---
title: How to Successfully Implement a Threat Intelligence Program
description: Threats continue to occur on a global scale. They are large, they are complex, and they are growing.
image: https://blog.nisos.com/hubfs/cs-tile-How%20to%20Successfully%20Implement%20a%20Threat%20Intelligence%20Program-1.jpg
---

[![NISOS_logo_high_res_horiz-black](https://blog.nisos.com/hs-fs/hubfs/NISOS_logo_high_res_horiz-black.png?width=3357&height=674&name=NISOS_logo_high_res_horiz-black.png "NISOS_logo_high_res_horiz-black")](https://www.nisos.com/)

- [Home](https://www.nisos.com/)
- Solutions 
    - [Manage Human Risk](https://nisos.com/solutions/human-risk/)
    - [Protect Online Platforms](https://www.nisos.com/solutions/trust-safety/)
    - [Manage Cybersecurity Risks](https://www.nisos.com/solutions/cybersecurity/)
    - [Protect Executives, Assets, and Reputation](https://www.nisos.com/solutions/corporate-security/)
    - [Secure the Employee Lifecycle](https://nisos.com/solutions/workforce-risk/)
- Services 
    - [Human Risk](https://nisos.com/services/human-risk/) 
          - [Employment Shield](https://nisos.com/services/employment-shield/)
          - [Executive Shield](https://nisos.com/services/executive-shield/)
          - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/)
          - [Insider Threat Intelligence Solutions](https://nisos.com/services/executive-shield/)
    - [Risk Assessment](https://www.nisos.com/services/risk-assessments/) 
          - [Threat Landscape](https://www.nisos.com/services/threat-landscape-assessment/)
    - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) 
          - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/)
    - [Investigations](https://www.nisos.com/services/investigations/) 
          - [Adversary Investigation](https://www.nisos.com/services/adversary-insights/)
- Company 
    - [About Us](https://nisos.com/company/about-us/)
    - [The Nisos Difference](https://nisos.com/company/the-nisos-difference/)
    - [Client Success](https://nisos.com/company/client-success/)
    - [Careers](https://www.nisos.com/company/about-the-company/careers/)
- Resources 
    - [News](https://www.nisos.com/newsroom/)
    - [Blog](https://www.nisos.com/nisos-blog/)
    - [Events](https://www.nisos.com/events/)
    - [Resource Library](https://www.nisos.com/resources/library/)
    - [Podcasts](https://www.nisos.com/podcasts/)
- [Contact](https://www.nisos.com/contact/)

- [Home](https://www.nisos.com/)
- Solutions 
    - [Manage Human Risk](https://nisos.com/solutions/human-risk/)
    - [Protect Online Platforms](https://www.nisos.com/solutions/trust-safety/)
    - [Manage Cybersecurity Risks](https://www.nisos.com/solutions/cybersecurity/)
    - [Protect Executives, Assets, and Reputation](https://www.nisos.com/solutions/corporate-security/)
    - [Secure the Employee Lifecycle](https://nisos.com/solutions/workforce-risk/)
- Services 
    - [Human Risk](https://nisos.com/services/human-risk/) 
          - [Employment Shield](https://nisos.com/services/employment-shield/)
          - [Executive Shield](https://nisos.com/services/executive-shield/)
          - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/)
          - [Insider Threat Intelligence Solutions](https://nisos.com/services/executive-shield/)
    - [Risk Assessment](https://www.nisos.com/services/risk-assessments/) 
          - [Threat Landscape](https://www.nisos.com/services/threat-landscape-assessment/)
    - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) 
          - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/)
    - [Investigations](https://www.nisos.com/services/investigations/) 
          - [Adversary Investigation](https://www.nisos.com/services/adversary-insights/)
- Company 
    - [About Us](https://nisos.com/company/about-us/)
    - [The Nisos Difference](https://nisos.com/company/the-nisos-difference/)
    - [Client Success](https://nisos.com/company/client-success/)
    - [Careers](https://www.nisos.com/company/about-the-company/careers/)
- Resources 
    - [News](https://www.nisos.com/newsroom/)
    - [Blog](https://www.nisos.com/nisos-blog/)
    - [Events](https://www.nisos.com/events/)
    - [Resource Library](https://www.nisos.com/resources/library/)
    - [Podcasts](https://www.nisos.com/podcasts/)
- [Contact](https://www.nisos.com/contact/)

