What Kind of Threat Intelligence Should You Focus on?
27 Mar 2025 · 1 min
0:49
In this segment, the speaker critiques the common focus on external threat intelligence—buying feeds, tools, and data—arguing that organizations often neglect the wealth of internal information they already possess. He emphasizes the need to systematically track, analyze, and structure internal data into its own intelligence product, then enrich it with external sources. By developing a clear threat profile and understanding the organization’s risk appetite, internal intel becomes a unique asset that cannot be purchased in standard formats (CSV, STIX/TAXII). This internal insight acts as a force multiplier for any tools, processes, or personnel, enhancing overall security effectiveness.
