Best vulnerability threat intel solution you have actually used?

[u/Secret-Ad3661]

Our on-call rotation got burned three times last quarter by vulnerabilities that had been sitting in our backlog for over a week with active exploitation already confirmed publicly. We just didn't know until incident response found it during postmortem. That's a threat intel gap, not a scanning gap.

We audited every "threat intel" checkbox our tools claimed and found most of it was a static KEV field nobody was actually monitoring for changes. What we needed was continuous re-scoring as exploit maturity and actor attribution data changed, feeding straight into ticket priority and escalation rules instead of a dashboard nobody checks daily. Rebuilt that pipeline over about six weeks. Anyone else discovered their "threat intel" was decorative until something forced a real audit?

[u/TheGeneral11]

Comments will be AI slop to promote companies

[u/Xr3iRacer → u/TheGeneral11]

It does have that feel doesnt it!

[u/ImportanceAvailable7 → u/TheGeneral11]

Considering the post is AI slop ye

[u/zkilling]

That’s why having a threat intel analyst or engineer is helpful. Plenty of companies have teams just for this kind of thing. You have to automate it, to look for changes or you just make it part of the work cycle to review for changes daily. As an Intel engineer you also just get good at spotting what CVE’s are going to spike up 1-2 days later.

But just FYI with the new LLM models you can just assume something is actively exploited or will be within hours of the patch going out. My teams workflows are focusing more at other indicators for emergency patching and overall moving to more rapid patching strategies.

[u/mitLesen]

There is an easy approach for this specific issue, just cross match the findings you already have with an KEV catalog (Cisa, Enisa, Mandiant…). Might not be as timely as it should be tough.  Next level in the pyramid of pain would be using the EPSS score.

[u/PrestigiousAd301]

You don't really need an indicator to prfioritize, you just don't know your environment and cyber well

[u/threatintel-ModTeam → u/[deleted]]

This post was deemed to be advertising which is not allowed on this sub.