- 01The narrative around CTI sharing is uniformly positive. Alexa Research measured the actual operational impact across a peer community of 14 organizations sharing through a common platform for 18 months. Results were more nuanced.
- 02What we measured: indicators consumed per organization per month, detections generated from those indicators, true-positive rate of detections, time from indicator publication to detection in consuming organizations.
- 03What we found: median consumption 2,400 indicators/month/org, median 47 detections/month/org generated, median 18% true-positive rate. Most variance was explained not by feed quality but by detection-engineering capacity in the consuming organization.
- 04Consequence: sharing without operationalization is largely theater. Organizations that invested in a small team to translate intel into detections extracted dramatically more value than those who simply ingested the feed. Plan the operationalization spend before committing to the sharing program.
The narrative around cyber threat intelligence sharing is uniformly positive. Alexa Research measured the actual operational impact across a peer community of 14 organizations sharing through a common platform for 18 months. The results were more nuanced.
What we measured
- 01Indicators consumed per organization per month
- 02Detections generated from those indicators
- 03True-positive rate of detections
- 04Time from indicator publication to detection in consuming organizations
What we found
Median consumption: 2,400 indicators per month per organization. Median number of detections generated: 47 per organization per month. Median true positive rate: 18%. Most variance was explained not by feed quality but by detection-engineering capacity in the consuming organization.
The consequence
Sharing without operationalization is largely theater. Organizations that invested in a small team to translate intel into detections extracted dramatically more value than those who simply ingested the feed. Plan the operationalization spend before committing to the sharing program.