Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How CISOs Use Threat Intelligence Platforms to Predict Attacks
Transcript
- Lucas: So last month, a Fortune 500 retailer — I'm not naming them because the breach never actually happened — got a high-confidence alert from their threat intelligence platform about a compromised API key at one of their third-party logistics providers. The platform had correlated a dark web post with internal logs and flagged it before any data moved. Luna: That's the dream, right? Catch it before it becomes a headline. How did the platform connect those dots? Lucas: It's a threat intelligence platform — a TIP. It ingests feeds from dozens of sources: open-source intelligence, industry sharing groups like the ISACs, commercial threat feeds, even the company's own historical data. Then it cross-references that against the organisation's actual environment — IPs, domains, software versions, third-party connections. Luna: So instead of a human analyst reading blog posts all day, the machine is doing the correlation? Lucas: Exactly. The platform in this case had a rule that said: if a credential associated with a third-party vendor appears in a paste site, and that vendor has recent access to an internal database, escalate immediately. The old way — someone might have seen that paste weeks later, if at all. Luna: And by then the attacker is already inside. So the TIP is fundamentally about speed and context. Lucas: Right. And it's not just about external feeds. The platform also pulls in vulnerability data — specifically the Exploit Prediction Scoring System, or EPSS. Instead of patching by CVSS severity alone, which is static, EPSS gives a real-time probability that a vulnerability will be exploited in the next thirty days. Luna: So you can prioritise. Patch the thing that's actually being weaponised, not just the thing with a high theoretical score. Lucas: Exactly. In Q2 2026, EPSS for a certain zero-day in a popular VPN appliance was at 97 percent for two weeks straight. Companies using a TIP that ingested EPSS could see that and prioritise patching before the exploit hit the mainstream. The ones relying on CVSS alone might have waited for a scheduled patch cycle. Luna: That's the difference between a near-miss and a breach. But I imagine this isn't cheap. Who's actually adopting these platforms? Lucas: Historically, it's been large enterprises — the banks, the tech giants, the critical infrastructure firms. But in the past year, I've seen mid-market companies, say 500 to 2,000 employees, start to adopt lighter versions. Managed threat intelligence services that bundle a TIP with analyst support. The pricing has come down because of competition and cloud delivery. Luna: But is the mid-market actually getting value? Like, do they have enough internal telemetry to make correlation useful? Lucas: It's a valid question. The key is integration. If the TIP is only pulling external feeds and not connecting to your endpoint detection or your firewall logs, you're basically just getting a news feed with a fancy interface. The real value is when it's stitched into your existing security stack. Luna: So it's not a silver bullet. It's a force multiplier if you already have decent detection in place. Lucas: Right. And that's where the industry is heading. I think within three years, TIP functionality will be embedded in most SIEM and XDR platforms as a standard feature. But right now, standalone TIPs still lead on two things: threat-sharing communities and predictive scoring like EPSS. Luna: Speaking of communities — there's a human element here too, right? The platform might surface an indicator, but someone still has to decide what to do. Lucas: Absolutely. And that's the next frontier. The platforms are getting better at automating response — blocking an IP or quarantining a file — but strategic decisions, like whether to cut a supplier's access, still need a human. The CISO or a senior analyst reviews the intelligence and makes the call. Luna: Which brings up an interesting tension: if the platform becomes really good at prediction, do you start acting on every high-confidence alert? Or is there still room for judgment? Lucas: The best teams I've seen use a tiered approach. Automated blocking for obvious stuff — known malicious domains, command and control callbacks. Then for the grey area, an analyst validates before action. And for strategic threats — like supply chain infiltration — it's escalated to the CISO level. You don't want to accidentally sever a business relationship over a false positive. Luna: But false positives are still a huge problem. I've heard CISOs say their TIP generates so many alerts that analysts start ignoring them. Garbage in, garbage out. Lucas: That's the single biggest complaint. If your feed quality is low — if you're pulling from unfiltered open sources or misconfigured sharing groups — you'll drown in noise. The solution is curation. Commercial feeds with human analysts filtering out the junk, plus tuning the correlation rules to your actual environment. A TIP that knows you don't run a particular software shouldn't alert you about vulnerabilities in it. Luna: So the platform needs to understand your infrastructure. That's a significant upfront investment — mapping all