Threat intelligence vendor: 14 questions to ask before you sign

Before you sign with a threat intelligence vendor, ask where the intel comes from, how fresh and how accurate it is, how it reaches your tools, and what you can do with it under the contract. Insist on a pilot against your own data. Marketing claims about volume are not evidence of value.

Why a question list?

Intelligence is hard to judge from a demo. NIST's guide to cyber threat information sharing describes the information broadly, from indicators of compromise to attacker tactics and techniques, recommended actions and incident findings. A vendor may sell any of these. You need to know which, and whether you can use it.

Sources and quality

1. Where does the data come from? Collection from the vendor's own sensors, incident response work, human analysts, open sources or other feeds. Ask for the mix, in general terms.
2. How is it verified? Ask what turns a raw observation into a published item, and whether confidence is stated.
3. How is stale data handled? Ask how indicators expire and how you see age.
4. What is the false positive rate in practice? Do not accept a number without a method. Ask to measure it in a pilot.

Relevance to you

5. What is covered for my sector and region? Ask for examples of past items relevant to companies like yours, and ask for them in writing.
6. Does it map to techniques? MITRE ATT&CK is a widely used knowledge base of adversary tactics and techniques. Ask whether reports map to it so you can compare against your detections.
7. Does it cover software and supply chain threats? Network and malware intel often miss malicious packages and build pipeline abuse. If you ship software, ask what the vendor has and how it is sourced.
8. Does it use exploitation evidence for vulnerabilities? Public signals such as the CISA Known Exploited Vulnerabilities catalog are free. Ask what the vendor adds beyond them.

Delivery and use

9. How does it arrive? API, standard formats, a platform, email. Ask for the integration list for your SIEM and ticketing tools, and ask who builds the connector.
10. What does an analyst get with each item? Context, recommended action, references, or only a bare indicator?
11. Who can I talk to? Ask about analyst access, response times for questions and how requests for information work.

Contract and exit

12. What can I share? Check redistribution terms, since you may want to pass items to customers, partners or a sharing community.
13. What happens to my data? If you send telemetry or ask questions, ask what is stored, who sees it and for how long.
14. How do I leave? Ask about data retention after termination, notice periods, renewal terms and whether indicators you already ingested remain usable.

A constructed scenario

A mid-size software firm runs a four-week pilot with two vendors. For each, an analyst tags every item with the action taken, as described in our post on metrics that matter. Vendor one sends more items. Vendor two leads to more actions and maps to ATT&CK. The scenario is invented. The point is the method, which beats a feature table.

What to do

1. Write what decisions you want intel to inform.
2. Send the fourteen questions to each vendor in writing.
3. Run a pilot on your own environment with a shared scoring sheet.
4. Check the contract for sharing, data and exit terms with legal.
5. Start with a short term if the vendor allows it.
6. Re-evaluate at renewal against the actions logged.

Quick check

Sources

• NIST SP 800-150, Guide to Cyber Threat Information Sharing
• MITRE ATT&CK
• CISA Known Exploited Vulnerabilities Catalog

Last reviewed: 18 October 2026.