate in a change is entertainment. The legitimate terminations are few, which is helpful — it gives you a checklist:

  • A new or modified detection. The most common and most valuable outcome. Operational intel describes a behaviour; a detection engineer turns it into something your SOC can see. This is the direct handoff between intelligence and SOC operations, and where the two functions either connect or quietly stop talking.
  • A hunt. If the behaviour would not have been detected, look for whether it already happened. Hunts triggered by specific intelligence find things; hunts triggered by a calendar mostly do not.
  • A control change. Sometimes the honest answer is that no detection helps and the fix is architectural — tightening an authorisation boundary, removing a standing privilege, closing an exposure. Our zero trust architecture work often starts from exactly this kind of finding.
  • A budget or roadmap decision. Strategic intel should occasionally change what you fund next quarter. If it never does, it is not reaching the people it is for.
  • A deliberate no-op. Recording "we assessed this and it does not apply to us, because X" is a legitimate and underrated output. It stops the same report being re-litigated every quarter.

Running it as a loop

The classic intelligence cycle — direction, collection, analysis, dissemination, feedback — is sound, and the stage organisations skip is always the last one. Without feedback, nobody ever learns which sources produced something that mattered, so renewal decisions get made on vendor relationships rather than evidence.

A minimal version that works: for every intelligence item that reached a human, record what it changed (detection, hunt, control, budget, or nothing) and which source it came from. After two quarters you will know precisely which subscriptions are earning their cost. Most teams discover that a small number of sources produce nearly all the decisions, and that some expensive ones have produced none.

It is also worth being honest that your own telemetry is an intelligence source, and frequently your best one — incidents you handled, phishing you received, techniques that worked against you in an assessment. That material is perfectly relevant by construction, because it is about you.

Questions worth asking a vendor

  • "Which altitude is this?" If the answer is "all three," expect tactical volume with a strategic cover page.
  • "What is your coverage of the techniques relevant to our sector?" Rather than the total indicator count, which measures quantity and nothing else.
  • "How much of this is unique to you?" A surprising share of commercial feed content is aggregated from open sources you could collect yourself.
  • "What does the analysis add?" Raw collection is a commodity; assessed, contextualised judgement is not.

Getting this right is less about spending more and more about deciding what you need to know before buying something that tells you. That scoping conversation is the first thing our threat intelligence engagements do, and it frequently concludes that a client needs fewer sources used properly rather than more.

If you want a candid review of whether your current intelligence is changing any decisions, talk to an engineer.

Defensive guidance. Nothing here describes offensive tooling or techniques.