More threat intelligence doesn’t necessarily mean better protection

Imagine a domain appearing in ten threat intelligence feeds.

Your security platform combines the results, counts the matches and assigns a high-confidence verdict. An automated control blocks the domain.

That might be the right decision.

But suppose all ten feeds obtained the domain from the same original report. Nobody independently verified it. The report concerned a compromised page that has since been removed.

You now have ten copies of one historical observation.

This hypothetical example exposes an important distinction: the amount of data supporting a verdict can look impressive while the underlying evidence remains limited.

More intelligence can improve protection. Its value depends on what it adds.

A record is a claim that needs context

An IP address, domain or email address is an identifier. Its appearance in a threat feed should prompt questions about why it is there.

Was a phishing page observed? Did the address distribute malware? Was it part of an investigation but never confirmed as malicious? Does it identify an attacker’s infrastructure, a compromised victim or a shared service?

Those distinctions affect the action the record can reasonably support.

“Associated with an incident” is too broad to justify every possible response. An address used to deliver malware and an address belonging to the victim of that malware can both appear in the same investigation.

Removing context may make a feed easier to process. It can also remove the information needed to interpret it correctly.

Repetition can look like corroboration

Consider how the hypothetical domain moves through the intelligence ecosystem.

A researcher publishes an observation. An aggregator imports it. Several feeds consume the aggregator’s output. A security platform receives the domain through multiple subscriptions.

The platform sees several sources. Underneath them sits one observation.

The distribution itself is useful: sharing helps evidence reach organisations that need it. The problem begins when repeated distribution is counted as independent confirmation.

An assessment should distinguish between:

• Multiple copies of the same report.

• Different analyses of the same underlying material.

• Separate observations that independently support the finding.

Each can add value, but they add different kinds of value.

If the original source cannot be established, independence should remain uncertain. It should not be assumed simply because the records arrived through different providers.

Ten sources may offer broad distribution. Whether they offer corroboration requires another question.

Fresh delivery does not mean fresh evidence

A feed updated every minute sounds current.

But the delivery schedule tells you when records arrive. It does not necessarily tell you when the underlying activity last occurred.

A record received today might describe behaviour observed months ago. Republishing it does not refresh the observation.

Useful intelligence should distinguish between when something was first observed, last observed, last checked and delivered to the consumer.

Those timestamps answer different questions.

Historical evidence can remain valuable for investigations and identifying patterns. Its suitability for a present-day blocking decision needs separate consideration.

An old observation is not automatically wrong. It should simply retain its age as it moves between systems.

Confidence needs a meaning

“High confidence” should communicate something about the strength of an assessment.

It becomes less useful when one provider uses the term for directly observed malicious behaviour and another uses it for an identifier appearing in several external feeds.

A consumer cannot safely treat those assessments as equivalent without understanding their basis.

The STIX 2.1 threat intelligence standard includes a confidence property representing the creator’s confidence in the correctness of their data. It also supports validity periods for indicators. These fields help preserve important context, but using a common format does not make every producer’s evidence or judgement equally strong.

A score of 95 also should not be read as a 95% probability of maliciousness unless the system has explicitly defined and validated it that way.

Precision in presentation can exceed precision in knowledge.

The cost of a weak signal depends on what follows

A tentative lead can be useful to an analyst.

The same lead may be unsuitable for automatically blocking a customer portal, interrupting a supplier relationship or labelling a legitimate organisation unsafe.

This is why evidence should be evaluated against its intended use.

A broad dataset may be valuable for searching historical activity or generating investigation candidates. A user-facing warning needs enough relevance and clarity to justify interrupting someone. An automated restriction needs evidence appropriate to its scope and business impact.

Treating every imported indicator as an instruction to block skips that judgement.

It also creates avoidable work: investigation, exception handling, restoring access and explaining the decision to affected teams.

The important question is what action the evidence supports.

High confidence must not become selective blindness

There is another side to this argument.

Demanding certainty before recording or investigating anything would make it harder to identify emerging threats. Early evidence is often incomplete.

A sound approach preserves useful leads while keeping their status clear.

An unverified report can be retained for investigation. A pattern can justify closer monitoring. Independent corroboration can strengthen an assessment. Direct observation of harmful activity can support a stronger response.

These are different stages of understanding.

Focusing on quality should improve how uncertainty is handled. It should not erase uncertain observations or imply that everything outside a confirmed dataset is safe.

That balance matters: excessive noise can waste attention, while an excessively narrow view can miss relevant activity.

Ask what the next feed contributes

Before adding another source, define the gap it is expected to fill.

Does it provide visibility into threats you otherwise miss? Earlier observations? Better evidence? Coverage relevant to your customers, suppliers or infrastructure?

Or does it primarily reproduce information already available?

Useful evaluation questions include:

• Can the finding be traced to supporting evidence?
• Does the source add independent observations?
• Are observation times separate from delivery times?
• Is the affected URL, domain, account or IP clearly identified?
• Are corrections and withdrawals propagated?
• Does the information change a relevant decision?

A smaller source that fills an important visibility gap may contribute more than a much larger source with substantial overlap.

Equally, a large source may offer valuable breadth. Size alone settles neither argument.

Corrections are part of intelligence quality

Evidence can change. Findings can be mistaken. Compromised services can be restored.

A credible intelligence process needs a way to revise assessments and communicate those revisions to the systems that consumed them.

That includes distinguishing “the harmful content is no longer present” from “the original finding was incorrect”. Both may change the appropriate action, but they tell different stories.

Without a correction process, a temporary finding can become a lasting reputation problem.

The ability to withdraw or narrow a claim is part of maintaining its integrity.

What this means for ThreatPrevent

At ThreatPrevent, our focus is high-confidence intelligence signals that help people make better decisions about domains, IP addresses and email addresses.

That focus places value on evidence quality, relevant context and conclusions proportionate to what is known. It also means recognising uncertainty and avoiding broad claims about legitimate organisations based on limited associations.

The measure of useful intelligence is the difference it makes when someone needs to decide whether to proceed, verify, investigate or stop.

Before asking how many indicators a service contains, ask what evidence would justify acting on one of them.