# Blog

## How to Successfully Implement a Threat Intelligence Program

 by [Landon Winkelvoss](https://blog.nisos.com/blog/author/landon-winkelvoss)  | Nov 23, 2020 | [Cybersecurity](https://blog.nisos.com/blog/tag/cybersecurity)

Threats continue to occur on a global scale. They are large, they are complex, and they are growing. This problem has led to widespread interest in tailoring intelligence programs that provide insight into business problems and generate actionable outcomes.

For intelligence to drive a security program, organizations need 1) a vehicle to drive, 2) a direction to go, 3) a dedicated driver, and 4) an understanding of the terrain as well as the ability to look back, pivot and maneuver when obstacles are encountered.

**The Vehicle: Defensive Security**

Optimizing threat intelligence requires a defensive security team with the ability to recognize and respond to incidents, identify and patch vulnerabilities, and track and resolve risk.

Programs do not have to launch in a fully-matured state, because threat intelligence and the environment can be used to guide program development, facilitate continuous improvement, and achieve increasingly higher levels of maturity.

However, even from the beginning, it is critical to the development of a threat intelligence program that if and when an organization identifies a threat, they are able to mitigate or resolve the threat.

**The Direction: Priority Intelligence Requirements**

Initially identifying the direction a threat intelligence program will travel can be as simple as highlighting an organization’s key threats.

Priority Intelligence Requirements (PIR) assist in addressing key threats by providing a series of questions the threat intelligence team must answer.

No single program is suitable for all organizations. Different organizations will have different priorities. For example, if an organization has significant research and development or high value intellectual property, the first PIR may be to identify:

- Who is interested in our data and what are their tactics, techniques and procedures?

However, if an organization is inundated with phishing emails related to wire fraud and their position in a supply chain, the first PIR may be to outline:

- What are the key techniques utilized for wire fraud and supply chain takeover and the proactive steps required to reduce or mitigate the threat?

**The Dedicated Driver: Full-Time Resource and Collaboration**

A common mistake when developing a threat intelligence program is the failure to provide adequate resources and staffing. In many cases, organizations will assign a person the role in addition to other existing duties. Organizations often balk at hiring a full-time, experienced, threat intelligence analyst. This approach is likely to fail. Without dedicated focus, a part-time analyst will be pulled in too many directions to be able to accurately and effectively perform all of the necessary functions and establish a successful intelligence program.

This individual may lean on solutions like intelligence feeds that are noisy and lack context, preventing the development of actionable intelligence. Without actionable intelligence, it is difficult to justify a threat intelligence program.

Threat intelligence programs require a lot of diplomacy and collaboration. An experienced and successful threat intelligence analyst will be able to effectively communicate with an organization’s c-suite as well as technical and non-technical peers. Experienced analysts have the skills to provide consistently actionable intelligence. Just as importantly, they have the ability to communicate the reason, the process, and the desired outcomes to stakeholders across the organization.

**The Terrain: Choosing the Right Supplemental Intelligence**

Supplemental intelligence resources fill in gaps that a Threat Intelligence Program is not able to provide on it’s own.

For organizations beginning the process with one analyst, this may be a platform that assists in the collection of data, a targeted intelligence feed, or assistance from a managed intelligence services provider.

Of critical importance is an organization’s understanding of the unique terrain their company will traverse. This allows them to reinforce their intelligence program and prepare for incoming threats. For example, engaging with a threat intelligence company specializing in Advanced Persistent Threats and nation state actors may not be the right choice for a retail manufacturer, but it is imperative for critical infrastructure. Likewise, a medical facility without a clear understanding of ransomware and how to protect against the latest variants is missing knowledge that could allow them to prevent or mitigate attacks.

