Abstract

This IDC Market Perspective provides a high-level overview of threat intelligence key capabilities that will serve as guidance for technology suppliers and buyers. Threat intelligence platform (TIP) providers and threat intelligence security service (TISS) are not niche cybersecurity approaches any longer. TIP/TISS was a viable (if expensive) technology used primarily by financial institutions, governmental departments, and critical infrastructure organizations where damages could be devastating in loss of money or even resulting in bodily harm. Several factors have pushed threat intelligence to the forefront today:

• TIP/TISS provide proactive defense capabilities and not just reactive.
• TIP/TISS vendors have worked on making their conclusions machine readable, and threat intelligence is mapped to MITRE ATT&CK/Engenuity framework.
• Cybersecurity AI/ML and back-end automation is mature enough that the software or service is affordable by midsize business.
• Threat intelligence is a requisite for an extended detection and response (XDR) platform.

"The adversary is too good these days to wait for indicators of compromise to surface and then investigate," notes Chris Kissel, research vice president, Security and Trust Products. "Properly curated threat intelligence can inform the security operation center (SOC) to create good lists and bad lists to deny or approve employee access, can fortify perimeter defenses such as firewalls and endpoint protection platforms, and lead to faster threat investigations if the adversarial motivations and tactics are properly understood."

Coverage