Grace Chi says security teams should start threat intelligence by identifying their biggest pain points, then develop internal talent like SOC analysts before buying tools or feeds. Without clear ROI and the right people in place, external solutions won't actually reduce risk.
But I would say if you have a security environment and you're considering threat intelligence, call me old-fashioned, but I'm like, where are your current pain points right now? Where are you wasting too much time? Where do you need capabilities that a single resource that you have could peel off some hours, or there is talent in your team that is interested, right? Being able to nurture a SOC analyst or, you know, a detection analyst or somebody, malware reverse engineer who likes intelligence to then think about it from that level and then do research and context and look at what the capabilities are is really important versus thinking, well, we first need the tool and then all these crazy commercial feeds, and then we need to join an ISAC all at the same time because you won't have the structures to support it underneath to get your ROI, which is the most important thing, right? The ROI that then reduces your risk.
