--- title: Six Considerations for Building a Cyber Threat Intelligence Program description: When evaluating cyber threat intelligence programs for enterprise, organizations should consider six critical topics before spending on data. image: https://blog.nisos.com/hubfs/tip2-01.png --- [![NISOS_logo_high_res_horiz-black](https://blog.nisos.com/hs-fs/hubfs/NISOS_logo_high_res_horiz-black.png?width=3357&height=674&name=NISOS_logo_high_res_horiz-black.png "NISOS_logo_high_res_horiz-black")](https://www.nisos.com/) - [Home](https://www.nisos.com/) - Solutions - [Manage Human Risk](https://nisos.com/solutions/human-risk/) - [Protect Online Platforms](https://www.nisos.com/solutions/trust-safety/) - [Manage Cybersecurity Risks](https://www.nisos.com/solutions/cybersecurity/) - [Protect Executives, Assets, and Reputation](https://www.nisos.com/solutions/corporate-security/) - [Secure the Employee Lifecycle](https://nisos.com/solutions/workforce-risk/) - Services - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/executive-shield/) - [Risk Assessment](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape](https://www.nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Investigation](https://www.nisos.com/services/adversary-insights/) - Company - [About Us](https://nisos.com/company/about-us/) - [The Nisos Difference](https://nisos.com/company/the-nisos-difference/) - [Client Success](https://nisos.com/company/client-success/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [News](https://www.nisos.com/newsroom/) - [Blog](https://www.nisos.com/nisos-blog/) - [Events](https://www.nisos.com/events/) - [Resource Library](https://www.nisos.com/resources/library/) - [Podcasts](https://www.nisos.com/podcasts/) - [Contact](https://www.nisos.com/contact/) - [Home](https://www.nisos.com/) - Solutions - [Manage Human Risk](https://nisos.com/solutions/human-risk/) - [Protect Online Platforms](https://www.nisos.com/solutions/trust-safety/) - [Manage Cybersecurity Risks](https://www.nisos.com/solutions/cybersecurity/) - [Protect Executives, Assets, and Reputation](https://www.nisos.com/solutions/corporate-security/) - [Secure the Employee Lifecycle](https://nisos.com/solutions/workforce-risk/) - Services - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/executive-shield/) - [Risk Assessment](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape](https://www.nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Investigation](https://www.nisos.com/services/adversary-insights/) - Company - [About Us](https://nisos.com/company/about-us/) - [The Nisos Difference](https://nisos.com/company/the-nisos-difference/) - [Client Success](https://nisos.com/company/client-success/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [News](https://www.nisos.com/newsroom/) - [Blog](https://www.nisos.com/nisos-blog/) - [Events](https://www.nisos.com/events/) - [Resource Library](https://www.nisos.com/resources/library/) - [Podcasts](https://www.nisos.com/podcasts/) - [Contact](https://www.nisos.com/contact/) # Blog ## Six Considerations for Building a Cyber Threat Intelligence Program by [Landon Winkelvoss](https://blog.nisos.com/blog/author/landon-winkelvoss) | Sep 21, 2020 | [Cybersecurity](https://blog.nisos.com/blog/tag/cybersecurity), [threat intelligence](https://blog.nisos.com/blog/tag/threat-intelligence) When evaluating cyber threat intelligence programs for enterprise, organizations should consider six critical topics before spending on data. It’s natural for an organization to start from one of two places: where they have already been beaten badly enough they need to prioritize threat intelligence (the story-telling approach) or to define the threats targeting their organization and thus go for a more data-driven approach.  Regardless, it’s important to take methodologies from both sides before thinking about large-scale investments in [broader intelligence feeds that can just overwhelm with noise.](https://blog.nisos.com/technical-blogs/firehose_noise_how_we_got_here) **Prioritizing The Spend in Threat Intelligence** Threat intelligence feeds and many tools can create opportunity cost and pain if not integrated or thought through in an intelligent manner. Organizations also need to make decisions between building internally, buying externally, or some combination of both.  