Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Threat Intel Feeds Are Going Real-Time and AI-Powered
Transcript
- Lucas: So there's this shift happening in threat intelligence that I think is actually one of the bigger architectural changes in security operations right now. It's the move from batch-updated feeds — you know, the old model where your TI platform pulls a CSV or STIX file every hour — to real-time streaming telemetry that's analyzed and delivered in seconds, often with AI inference baked in. Luna: Right, because the old model meant you were always looking at something that happened at least an hour ago. In a ransomware scenario, that gap can be the difference between containment and full encryption. Lucas: Exactly. And the vendors have been pushing this for a while — CrowdStrike's Falcon OverWatch has been streaming telemetry for years, but what's new is that the market for standalone threat intelligence platforms is pivoting hard. I was looking at a survey from mid-2026 — it's from the SANS Cyber Threat Intelligence survey — and it shows 42 percent of enterprises now use real-time threat feeds, up from 18 percent just two years ago. Luna: That's a pretty dramatic jump. What's driving it? Is it the threat landscape, or is it more that the tech has matured? Lucas: Both, honestly. On the threat side, we're seeing attackers move faster — especially with initial-access brokers who will compromise a perimeter in minutes and pass it off. So defenders need intel that's as current as the attack chain. On the tech side, we've got platforms like Palo Alto Networks' Cortex XSOAR and their new real-time TI module that ingests from dozens of sources and correlates with machine learning models on the fly. Luna: And I imagine the AI piece is crucial. Because if you're getting a firehose of indicators — IPs, domains, hashes — you need something to prioritize what's actually relevant to your environment. Lucas: Exactly. That signal to noise problem is huge. A typical enterprise might ingest millions of indicators per day from open-source and commercial feeds. Without ai driven triage, analysts are drowning. So the newer platforms apply what's called 'inference-based intelligence' — they look at patterns, not just indicators. For example, if they see a command and control domain that's been registered via a specific registrar, using a specific SSL cert pattern, and it matches a known threat actor's TTPs, the feed can predict the next move before the actual payload drops. Luna: Interesting. So it's shifting from reactive — 'here's a bad IP' — to proactive: 'here's what's about to happen.' That feels like a fundamental change in how SOCs operate. Lucas: It really is. And we're seeing some CISOs restructure their teams around this. Instead of having a tier-one analyst doing manual enrichment on alerts, the real-time feed handles enrichment automatically. The analyst's job becomes validating the AI's inference and deciding on response actions. It's a higher-leverage role. Luna: But I wonder about the smaller shops. The mid-size company with a three-person security team — can they handle the bandwidth and compute cost of a real-time streaming feed? Lucas: That's the tension. The big vendors charge based on data volume and compute, so it can get expensive. But some managed security service providers are offering it as a bundled service — you pay a flat monthly fee and get access to the real-time feed plus some analyst time. So it's becoming more accessible than it was even a year ago. Luna: Let me ask about the quality of the intel itself. With batch feeds, you at least had some curation — the feed provider had time to validate. With streaming, are we seeing more false positives? Lucas: Good question. Early on, yes — the signal to noise ratio was worse because the systems were tuned for speed over accuracy. But the newer AI models are actually improving precision. They're trained to correlate multiple low-confidence signals into a high-confidence alert. For instance, a single connection to a never before seen domain might be noise. But if that domain was registered two hours ago, uses a known malicious hosting provider, and the beaconing pattern matches a specific malware family, the model flags it with high confidence. Luna: So it's pattern matching at machine speed. I can see how that would be a game changer for incident response timelines. Lucas: Right. And it also changes how threat intelligence is consumed. Traditionally, TI was something you used for enrichment after you detected something. Now it's becoming part of the detection engine itself. You're seeing things like 'reputation-based blocking' that updates in real time. If a new malicious IP is identified by one customer's sensor, within seconds it's blocked across the entire customer base. Luna: That's powerful, but also raises questions about false positives at scale. One misclassification and you're blocking legitimate traffic across thousands of organizations. Lucas: Absolutely, and that's why the vendors are investing heavily in feedback loops. When a block is triggered, the system checks if the traffic was actually malicious — and if not, it adjusts the model. It's a continuous learning cycle. But you're right, the risk is there. That's why most enterprises still use real-time feeds for alerting, not automatic blocking, at