Key Criteria for Evaluating Threat Intelligence Solutionsv1.0

1. Summary

Effective risk-based cyber-defense strategies and infrastructures rely on validated and actionable threat intelligence (TI). Comprehensive solutions collect or procure threat intelligence data from disparate sources, then subject it to a variety of procedures to render it intelligible, accessible, and able to develop and prioritize security strategies based on previously unknown threats. The objective is to accelerate workflows for analysts and stakeholders making decisions about risk management across all domains in an enterprise.

There are two main groups of threat intelligence solutions, but they share the same objective: to help organizations protect their environments, endpoints, and assets from cyber threats.

• Threat intelligence platforms (TIPs) work by correlating events, logs, and telemetry data against the database of threat data intelligence.
• Threat intelligence providers take a more focused approach by scoping the collection and correlation of intelligence through queries or client-specific programs.

Whether to implement a TIP or a provider depends on the organization’s specific requirements and use case. Security operations and vulnerability management will see a boost from the broader collection and correlation of a TIP, and threat hunters will see immediate value from the preciseness of Tl providers. In some scenarios, an enterprise would need to use both to achieve its security objectives. Several of the TIPs in the corresponding Radar report have partnerships with TI providers and source some of their threat intelligence from those databases through their APIs.

An intelligence-based approach to security operations has steadily grown as the threat landscape, and the amount of data required to implement an intelligence-led cybersecurity framework, increased exponentially year over year. Modern threat intelligence is a big data problem. Moreover, there has been a shift away from vendor-created detection rules. Detection engineers need contextual threat intelligence to build effective detection controls. Threat intelligence solutions provide the information to accelerate the development of contextual detection controls based on real-world data. This approach is logical; enterprise detections will almost always be more effective if written by the enterprise’s internal engineering team, based on threat intelligence contextualized for their own systems, endpoints, and infrastructure.

Threat intelligence solutions are designed to be the single source of truth driving the priorities for risk management strategies. Many security organizations are not equipped to handle the volume of threat data they are currently receiving. Threat intelligence is still an evolving space, and security teams are often overwhelmed by threat data when using a poor threat intelligence solution, wasting time working through the noise as they search for actionable threat intelligence.

Threat intelligence has moved from “nice-to-have” to a requirement across every cybersecurity domain. Attentive vendors have taken notice and are actively developing more advanced solutions based on the changing needs of diverse enterprise threat landscapes. Every element of cybersecurity today—security policies, security frameworks, physical security decisions, alert triage processes, incident response processes, vulnerability management programs, patch prioritization strategies, threat hunting priorities, and network architectures—need reliable, timely threat intelligence.

The GigaOm Key Criteria and Radar reports provide an overview of the threat intelligence market, identify capabilities (table stakes, key criteria, and emerging technology) and evaluation metrics for selecting a threat intelligence platform, and detail vendors and products that excel. These reports give prospective buyers an overview of the top vendors in this sector and help decision makers evaluate solutions and decide where to invest.