When it comes to selecting an external threat intelligence tool or managed service, “plenty of fish in the sea” is an understatement. The incredible variation in provider size, geography, vertical market focus, and most importantly, capability, is dizzying. In the vast ocean of Threat Intelligence and Digital Risk Protection providers, how is one supposed to choose?

Thankfully, Forrester has just published their latest research into the Threat Intelligence Market: Now Tech: External Threat Intelligence Services, Q4 2020. This research provides an overview of 30 external threat intelligence (TI) providers to understand their value. Here are some of our key takeaways:

Prioritize brand-focused and vulnerability intelligence

 In the Now Tech report, Forrester splits the market into three TI functionality segments:

  • Brand-focused intelligence (i.e. leaked credentials, data loss, typosquat domains, phishing sites, stolen payment cards, counterfeit products, fake social media profiles)
  • Vulnerability intelligence (i.e. software vulnerabilities)
  • Cyber threat intelligence (i.e. intelligence on cyberthreats, campaigns, and capabilities)

Forrester recommends not only evaluating vendors by the three segments, but also focusing on where intelligence can be the most applied or actionable in protecting your communities.

You’ll notice brand-focused and vulnerability intelligence are concerned with informed action on risk. In other words, transforming reactive teams into proactive risk advisors and facilitating timely successful takedowns. On the other hand, cyber threat intelligence is concerned with informed awareness of the wider threat landscape for your specific organization, geography, and industry vertical.

While cyber threat intelligence is an important component to have in your security toolbox, the most highlighted concern of Digital Shadows (now ReliaQuest) clients are tactical things like detecting an unauthorized code commit or launching a takedown of an impersonator website. These are all use cases which fall under brand protection, data loss detection, and attack surface reduction– which brings us to the second takeaway…

Question the use-cases for your organization

TI has plenty of buzzwords, and security professionals can get caught up in the smoke and mirrors of the latest descriptive jargon and product hype. To get to the core of each threat intelligence organization, focus on the use cases of each tool.

Security professionals should ensure the provider aligns with their use cases, and that it is likely to reduce the risk of the company and the communities they support (i.e. customers, users, employees, etc). This could be asking the vendor if they have coverage of all critical assets to your organization— from exposed documents, both marked and unmarked, to coverage of dark web forums in multiple languages.

The Forrester report additionally evaluates capability, mentioning:

  • For brand-focused intelligence… the timeliness and success of takedowns
  • For vulnerability intelligence… vulnerability discovery and risk assessment measures

Aside from these de-facto measures, you may want to consider a managed service which resolves low-severity discoveries automatically or filters out the false positives from threat intelligence feeds. But security and threat intelligence are often overwhelmed with the time-consuming tasks such as discovering leaked employee or customer credentials. Digital Risk Protection tools such as SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) provides human analysts as an extension to your team, and further eases the triage burden with automated triage options.

Plan on incorporating threat intelligence into a wider team

Threat Intelligence should now be incorporated as part of a business’ overall risk management program. There are now more stakeholders than the security team— with executives who may be targeted for impersonation, brand teams concerned with fake social media profiles, or legal teams concerned with document loss.

We frequently hear from clients that they’d like to have departments outside of security operations be alerted to potential exposures. Adopting a tool that allows for many user accounts, activity feeds to stay up to date on takedown statuses, and custom email notifications, so the brand will only receive high-severity brand protection-related alerts can drive risk management into other departments while not contributing to employee overwhelm.

Want to see what SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) has to offer? Take a test drive of the software here.