least for now. Luna: So you're seeing it as a detection accelerator, not a replacement for human judgment. Lucas: Exactly. And that brings up another angle — the insurance industry is starting to take notice. I've heard of cyber insurers asking about real-time intel capabilities during underwriting. If you're a company that relies on batch-updated feeds with hour-plus latency, your premium might be higher than a company using real-time streaming. Luna: That makes sense. If real-time intel demonstrably reduces the dwell time of attackers, that's a direct reduction in claim risk. I could see it becoming table stakes within a few years. Lucas: And that would further accelerate adoption. Because now it's not just a security decision — it's a financial one. CISOs can make the business case that investing in real-time TI lowers cyber insurance costs, which improves the bottom line. Luna: Before we go deeper, I want to quickly mention something that's tangential but relevant. A couple of dollars a month is genuinely what keeps these shows going — buy me a coffee dot com slash fexingo, if you've gotten something out of them. It's ad-free because of listeners who chip in. Lucas: Yeah, it makes a real difference. And it keeps us independent, so we can cover topics like this without any vendor spin. So thank you if you've supported that. Luna: Alright, back to the intel. Lucas, you mentioned inference-based intelligence. Can you give a concrete example of how a real-time feed might predict an attacker's next move? Lucas: Sure. Let's say a threat actor group known for targeting healthcare — like one of the ransomware as a service crews — is observed scanning for a specific vulnerability in a medical device management portal. The real-time feed correlates that scanning activity with known infrastructure of that group and then automatically pushes a detection rule to all healthcare customers. Before the group even launches its exploit, the defenders have a signature in place. That's the ideal. Luna: So it's about shortening the window between first observation and protective action. In the old model, that window could be hours. Now it's seconds. Lucas: Exactly. And that's the metric that matters — mean time to protection. The industry average for batch feeds was something like two to four hours. With real-time ai driven feeds, we're seeing sub-60-second protection for some threat types. That's a dramatic shift. Luna: Are there any downsides besides cost and false positives? For instance, what about data privacy? When you're streaming telemetry to a third-party cloud for analysis, that creates its own risk. Lucas: Great point. That's actually a hot topic right now. Some enterprises are uncomfortable sending all their network logs to a vendor's cloud for real-time analysis. So we're seeing on-premise or hybrid deployments where the AI model runs locally, and only anonymized metadata goes to the cloud for cross-customer correlation. That's a compromise that seems to be gaining traction. Luna: So the technology is evolving, but the adoption curve is still being shaped by trust, cost, and integration complexity. Lucas: Exactly. And I think we'll see a bifurcation: large enterprises with mature SOCs will build their own real-time pipelines using open-source tools like OpenCTI with streaming connectors. Mid-market companies will buy it as a managed service. And small businesses will get it embedded in their next-gen firewall or EDR platform without even knowing it. Luna: That last point is interesting. If it becomes invisible — just part of the infrastructure — then the adoption could be much faster than the survey data suggests. Lucas: Right. Because if you're using a modern endpoint protection platform, you're already getting real-time intel under the hood. The question is whether the security team is aware of it and configuring it correctly. I think that's the next challenge: training analysts to trust and act on real-time signals, rather than waiting for a human-written report. Luna: So it's as much a cultural shift as a technical one. Lucas: Absolutely. And I think that's what makes this such a fascinating moment in cybersecurity. The technology is ready, but the organizational muscle is still being built. Luna: Alright, so where do you see this going in the next year or two? Will real-time become the default, or will there always be a role for batch intel? Lucas: I think batch intel won't disappear, but it'll shift to strategic uses — like long-term trend analysis and threat actor profiling. For operational detection and response, real-time will become the baseline. The vendors that don't offer it will be at a competitive disadvantage. And I suspect cyber insurance will be the forcing function that pushes the laggards. Luna: So if you're a CISO listening, the takeaway might be: start evaluating real-time TI now, even if it's just a pilot. Because in two years, it might be a requirement. Lucas: That's exactly the takeaway. And the good news is, the barrier to entry is lower than ever. There are open-source projects, freemium tiers from vendors, and managed services that let you test without a huge upfront investment. No excuse not to start. Luna: Well, this has been a great look at where threat intelligence is heading. Thanks, Lucas. Lucas: Thanks, Luna. And thanks to everyone who supports the show.