your assets, classifying them, setting up the integrations. Lucas: It is. But companies that do it well see a return. The retailer I mentioned at the top — they told me the Tip paid for itself in that one near-miss alone. The cost of a data breach is millions. A TIP subscription is tens of thousands. Luna: And that's the argument. But I wonder — for the smaller company that can't afford the integration effort, is there an alternative? Lucas: There are managed detection and response services that bundle threat intelligence as part of the package. You outsource the correlation and the analysis to a third party. It's less control, but also less overhead. And you still get the benefit of their aggregated intelligence. Luna: So the trend is clear: threat intelligence is moving from a niche tool for the big players to a core component of every security program. The question is how fast that trickle-down happens. Lucas: Exactly. And I think the next step is more predictive — not just alerting on existing indicators, but forecasting attack patterns based on geopolitical events, economic shifts, even social media sentiment. Some platforms are already experimenting with that. Luna: That's fascinating — and slightly scary. But I guess that's where we're headed. Lucas: Yeah, it's a powerful tool. And like any tool, it depends on who's wielding it and how thoughtfully it's applied. Luna: Exactly. And speaking of thoughtful application — we've been doing these deep dives every week because we think they're genuinely useful for people building and running security programs. We don't run ads on these episodes. We want to keep it that way. Lucas: Yeah, the whole show is ad-free by design. If you find these conversations valuable and want to support that choice, there's a simple way: buy me a coffee dot com slash fexingo. It's not a subscription or anything — just a way to say 'keep going'. Luna: Right. And it really does help. Anyway — back to prediction. You mentioned geopolitical events feeding into threat intelligence. Is there a concrete example of that happening recently? Lucas: Sure. In April 2026, when tensions escalated between two countries in Eastern Europe, several TIPs saw a spike in scanning activity against energy sector companies. The correlation wasn't a direct indicator, but the platforms flagged it as a pattern worth monitoring. Some firms proactively isolated certain ICS networks. Luna: So the intelligence wasn't a specific IOC — it was a behavioural shift. That's a different kind of prediction. Lucas: Exactly. It's moving from 'here's a known bad IP' to 'here's an unusual volume of reconnaissance traffic from a region that often precedes attacks.' That's where AI and machine learning come in — clustering behaviours, not just matching hashes. Luna: And that's where the human analyst still has an edge, at least for now. An AI can spot the anomaly, but a person can ask: is this just noise? Is it a research project? Or is it the first phase of an intrusion? Lucas: Right. And that's the partnership model that works best. The TIP handles the data ingestion, the correlation, the prioritisation. The analyst brings context, experience, and judgment. Luna: So for a CISO evaluating a TIP today — what's the one question they should ask that's not about features or price? Lucas: I'd ask: how does this platform integrate with the tools you already have? A TIP that sits in a silo is just a very expensive RSS feed. The winner is the one that plugs into your SIEM, your SOAR, your endpoint protection, and your ticketing system — and actually reduces the number of alerts your team has to look at manually. Luna: Integration over features. That's a good lens. So where do you see the biggest gap in the market right now? Lucas: For me, it's intelligence sharing among mid-market companies. The big players have their ISACs and their closed groups. But a regional manufacturer with 800 employees — they're often flying blind unless they buy a commercial feed. If we could get more structured sharing across industries, everyone benefits. Luna: That's a coordination problem more than a technology problem. But maybe the TIP vendors can help facilitate it. Lucas: Some are trying. They offer anonymised aggregation — you can see that 'X percent of our customers in manufacturing saw this pattern' without revealing who. It's a start. Luna: Not bad. So overall, the trend is toward more data, more automation, and hopefully fewer breaches. But the human in the loop is still critical. Lucas: Absolutely. And that's the paradox — the more we automate prediction, the more we need skilled analysts to interpret it and act. The technology is only as good as the team using it. Luna: And the team using it is only as good as the intelligence they're fed. So maybe the real differentiator is feed quality, not the platform itself. Lucas: I think that's right. The best TIP in the world can't fix a bad feed. And a so-so TIP with a great, curated source will outperform a flashy one with noise. Luna: Good to keep in mind. Thanks, Lucas. Lucas: Thanks, Luna. Next week we'll look at how security teams are using AI to simulate employee phishing responses — and why some companies are seeing ninety percent click rates drop to under five. Luna: That sounds like a good one. See you then.