Considerations include: - Centralizing intelligence through an open source platform or through a vendor - Getting control of data through applications that push to a SIEM or manage APIs through a Threat Intelligence Platform (TIP), SOAR, or Message Box - Reporting leadership needs from outside experts regarding incidents, TTPs, and actors - [Spending money on insourcing or outsourcing malware analysis and enrichment capabilities that are maybe out-of-band to help insulate or provide source validation for a SOC’s inline tools](https://blog.nisos.com/blog/five_critical_data_source_considerations_external_threat_hunting). - [Evaluating if rulesets over IOCs are more important; or perhaps considering what IOCs they want to deploy](https://blog.nisos.com/technical-blogs/real_cyber_intel_tells_soc_what_security_stack_cannot_detect) - Does the organization have an advanced persistent threat (APT) or crimeware problem? Companies that use credit cards versus companies that fit into the supply chain are going to have very different actors to research. Drilling down further, many organizations start with [ransomware](https://blog.nisos.com/blog/avoiding_ransomware) because it is pervasive across all enterprises and is used by the full spectrum of threat actors from nation states to unsophisticated criminals.  To address this threat, a security team may have to: - Consider writing IPS rules to protect the network - Reduce risk to IOT devices or protocols like RDP and how they access the network - Review proximate threats in the email gateway and determine if it’s being delivered directly in a file or a URL or is a proximate threat delivered through a botnet that will need to be blocked at the firewall (Trickbot and Ryuk).  - Develop and review redundancy backups  - Ensure firewalls between interconnect environments and policies on the endpoint with EDR technology are covered Check out threat researcher Jamie Kane’s analysis on this topic below. --- --- --- - Solutions - [Human Risk](https://nisos.com/solutions/human-risk/) - [Cybersecurity](https://nisos.com/solutions/cybersecurity/) - [Trust and Safety / Platform](https://nisos.com/solutions/trust-safety/) - [Corporate / Physical Security](https://nisos.com/solutions/corporate-security/) - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/insider-threat-intelligence-solutions/) - [Risk Assessments](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape Assessment](https://nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Executive Shield](https://www.nisos.com/services/executive-shield/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Insights® Investigation](https://www.nisos.com/services/adversary-insights/) - [Event-Driven Intel Investigation](https://www.nisos.com/services/event-driven-investigation/) - Why Nisos - [About Us](https://nisos.com/company/about-us/) - [Client Success](https://nisos.com/company/client-success/) - [Our Approach](https://nisos.com/company/our-approach/) - [The Dogpile](https://www.nisos.com/the-dogpile/) - [Team Pandion™](https://www.nisos.com/company/team-pandion/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [Blog](https://www.nisos.com/nisos-blog/) - [Resource Library](https://nisos.com/resources/library/) - [Podcast](https://www.nisos.com/podcasts/) - [News](https://www.nisos.com/news/) - [Events](https://nisos.com/events/) - [Law Firms](https://nisos.com/law-firms/) - [Federal](https://nisos.com/federal/) - [Media Inquiries](https://nisos.com/company/about-us/media-support/) **Contact** [info@nisos.com](mailto:info@nisos.com) tel: [703-382-8400](tel:7033828400) 2101 Wilson Blvd. Suite 304 Arlington, VA 22201 ![Nisos](https://blog.nisos.com/hs-fs/hubfs/Nisos_July2023/images/NISOS_logo_high_res_vert_white@2x.png?width=320&name=NISOS_logo_high_res_vert_white@2x.png "Nisos") [Terms and Conditions](https://www.nisos.com/terms-conditions/) [Cookie Policy](https://www.nisos.com/cookie-policy/) [Privacy Policy](https://www.nisos.com/privacy-policy/) ©2025 Nisos All Rights Reserved ![](https://px.ads.linkedin.com/collect/?pid=1593266&fmt=gif)