Threat Intelligence for Small Teams
Earlier in this series
"Threat intelligence" is one of those phrases that makes small organizations feel behind. Clients ask me about it apologetically, as if not subscribing to feeds were a hygiene failure, like not patching.
Let me remove the guilt first. Most of what is sold as threat intelligence is useless to a small team — not because it is false, but because it cannot change anything you do. And the part that is useful is mostly free, mostly boring, and needs about thirty minutes a week.
I say this from both sides. In a telecom SOC, I worked where threat information actually got consumed at scale — fed into detections, matched against real telemetry. As a consultant to small and mid-sized organizations since, I have watched teams with no security staff drown in the same information that the telecom could digest. The difference was never access to intelligence. It was the machinery to act on it.
The only test that matters
Here is the definition I use with clients: intelligence is information that changes a decision. Everything else is news.
"Ransomware groups are increasingly targeting mid-sized companies" changes nothing. You knew to worry. "A vulnerability in the VPN appliance you run is being actively exploited, patch now" changes your afternoon. Same genre, opposite value.
So the filter for any source, feed, or report is one question: what would we do differently because of this? If the answer is "nothing, but now we're informed," you are consuming security news. News is fine — I read it too — but it should cost you minutes, not budget, and it should never be mistaken for a capability.
Why IOC feeds fail small teams
The classic starter purchase is a feed of indicators of compromise — malicious IPs, domains, file hashes. For a small team, this is almost always the wrong first move, for a mechanical reason.
An indicator is only worth something if you can match it against your own telemetry, automatically, and act on hits. That assumes centralized logs, a matching pipeline, and a human who investigates the matches — the machinery I described the telecom having in SIEM Deployment Lessons from Two Very Different Organizations. Without that machinery, a feed is a river flowing past a house with no waterwheel. And even with the machinery, raw indicator matching is noisy work; in the SOC I saw how much tuning stood between a feed and a trustworthy alert — the same discipline problem I wrote about in SOC Analyst Diary: What Detection Engineering Really Looks Like.
Buy the waterwheel before the river. For most small teams, the honest answer is: not yet, possibly never.
What is actually actionable with no TI team
The intelligence a small organization can use maps to decisions it can actually make: patch something, change a configuration, warn people, or check the logs. Four sources cover most of that, and as of this writing, all are free or nearly so.
1. Vendor advisories for the things you run. The single highest-value source, and the least glamorous. Subscribe to the security notifications for your actual stack — your firewall, your VPN, your OS, your cloud provider, your critical SaaS. This is intelligence pre-filtered by relevance: it is about your assets by construction. It only works if you know what you run, which is why I keep saying the inventory comes first — the same spreadsheet-grade inventory I have pushed since my startup days.
2. Known-exploited-vulnerability catalogs. Several national cyber agencies publish lists of vulnerabilities confirmed to be exploited in the wild. These lists answer the question that generic severity scores cannot: not "how bad could this be," but "is anyone actually using it." Cross-referencing a catalog like that against your inventory is the closest thing to a free prioritization engine that exists. If it is on the list and in your stack, it goes to the front of the patch queue. That one habit outperforms any feed subscription I have seen a small team buy.
3. Your national CERT and your sector's sharing community. Most countries have a national CERT issuing advisories, and many sectors have information-sharing groups. Their output is regionalized and sectorized — filtered toward threats that actually reach organizations like yours. Signal-to-noise varies, but the price is right and the relevance filter is built in.
4. Your own logs. Unfashionable but true: the most relevant threat intelligence you own is what is already hitting you. Which accounts get password-sprayed. Which phishing themes actually land in your inboxes. What probes your perimeter. A monthly hour reading your own authentication failures and mail filters tells you more about your threat model than any vendor report about threat actors you will never meet.
The thirty-minute routine
Here is the whole program I set up for clients without a security function. Weekly, one owner, timeboxed:
- Read the advisories that arrived from your vendors, CERT, and the exploited-vulnerabilities catalog. (10 minutes)
- For each item, apply the one test: does this touch anything on our inventory? Discard everything that does not. (5 minutes)
- For each hit, open a ticket in the normal tracker — patch, reconfigure, investigate, or warn staff — with an owner and a date. (10 minutes)
- Note anything recurring in your own logs or inboxes worth a closer look this month. (5 minutes)
That is it. No platform, no subscription. The output is tickets, not briefings — because for a small team, intelligence that does not end in a ticket did not happen.
What to ignore without guilt
Glossy annual threat reports: fine as background reading, irrelevant as inputs. Attribution drama — which group, which country: operationally meaningless for you; you defend the same way regardless of who is attacking. Real-time feeds you lack the machinery to match. Dark-web monitoring subscriptions before basic patching is under control. And any product whose pitch is fear plus a dashboard, where the dashboard does not end in an action you can take.
None of this is a criticism of the intelligence industry. At telecom scale, with pipelines and analysts, much of it earns its keep. Value depends on the consumer's machinery, and small teams should size their intake to their machinery honestly.
The quiet payoff
Do the boring version for a year and something changes: decisions stop being ambient anxiety and start being triage. You stop asking "should we be worried?" — an unanswerable question — and start asking "is it in our stack, is it exploited, who owns the ticket?"
That shift, not the feeds, is the actual capability called threat intelligence. Small teams can afford it. Most just haven't been told how little it costs.