An intelligence-powered approach to threat intelligence investigations

David Ahn of Centripetal presents findings from what he describes as an academic, peer-reviewed study analyzing over 300 commercial, open-source and government cyber threat intelligence (CTI) providers. His team tracked roughly 10 billion active indicators and found that overlap between providers is only about 2 to 5%, that 66% of commercial intelligence is closed to outside use, and that 16% of indicators carry conflicting threat context between sources. A time-series analysis of 2023 CVEs shows that peak intelligence coverage of a new vulnerability typically takes around 15 days to build, yet roughly 75% of the indicators eventually attributed to an exploit were already known up to 90 days earlier under different or no attribution, meaning most breaches involve information that existed but was not accessible or connected in time. Ahn argues this fragmentation, driven by commercial differentiation rather than technical limits, explains why reactive, context-heavy threat hunting misses so much. He proposes shifting intelligence use further left on the MITRE ATT&CK kill chain, accepting lower-confidence indicators to reduce log volume proactively, and matching the intelligence quality demanded to actual business risk rather than treating every alert as needing full attribution.