The much anticipated State of Threat Intelligence report has just been published. The State of Threat Intelligence report is based on a survey Recorded Future conducted with UserEvidence of 768 cybersecurity professionals at enterprises with at least 1,000 employees. It’s the latest edition in our annual report series, where we gauge how threat intelligence is currently being used, funded, and measured. When I first saw the results of this year’s survey, a few findings stood out to me as especially relevant for anyone who runs, funds, or relies on a threat intelligence program and is planning for the year ahead. Here are my top five findings and why.
1. Cost is the least common reason to consolidate
A strong majority of respondents (79%) said they plan to consolidate threat intelligence vendors in the next year. That alone is no huge surprise, especially given that respondents reported using an average of five different vendors. Cost would be a reasonable guess for why, but reducing costs actually ranked last of five drivers, at 5%.
The drivers that ranked higher point to what teams want from consolidation:
- Improving correlation across signals (34%): connecting intelligence across threat domains and internal telemetry into one view of risk.
- Bringing siloed tools together (29%): ensuring different risk owners can efficiently act on intelligence.
- Simplifying operations (22%): fewer interfaces and handoffs so teams can act on intelligence sooner.
- Reducing vendor-management overhead (9%): fewer vendors to evaluate and renew.
Overall investment is still rising: 83% plan to increase threat intelligence spending in the next 12 months. Teams are consolidating to get better results from their intelligence, not to cut spend.
That puts the focus on outcomes. Jason Steer, CISO at Recorded Future, framed the risk well: consolidation only counts “if that provider has the same or better outcomes.” For anyone evaluating vendors this year, that’s the bar to consider.
Especially as teams expand the reach of their threat intelligence programs and support more stakeholders across the enterprise, they’re pursuing vendors that provide coverage across the risk domains that matter for those teams, but equally important that friction is not created in that pursuit of breadth, and that the organization is able to see how threats across disparate domains actually connect.
2. Only 25% have external intelligence and internal telemetry in one place
Correlation is the top consolidation driver, yet only a quarter of respondents say external intelligence and internal telemetry reside in one place. The rest break down as follows:
- 52% are partially integrated across some tools.
- 18% rely on manual correlation by analysts.
- 5% keep the two in separate workflows.
Poor integration with existing tools and workflows was also the most-cited pain point with current vendors.
This doesn’t mean every team needs to move everything into a single tool. What often matters is whether external intelligence can be correlated with internal signals across the tools a team already uses, without an analyst doing it by hand. Collective Insights® is built for this: it pulls detections from a team’s existing security tools and enriches them with Recorded Future intelligence.
For the 70% who are partially integrated or correlating manually, it’s worth identifying where that manual handoff still happens.
3. Confidence in ROI is high, but few measure cost savings
Nearly every respondent (99%) formally measures the value of their threat intelligence program, and 57% say they are very confident in their ability to quantify its ROI. But when asked how they measure value, more than half (58%) of that very confident group did not include cost savings. Across all respondents, 39% measure cost savings, and 31% measure whether triggered actions actually worked.
The most common metrics are operational:
- Enhanced threat detection rates: 60%
- Improved response times: 59%
- Fewer incidents: 57%
Those matter to security teams, but ultimately fail to communicate the bottom-line impact of your threat intelligence program to the business. The Impact & Metrics dashboard in the Recorded Future platform helps here by showing the hours and dollars saved through use of the platform.
4. About one in four have already closed the loop
Closing that measurement gap depends on connecting intelligence to outcomes. That is what closed-loop operationalization does: intelligence is automatically shared with the relevant stakeholders, they take action based on it, and the efficacy of that action is validated and used to inform what intelligence is collected and shared with these teams.
Closed-loop programs can answer the questions stakeholders outside security ask: did the intelligence drive an action, and did that action work? Answering those questions also requires a clear definition of what intelligence should achieve. Most programs have that starting point: 68% say formally documented, regularly reviewed Priority Intelligence Requirements (PIRs) govern their program.
For teams building next year’s measurement plan, PIRs set the benchmark, and closed-loop validation should be the goal for how outcomes get measured against it.
5. Threat intelligence is now an input to AI, not only a beneficiary of it
98% of respondents use AI in their threat intelligence work. Less discussed is the other direction: 74% say threat intelligence already feeds their organization’s AI or automation initiatives.
- 44% describe this as established, with intelligence regularly feeding one or more AI or automation workflows.
- 30% describe it as advanced, with structured intelligence as a core input across their AI and agentic systems.
- Only 4% don’t use threat intelligence to support AI at all.
Across all of the tasks where we assessed comfort with AI autonomy (summarization, alert triage, enrichment, false-positive reduction, detection rule generation, prioritization, and enforcement actions), at least 92% of respondents are comfortable giving AI some role. That makes the earlier findings more pressing. AI workflows inherit whatever gaps exist in the intelligence they draw on, including signals that aren’t correlated and actions that aren’t validated.
Looking ahead
Taken together, these findings describe programs that are still investing. Their focus is on connecting intelligence, proving its value, and extending it into new workflows, including AI. Most are partway through that work, and some are further along than expected.
The full 2027 State of Threat Intelligence report covers each of these areas in more depth. That includes which teams beyond the SOC rely on threat intelligence and how comfortable organizations are giving AI autonomy. Download the report.
Source: RecordedFuture
Source Link: https://www.recordedfuture.com/blog/state-of-threat-intelligence-2027