Buy or build threat intelligence depending on which decisions it must improve. Most teams get strong value from free public sources and sharing communities, add a paid feed only for a specific gap, and hire an analyst only when they can name the questions that person would answer.
What counts as threat intelligence?
NIST SP 800-150 defines cyber threat information as any information that can help an organization identify, assess, monitor and respond to cyber threats. It lists indicators of compromise, tactics, techniques and procedures, suggested actions, and findings from incident analysis. That breadth is the first trap: a list of bad addresses is intelligence, and so is a report about how a group operates, but they serve different decisions.
Start with decisions, not feeds
Write the decisions you make that intelligence could change.
Patching order: which flaws to fix first. Detection tuning: which behaviors to alert on. Blocking: which domains or addresses to block now. Awareness: what to tell staff or leadership this month. Vendor risk: whether a supplier is under active attack.
If a source does not change one of those, it is a subscription, not a capability.
What does free get you?
A lot. CISA's Known Exploited Vulnerabilities catalog lists flaws seen exploited in the wild and CISA tells organizations to use it as an input to prioritization. FIRST's EPSS estimates the probability that a published CVE will be exploited in the next 30 days. Vendor advisories and sector sharing groups add context. NIST SP 800-150 describes how to engage with sharing communities and set rules for what you share.
A constructed example: a small SaaS firm subscribes to KEV updates, filters them against its software inventory and opens a ticket only for matches. It cost an engineer a day to set up and removed a daily scan of news.
What does paid get you?
Paid feeds can add scale, speed, curation and coverage of areas free sources do not follow, such as criminal forums or brand abuse. They can also add noise. Ask what is the source, how is it vetted, how fast does it arrive, and can it be filtered to your industry and stack. Ask for a trial against your own incidents from last year: would it have helped?
What does building mean?
Building means analysts who collect, assess and produce intelligence for your organization. It is costly in people and attention, and valuable only when you have a steady stream of questions from detection, incident response and leadership. A common middle path is one person who owns intake, filtering and internal reporting, using mostly external sources.
What can go wrong?
Indicator hoarding. Lists of addresses age fast and generate false alerts.
No owner. Feeds arrive and nobody reads them.
No feedback. Analysts do not learn which items helped, so quality never improves.
Sharing without rules. NIST advises setting rules about publication and distribution before you share.
How do you decide?
Make a table with the five decisions above. For each, write the current source, its gap, and the cost of a wrong or late decision. Buy only where a gap is expensive and a source plausibly closes it. Build only when the number of recurring questions justifies a person.
Where Safeguard fits
Safeguard covers the software side: zero day discovery in agentic and scanner modes and reachability analysis, which tells you whether a newly public flaw is reachable in your code. It is not a general threat intelligence feed.
How do you measure whether intelligence is working?
Count decisions, not items. Each quarter, list the cases where a piece of intelligence changed an action: a patch moved up, a detection added, a domain blocked, a briefing written. Divide your spend of money and hours by that count. If the number is near zero for a source, stop paying attention to it. Also track timeliness: how long between the first public report and the moment your team acted. If the gap is days and you can close it to hours with a cheap filter, you have found a better use of effort than any new feed.
What to do
- List the decisions intelligence should improve.
- Wire up free sources first and filter them against your inventory.
- Name one owner for intake and reporting.
- Trial any paid feed against last year's incidents.
- Write sharing rules before joining a community.
- Review which items changed a decision each quarter.
Quick check
Is a list of malicious addresses threat intelligence?
Yes, as one kind. NIST includes indicators of compromise in its definition, but they age quickly and serve blocking and detection more than strategy.
When should I hire a threat intelligence analyst?
When you can list recurring questions from detection, response and leadership that free sources and your current team cannot answer.
Sources
- NIST SP 800-150, Guide to Cyber Threat Information Sharing
- CISA Known Exploited Vulnerabilities Catalog
- FIRST, Exploit Prediction Scoring System
Last reviewed: 18 October 2026.