Based on the unique characteristics of each organization, it is important to reinforce any Threat Intelligence Program with supplemental intelligence and investigative expertise that maps directly to the threats they will likely encounter.

**The Obstacles**

Regardless of whether an organization is facing cyber-crime, nation state espionage, physical security threats, aggressive online hostiles, or threats targeting their supply chain, it’s critical to have investigative support that helps provide proper context.

The “how”, “why”, and potentially the “who” that inform actionable outcomes determine if a threat or vulnerability requires remediation.

Many threat intelligence providers can provide an early warning, but the investigative follow-through is where the value lies. The ability to rapidly confirm or deny whether a breach is in process can be the difference between success and failure.

**Conclusion**

Implementing a successful Threat Intelligence Program is not easy. It starts by understanding your exposure and then implementing a combination of the right people, the right process, and the right intelligence. Programs will continually evolve, but these simple initial steps and considerations will get you started on the correct path.

---

---

---

- Solutions 
    - [Human Risk](https://nisos.com/solutions/human-risk/)
    - [Cybersecurity](https://nisos.com/solutions/cybersecurity/)
    - [Trust and Safety / Platform](https://nisos.com/solutions/trust-safety/)
    - [Corporate / Physical Security](https://nisos.com/solutions/corporate-security/)

- [Human Risk](https://nisos.com/services/human-risk/) 
    - [Employment Shield](https://nisos.com/services/employment-shield/)
    - [Executive Shield](https://nisos.com/services/executive-shield/)
    - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/)
    - [Insider Threat Intelligence Solutions](https://nisos.com/services/insider-threat-intelligence-solutions/)
- [Risk Assessments](https://www.nisos.com/services/risk-assessments/) 
    - [Threat Landscape Assessment](https://nisos.com/services/threat-landscape-assessment/)
- [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) 
    - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/)
    - [Executive Shield](https://www.nisos.com/services/executive-shield/)
- [Investigations](https://www.nisos.com/services/investigations/) 
    - [Adversary Insights® Investigation](https://www.nisos.com/services/adversary-insights/)
    - [Event-Driven Intel Investigation](https://www.nisos.com/services/event-driven-investigation/)

- Why Nisos 
    - [About Us](https://nisos.com/company/about-us/)
    - [Client Success](https://nisos.com/company/client-success/)
    - [Our Approach](https://nisos.com/company/our-approach/)
    - [The Dogpile](https://www.nisos.com/the-dogpile/)
    - [Team Pandion™](https://www.nisos.com/company/team-pandion/)
    - [Careers](https://www.nisos.com/company/about-the-company/careers/)

- Resources 
    - [Blog](https://www.nisos.com/nisos-blog/)
    - [Resource Library](https://nisos.com/resources/library/)
    - [Podcast](https://www.nisos.com/podcasts/)
    - [News](https://www.nisos.com/news/)
    - [Events](https://nisos.com/events/)
    - [Law Firms](https://nisos.com/law-firms/)
    - [Federal](https://nisos.com/federal/)
    - [Media Inquiries](https://nisos.com/company/about-us/media-support/)

**Contact**  
[info@nisos.com](mailto:info@nisos.com)  
tel: [703-382-8400](tel:7033828400)  
2101 Wilson Blvd. Suite 304  
Arlington, VA 22201

<https://twitter.com/nisos>

<https://www.linkedin.com/company/nisos/>

<https://www.facebook.com/nisos.managed.intelligence/>

<https://www.instagram.com/nisos.managed.intelligence/>

![Nisos](https://blog.nisos.com/hs-fs/hubfs/Nisos_July2023/images/NISOS_logo_high_res_vert_white@2x.png?width=320&name=NISOS_logo_high_res_vert_white@2x.png "Nisos")

[Terms and Conditions](https://www.nisos.com/terms-conditions/) [Cookie Policy](https://www.nisos.com/cookie-policy/) [Privacy Policy](https://www.nisos.com/privacy-policy/)

©2025 Nisos All Rights Reserved

![](https://px.ads.linkedin.com/collect/?pid=1593266&fmt=gif)