Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Use Cyber Threat Intelligence Platforms
Transcript
- Lucas: If these conversations are useful for what you're building or running, you're in the right place. I'm Lucas. Luna: And I'm Luna. Today, episode 128, we're talking about cyber threat intelligence platforms — not just what they are, but how teams actually use them to cut through the noise. Lucas: Right. There's a stat that sticks with me: a mid-sized financial services firm — about five hundred employees, maybe a three-person security team — deployed an open-source threat intelligence platform last year. Within six months, their mean time to respond to alerts dropped by forty percent. That's not a vendor claim; it's from a case study published by the firm's CISO at a conference. Luna: Forty percent is huge. But what actually drove that? Was it better feeds, or the platform itself? Lucas: Both, but mostly the platform. Before, they were pulling in raw feeds from a couple of free sources — AlienVault OTX, maybe some spam lists — and dumping them into their SIEM. They had thousands of indicators of compromise, but no context. So analysts spent hours trying to figure out if an IP was actually relevant to their infrastructure. Lucas: The platform they adopted — I believe it was OpenCTI, the open-source project from the French cybersecurity agency — let them tag indicators with MITRE ATT&CK techniques, automatically enrich them with passive DNS and WHOIS data, and then map those indicators to their own asset inventory. Suddenly, an IP that was flagged as a Cobalt Strike server could be checked against their public-facing web servers in seconds. Luna: So the platform wasn't just aggregating data, it was aligning it with their environment. That's the difference between intelligence and just noise. Lucas: Exactly. And that's where a lot of teams get stuck. They buy a threat intelligence feed — sometimes spending fifty thousand dollars a year on a commercial feed — but they don't have the operational layer to turn that feed into detection rules or prioritized investigations. The platform bridges that gap. Luna: But let's be real: a three-person security team probably doesn't have a dedicated threat intel analyst. Can they really operationalize a platform like that without hiring? Lucas: It's a fair question. The firm I mentioned didn't hire anyone. What they did was assign threat intelligence duties to one person, but only for about ten hours a week. The rest of the team contributed by flagging interesting alerts. The platform's automation did the heavy lifting — automatically creating detection rules in their SIEM based on new indicators that matched their environment. Lucas: There are now managed threat intelligence services that do the analysis for you, curating feeds and pushing prioritized alerts. But the platform itself can also integrate with SOAR tools to automate response. So even a small team can operationalize intel if they choose the right tools. Luna: That makes me think about the different types of intelligence. Strategic, tactical, operational. Most teams I talk to are drowning in tactical intel — IPs, domains, hashes — but they lack strategic context, like which threat groups are targeting their sector. Lucas: Right. Strategic intel is more about long-term trends and adversary motivations. It's harder to produce and harder to consume. But a good CTI platform should help with all three layers. For example, if you see a spike in indicators related to a specific ransomware group, the platform can surface a strategic report about that group's latest tactics, and that helps the CISO communicate risk to the board. Luna: I've also seen teams struggle with alert fatigue from too many uncorrelated feeds. They subscribe to every free feed they can find, and then their SIEM is overwhelmed. Lucas: That's a common pitfall. One security manager I spoke with said they were ingesting over forty feeds, but ninety percent of the alerts were duplicates or irrelevant. They consolidated to three feeds — one commercial, one open-source, and one sector-specific ISAC feed — and used the platform to deduplicate and score indicators. Their alert volume dropped by seventy percent, and their true positive rate went up. Luna: That's a great example of less being more. So what should a team look for when evaluating a CTI platform? Not just features, but capabilities. Lucas: I'd say three things. First, integration with existing tools — SIEM, SOAR, ticketing system. If you have to manually copy-paste indicators, you've already lost. Second, enrichment capabilities: passive DNS, WHOIS, geolocation, SSL certificate data. Raw IPs are useless without context. Third, the ability to map to a framework like MITRE ATT&CK, because that gives you a common language for sharing intel with other teams. Lucas: Also, consider whether the platform supports