Which threat intelligence do you actually need? A decision guide

Choose threat intelligence by the decision it supports. If you need fast blocking, use indicator feeds. If you need better detections, use reports about attacker behavior. If you need to brief leadership, use short assessments of who targets your sector. Buying all three before you can act on one wastes money.

Start with the decision, not the feed

Ask: what will someone do differently on Monday because of this? If there is no answer, it is background reading, not a program.

Match the need to the type

Many teams group intelligence by audience, often labeled tactical, operational and strategic. Those labels are a convention, not a standard, so define them in your own words.

• Block or scope quickly: look for indicators such as addresses, domains and hashes. Example use: search logs for a known address.
• Write better detections: look for descriptions of attacker behavior and tooling. Example use: add a rule for a technique.
• Plan priorities: look for assessments of who targets your sector and how. Example use: decide what to test first.

Use the Pyramid of Pain as a quality test

For indicator feeds, ask which level they sit on. Hashes and addresses are quick to change. David Bianco's pyramid puts behavior at the top, because detecting it forces attackers to change how they work. A feed made only of low level items is fine for scoping, but it will not harden you.

Judge a source before you trust it

• Origin. Who produced it, and how did they see it?
• Age. When was it observed? Does each item expire?
• Confidence. Does the source say how sure it is?
• Format. Can you load it without hand work? STIX is the common structured format.
• Handling rules. Is it labeled with a TLP level, and can you follow it?

Free versus paid

Free sources include government advisories, community rule sets and sector groups. They cover a lot for a small team. Paid sources can add speed, curation or coverage of specific regions or actors. Before paying, run a trial and count how many items you used.

A minimum viable setup

1. One indicator source feeding your log search, with expiry dates.
2. One behavior source, such as ATT&CK mapped reports, feeding your detection backlog.
3. One person who reads both weekly and records what changed.
4. One sharing community, so information flows both ways.

When to grow

Add more when you consistently act on what you have and run out of material. Not before.

Quick check

Sources

• The Pyramid of Pain, David Bianco
• NIST SP 800-150
• FIRST Traffic Light Protocol
• OASIS STIX Version 2.1

Last reviewed: 19 October 2026.