Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How CISOs Are Using Threat Intelligence Sharing to Stop Attacks
Transcript
- Lucas: Luna, we talk a lot about how enterprises defend themselves. But here's a question that doesn't get enough attention: why aren't they defending each other? Luna: You mean sharing intelligence about threats? Lucas: Exactly. And I don't mean the kind of sharing that happens over coffee at a conference. I mean structured, automated, machine-readable threat intelligence. Because in 2026, the idea that every company is an island when it comes to security is starting to look like a very expensive mistake. Luna: We've seen the stats. The average cost of a data breach is now over four and a half million dollars. That's a serious incentive to cooperate. Lucas: And that figure is up from four point three five million in 2022. So the cost keeps climbing. But here's the thing — the most sophisticated attackers are reusing their playbooks across multiple targets. The same phishing kit, the same malware strain, the same infrastructure. If one company detects it, they can share the indicators of compromise with everyone else, and the whole community gets harder to hit. Luna: So why doesn't that happen more often? There's got to be friction. Lucas: There is. Trust is the big one. Companies are terrified that sharing threat data might reveal something sensitive about their own network. And there are legal concerns — antitrust issues, data privacy regulations. But the industry has been trying to solve this for years, and we're finally seeing real traction. Luna: Let's talk about a concrete example. The Kaseya supply-chain attack in 2021. That was a big one. Lucas: Right. Kaseya is a company that makes remote-management software for managed service providers. Hackers exploited a vulnerability in their VSA product, and they pushed ransomware to over a thousand businesses in one go. It was a textbook supply-chain attack. Luna: And the response showed how important sharing can be. I remember that almost immediately, security firms were publishing indicators of compromise — file hashes, malicious IPs — so other companies could block them. Lucas: Exactly. And that was partly because of formal sharing groups. The Cyber Threat Alliance, which includes companies like Fortinet and Palo Alto Networks, played a role. They have automated systems that let members share threat data in real time. Within hours, the indicators were in security feeds across the globe. Luna: Did that actually limit the damage? Lucas: It's hard to quantify precisely, but the consensus is that it helped. The ransomware spread through managed service providers, so the more quickly downstream companies had the file hashes and command and control domains, the faster they could block them. And that's the whole point of intelligence sharing. Luna: But not all companies are in the Cyber Threat Alliance. Most aren't. So what's available for the average enterprise? Lucas: That's where ISACs come in — Information Sharing and Analysis Centers. There are ISACs for almost every sector: financial services, healthcare, energy, even retail. They're industry-specific, which is great because the threats in banking aren't the same as in hospitals. Members share threat reports, best practices, and indicators in a trusted environment. Luna: So a CISO at a mid-sized bank can join the Financial Services ISAC and get access to real-time intelligence from their peers. Lucas: Yes. And it's not just for the big players. Even small security teams can benefit. Many ISACs offer free or low-cost memberships for smaller companies. And the intelligence is actionable — not just, 'here's a new threat,' but 'here's what it looks like, and here's how to block it.' Luna: There's also the concept of threat intelligence platforms. Those are the tools that help automate the sharing, right? Lucas: Right. Platforms like MISP, which is open source, or commercial ones like Anomali or ThreatConnect. They let you ingest indicators from multiple sources, enrich them, and then push them into your security tools — your firewalls, your EDR, your SIEM. So you're not just getting a PDF report; you're getting automated defenses. Luna: That's where the real value is. Automation. Because if you have to manually update your firewall every time you get a new indicator, that doesn't scale. Lucas: Exactly. And that's a big shift we're seeing in 2026. The market for threat intelligence is growing because CISOs realize that sharing isn't just altruistic — it's economic. You're getting protection you couldn't build yourself, for a fraction of the cost of developing your own intelligence capability. Luna: But there are still challenges. The trust issue we mentioned earlier. How do companies get past that? Lucas: It's evolving. Anonymization is one piece. You can share the technical details — the IP address, the file hash — without saying who you are. But there's also a cultural shift. Security leaders are realizing that the bad guys are sharing information with each other, so the good guys have to too, or they fall behind. Luna: There's also a legal piece. The SEC's new rules on incident reporting might actually encourage sharing, because they push for transparency about breaches. Lucas: That's a good point. The SEC rules that took effect in 2023 require companies to disclose material incidents within four business days. That's forced companies to be more open about what happened, and that openness can trickle down to intelligence sharing. If you're already telling the SEC, why not tell your industry peers, in a structured way? Luna: So we're seeing a regulatory environment that's pushing toward collaboration. Lucas: Exactly. And I think that's a positive development. But we should also be clear about what sharing doesn't mean. It doesn't mean giving away your entire security strategy. It's about sharing the technical indicators of compromise, not your proprietary defenses. That's a nuance that sometimes gets lost. Luna: So for a CISO listening right now, what's the first step? Where do they start? Lucas: Start by joining your sector's ISAC. That's the lowest-hanging fruit. You don't have to build anything; you just join and start receiving alerts. From there, you can set up a basic threat intelligence platform, maybe the open-source one, MISP, and start integrating it with your existing security tools. The key is to start small, but start. Luna: And that's a conversation we've been having a lot on this show, actually — how to operationalize security, not just talk about it. It's one of the reasons we're so committed to keeping these episodes ad-free. Lucas: Yeah, we really try to give you practical, actionable insights here. And we deliberately don't run ads on these shows. If you want to support that choice, the link is buy me a coffee dot com slash fexingo. Anything helps, but no pressure. It's just a way to keep this resource open. Luna: And it goes directly to keeping the lights on, so we can keep digging into topics like this. Lucas: So, back to threat intelligence. What does the future look like? I think we're going to see more automation, ai powered analysis of incoming indicators, and even more real-time sharing. Luna: We've talked about AI agents in security operations before. Could they help with threat intelligence sharing too? Lucas: Absolutely. Imagine an AI agent that sits on your network, detects a suspicious file, automatically extracts the indicators, and shares them with your ISAC's platform — all in seconds. That's the direction we're heading. Some vendors are already piloting that kind of capability. Luna: That's exciting. It makes sharing feel less like an extra task and more like a background process. Lucas: Right. And that's what we need, because the threat landscape isn't slowing down. In the second quarter of 2026, we saw a record number of ransomware attacks. So the more we can automate defense, the better. But it all starts with a decision to share. Luna: So the takeaway is that threat intelligence sharing isn't just a nice to have; it's a strategic imperative. Lucas: Exactly. And it's not about being perfect. It's about being better together. If you're a CISO or a security professional, look into your ISAC, look into threat intelligence platforms, and start sharing. Because in the end, the bad guys are already collaborating. It's time we did too. Luna: And on that note, we'll wrap up. Thanks for listening, and we'll catch you next time. Lucas: Take care, everyone.