collaboration. Threat intelligence is a team sport. You want to be able to share notes, tag adversaries, and track investigations within the platform. Luna: You mentioned open-source platforms like OpenCTI. How do they compare to commercial ones like ThreatConnect or Anomali? Lucas: Open-source gives you flexibility and no licensing cost, but you need some engineering support to set it up and maintain it. Commercial platforms offer more out-of-the-box integrations, support, and often better enrichment data. For a small team without dedicated DevOps, a commercial platform might save time. But for a team that wants to customize heavily, open-source is powerful. Luna: There's also the question of data sharing. Some platforms encourage sharing indicators with the community, but some organizations are hesitant because of legal or competitive concerns. Lucas: That's a valid concern. But most platforms allow you to control what you share — you can share only anonymized data or subscribe to feeds without contributing. And the benefits of sharing often outweigh the risks, because you get access to a broader set of indicators. The financial firm I mentioned earlier shared their indicators through an ISAC, and they got early warning about a phishing campaign targeting banks weeks before it hit them. Luna: So the platform becomes a force multiplier. It's not just about collecting intel, but about connecting it to action. Lucas: Exactly. And that's why we're seeing more organizations move from 'collecting threat intel' to 'operationalizing threat intel.' The platform is the engine, but the process and people matter too. Luna: Speaking of people, if you found any of this useful, here's a quick thought: our show is ad-free because of listeners who chip in. If today's episode gave you a concrete idea or a tool to check out, consider supporting at buy me a coffee dot com slash fexingo. It helps us keep doing deep dives like this without any sponsor pressure. Lucas: Yeah, it's a small way to keep the conversation going. And we truly appreciate it. Now, back to the tactical: once you have a platform in place, how do you measure success? What's the metric that matters? Luna: That's a good question. I've seen teams track number of indicators ingested, but that's vanity. Better metrics are mean time to detect, mean time to respond, or percentage of alerts that are triaged automatically. Lucas: Right. And one underrated metric is 'intelligence to detection ratio' — how many of your indicators actually become detection rules. If you're ingesting ten thousand indicators a day but only creating five rules, you're not operationalizing. A good target is to have at least twenty percent of high-confidence indicators converted into rules within 24 hours. Luna: That requires automation. Manual conversion doesn't scale. So the platform's ability to auto-generate rules is critical. Lucas: Absolutely. And that's where the integration with your SIEM or EDR matters. Some platforms can push indicators directly as Sigma rules or YARA rules, which then get deployed to your detection tools. That's the kind of workflow that saves analysts hours. Luna: Let's talk about a specific use case: ransomware preparedness. How can a CTI platform help with that? Lucas: A great example. If you're tracking ransomware groups, you can subscribe to feeds that focus on ransomware indicators — like specific hashes, C2 domains, or email subject lines used in initial access. The platform can then alert you when any of those indicators appear in your environment. More importantly, it can provide strategic intel on which groups are most active in your region or sector, so you can prioritize patching or user training. Lucas: There's also the pre-attack phase. Some platforms collect information on vulnerabilities being exploited by ransomware groups. If a new exploit for a VPN appliance is being used by a group like LockBit, the platform can flag it and suggest a mitigation before you see an actual intrusion. Luna: That's proactive defense. Instead of waiting for an alert, you're preventing the breach. Lucas: Exactly. And that shift from reactive to proactive is what CTI platforms enable. They give you the context to make decisions — like blocking a domain before a user clicks, or isolating an endpoint based on a behavioral indicator from a threat report. Luna: So for a security leader listening, the takeaway is: don't just buy a feed. Invest in the platform that turns that feed into actionable intelligence. Lucas: And start small. Pick one use case — say, ransomware or phishing — and build from there. Measure your before and after metrics. That's how you prove ROI to the board and build a program that scales. Luna: All right, that's a solid blueprint. Thanks for the deep dive, Lucas. Lucas: My pleasure. For more episodes like this, head to fexingo dot com. I'm Lucas. Luna: And I'm Luna. Catch you next time.