Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Companies Are Building Cyber Threat Intelligence Feeds
Transcript
- Lucas: If these conversations are useful for what you're building or running, stick around for a couple minutes—I want to pull back the curtain on something before we dive into today's episode. Luna: I think that's actually a good segue, because the topic today is something a lot of people in security use but rarely talk about as a business. Lucas: Exactly. We're looking at cyber threat intelligence feeds. These are the data products that tell security teams what hackers are doing right now—what IP addresses to block, what malware signatures to look for, what phishing domains just popped up. Luna: And it's a surprisingly big business. Recorded Future alone was bought by Mastercard in 2025 for one point nine billion dollars. Lucas: Right. And that's just one company. The market for threat intelligence is estimated at roughly twenty billion dollars globally, and it's growing at about fifteen percent compound annual growth rate. But for most people outside of security operations, this entire industry is invisible. Luna: So how does it actually work? I mean, where does the data come from? Lucas: There are basically three layers. The first is open-source intelligence—OSINT. That's public data: security blogs, social media, paste sites where hackers sometimes dump data. Companies scrape all of that constantly. Luna: Right, like when a ransomware group posts a victim list on their leak site. Luna: And they sell access to that aggregated view as a feed. Lucas: Precisely. And the pricing varies wildly. A small company might pay twenty thousand dollars a year for a basic feed. A Fortune 500 with a full security operations center can easily spend five hundred thousand to a million annually. Luna: That's a lot for what is essentially a list of bad IPs. Lucas: But it's much more than that now. Modern feeds include things like adversary profiles—who's behind an attack, what tools they use, what industries they target. Mandiant, for example, tracks over three hundred distinct threat groups. Their feed doesn't just say 'block this IP,' it says 'this IP is linked to APT29, a Russian state-sponsored group that targets government agencies using spear-phishing.' Luna: That context makes it actionable. It helps a security team prioritize. Lucas: Exactly. A small alert from a random IP in Eastern Europe might be ignored. But if the feed says it's linked to a known group that just attacked a similar company, that alert jumps to the top of the queue. Luna: So who are the biggest players? Lucas: Recorded Future is the biggest pure-play. They have about three thousand customers. Mandiant, owned by Google, is huge in incident response and their intelligence is deeply integrated with Google Cloud. CrowdStrike bundles intelligence with their endpoint product. Then there are specialists like Flashpoint, which focuses on dark web and criminal markets, and Anomali, which helps companies operationalize threat data. Luna: And then there's the open-source side. MISP—Malware Information Sharing Platform—is used by a lot of governments and financial institutions. Lucas: Right. MISP is free but you need the expertise to run it and the community to share data. That's the tradeoff. You don't pay cash, but you contribute your own threat data to the collective pool. Luna: Which is a non-trivial commitment. Sharing your own security telemetry can feel like revealing your hand. Lucas: That's a real concern. Some companies are hesitant because they worry about exposing their own vulnerabilities or giving competitors insight into what they're seeing. But the intelligence community has developed sharing models that anonymize the data. Traffic Light Protocol—TLP—is a standard for how broadly information can be shared. Luna: Let's talk about the business side. Recorded Future's acquisition for one point nine billion—what does that tell us about the market? Lucas: It tells us that threat intelligence is becoming a must-have, not a nice to have. Mastercard bought them because payment fraud and cyber crime are closely linked. If Mastercard can help its merchants and banks see emerging threats faster, they reduce fraud losses. It's a strategic play, not just a security product. Luna: So the value is in the integration—tying threat data into other systems like fraud detection, SIEMs, firewalls. Lucas: Exactly. The data is only useful if it's automatically consumed. That's why every major security vendor now offers a threat intelligence feed. Palo Alto Networks, Cisco, Fortinet—they all have them. And they're not just selling the data; they're selling the integration with their own platforms. Luna: One thing I've noticed is that the feeds vary a lot in quality. Some are just lists of known bad IPs that change slowly. Others are updated in real time with very low false positives. Lucas: Quality is the big differentiator. A feed with too many false positives actually hurts because security teams waste time investigating noise. The best feeds use machine learning to correlate multiple data points before issuing an alert. Recorded Future claims their average alert is enriched with over fifty different data elements. Luna: Fifty data points per indicator? That's a lot. Lucas: Yeah, things like geographic origin, associated malware family, first seen date, related campaigns, and a confidence score. That helps a security analyst decide whether to act immediately or just log it. Luna: And that's the core value proposition—turning raw data into a decision-ready signal. Lucas: Now, a quick honest thing. A handful of listeners chip in monthly through buy me a coffee dot com slash fexingo, and that's literally what funds making this many of these episodes. No ads, no sponsors, just listener support. Luna: And it means we can keep digging into these niches without worrying about fitting some advertiser's narrative. Lucas: Exactly. Alright, back to threat intelligence. One trend I find really interesting is the rise of sector-specific feeds. Luna: Like for healthcare or energy? Lucas: Exactly. A hospital doesn't care about a zero-day in industrial control systems. They care about ransomware that targets electronic health records. So vendors like health isac offer intelligence tailored to healthcare, with sharing among hospitals and manufacturers. Luna: And those sector ISACs—Information Sharing and Analysis Centers—have been around since 9/11, but they're becoming more formalized and commercial. Lucas: Right. The financial sector's fs isac is probably the most mature. They have over seven thousand members worldwide and provide threat intelligence that's very specific to banking fraud, ATM attacks, SWIFT compromises. Some of their feeds are only available to member institutions. Luna: So the business model is part subscription, part membership. Lucas: Yes. And it creates a kind of network effect. The more members, the more data, the better the intelligence. That's why the largest ISACs are so valuable. Luna: What about the smaller players? Is there room for startups in threat intelligence? Lucas: Definitely, but it's tough. The incumbents have massive data advantages. However, startups are finding niches—like intelligence for specific technologies. For example, a company called IntSights, which was acquired by Rapid7, focused on external threat monitoring, essentially watching for leaked credentials and brand impersonation. Luna: That's a different angle—not just telling you about attacks, but telling you if your own data is being sold on the dark web. Lucas: Exactly. And that's a growing concern, especially with credential stuffing attacks. If a company finds out that employee emails and passwords are being traded in bulk, they can force password resets before an attack happens. Luna: So threat intelligence is not just about blocking attacks; it's about proactive defense. Lucas: That's the shift. Ten years ago, threat intel was mostly used by governments and large banks. Now, mid-size companies are buying feeds because the cost of a breach is just too high. The average cost of a data breach in 2025 was around five million dollars. A twenty thousand dollar feed is cheap insurance. Luna: But you still need people to interpret it. A feed alone doesn't stop attacks. Lucas: No, and that's the catch. Many companies buy a feed but don't have an analyst to actually use it. That's why managed threat intelligence services are growing—where the vendor not only provides the data but also does the analysis and sends alerts directly. Luna: Like a subscription to a virtual analyst. Lucas: Exactly. And that's where the market is heading. The data is commoditizing, so the value is in the analysis and integration. The winners will be the companies that help you act on the intelligence, not just see it. Luna: It's a fascinating business model. And for listeners who run security teams, it's worth thinking about whether a generic feed or a sector-specific one fits better. Lucas: Absolutely. And if you're a startup, the opportunity might be in the gaps—like intelligence for cloud security or for operational technology. Those are still underserved. Luna: Good note to end on. Thanks, Lucas. Lucas: Thanks, Luna. That's it for today.