Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Enterprise Security Teams Are Using Threat Intelligence Platforms
Transcript
- Lucas: So there's this number that keeps rattling around in my head: the average large enterprise subscribes to something like 15 separate threat intelligence feeds. Feeds from vendors, from open-source communities, from industry ISACs, from government alerts. And most of them end up in different inboxes, different dashboards, different Slack channels. Luna: And that's basically the recipe for alert fatigue, right? Fifteen different sources all yelling at the same analyst. Lucas: Exactly. And that's the problem that threat intelligence platforms — or TIPs — are supposed to solve. One unified platform that ingests all those feeds, deduplicates them, enriches them, and then prioritizes them. I want to talk about why this is suddenly a boardroom conversation, not just a SOC tool. Luna: Let's start with a concrete example. Who's doing this well that we can point to? Lucas: I've been looking at how a global bank — let's call them a top-five European institution — consolidated from 22 separate intelligence sources down to a single TIP from Recorded Future. Their SOC team reported a 40 percent reduction in alerts that required manual triage within the first six months. The key was that the platform automatically correlated indicators across all feeds and surfaced only the ones that matched their infrastructure. Luna: That 40 percent cut is huge. But I imagine the real win is not just fewer alerts — it's better context. An IP address from one feed might be meaningless, but when the platform sees that same IP tied to a ransomware campaign in another feed, suddenly it's actionable. Lucas: Right. And that's where the standards come in. Most TIPs now use STIX and TAXII — Structured Threat Information Expression and Trusted Automated Exchange of Indicator Information. STIX gives you a common language for describing threats, TAXII gives you a transport mechanism. Without those standards, every feed is a custom integration project. Luna: So the TIP market has matured to the point where you can plug in almost any feed and get structured data out. That wasn't the case even three years ago, was it? Lucas: No, it really wasn't. Earlier TIPs were basically just RSS readers for threat blogs. Now you've got platforms like Anomali that not only aggregate but also run machine learning models on the data to predict which threats are most likely to hit your industry. They look at things like: is this group actively targeting financial services? Is the malware type one that historically evades your current defenses? Luna: And that predictive piece is what gets the CISO's attention. Because they're drowning in data but starving for insight. Lucas: Exactly. And I think that's why we're seeing adoption accelerate. According to a 2025 survey from SANS, around 70 percent of large enterprises now have a dedicated threat intelligence platform. That's up from maybe 40 percent five years ago. The remaining 30 percent are mostly still using spreadsheets and shared inboxes. Luna: And those spreadsheet shops are the ones getting hit hardest by ransomware, I'm guessing. Lucas: The correlation is strong. But even among the 70 percent who have a TIP, there's a second-order problem: many of them aren't using the platform to its full potential. They ingest all the feeds, but they don't configure the enrichment rules. They don't set up automated playbooks. So the TIP becomes just another dashboard. Luna: That's the difference between buying a tool and actually operationalizing intelligence. I've heard CISOs talk about needing a 'TI engineer' — someone who bridges the gap between the platform and the SOC workflow. Lucas: That's a great term. And it points to a hiring trend. A lot of the job postings I see now have 'Threat Intelligence Platform Administrator' or 'TI Integration Specialist' as a distinct role. It used to be a side task for a senior analyst. Now it's a full-time position. Luna: So if someone is listening and thinking about pitching a TIP to their boss, what's the one metric that moves the needle? Lucas: Mean time to respond. Or more specifically, mean time to identify a relevant threat. A good TIP can cut that from hours to minutes. I spoke with a SOC manager at a retail company who said before the TIP, they would spend 20 minutes manually cross-referencing a new indicator across their feeds. After the TIP, it was three seconds. Luna: Three seconds. That's the kind of number that makes a CFO nod. Lucas: It really is. And it ties directly to ROI. If you can reduce the time a senior analyst spends on triage, you free them up to do actual hunting. That's where the value is. Luna: Speaking of freeing up resources, these shows are ad-free and rely on listener support. If you're getting value from these deep dives, consider buying us a coffee at buy me a coffee dot com slash fexingo. It helps us keep the research going and the episodes coming. Lucas: Yeah, we appreciate it. And we wouldn't ask if it wasn't genuinely helpful. Now, back to TIPs — one more thing I want to touch on is the shift toward cloud-native platforms. The older TIPs were on-prem appliances. Now almost every major vendor — Recorded Future, Anomali, ThreatConnect — offers a SaaS version. Luna: And that changes the deployment model. No more hardware procurement cycles. No more quarterly updates. You get new feeds in real time. Lucas: Exactly. And that's especially important for smaller security teams that don't have a dedicated infrastructure person. They can sign up, connect their existing EDR and SIEM, and start getting enriched alerts within a day. Luna: It's almost like the democratization of threat intelligence. Five years ago, only the biggest banks and tech companies had dedicated TI teams. Now a 200-person company can have the same quality of intelligence. Lucas: Right. And that's a good place to leave it. The tools are there. The standards are mature. The question for most teams now is not 'should we get a TIP?' but 'how do we get the most out of the one we have?' Luna: And that's a question worth revisiting in a future episode. For now, thanks for listening.