Your threat-feed renewal costs the same as twenty EDR seats - how do you make the call?

## The decision, stated honestly A feed renewal in a small security team is not a procurement question, it is an allocation question: this money is already committed to something else - endpoint coverage, a log source you are not collecting, an analyst's hours. So the case has to be made in the currency of what is given up, and the vendor's ten-million-indicator headline is not in that currency at all. ## What you bring into the room **The funnel.** Over a fixed window: delivered, unique to this source, unique and matched against your telemetry, matched and acted on. The last number is usually small and sometimes one, and stating it before the vendor does is what makes the rest of your argument credible. **The lead-time distribution.** Not against other vendors, against your own exposure. "On the artefacts several sources carried, this one was first by a median of a few hours, and on one occasion it carried a credential-harvesting landing domain before the first message reached a mailbox" is a specific, checkable claim. **The named cases.** One or two investigations, with timelines, where the verdict came out differently. This is the part everyone remembers, and it is also the part you must be most careful with - it is an anecdote, and if you present it as a rate you will be caught. **The counterfactual.** What would the same money buy? Endpoint or identity telemetry is an asset you keep: it produces detections you write, it supports hunts and it survives the vendor. A feed is a subscription to someone else's collection whose contents are stale within weeks and whose value ends with the contract. That asymmetry is the strongest structural argument, and it usually matters more than the funnel numbers. ## Reading the vendor's pitch Volume claims (indicator counts, sources monitored, languages covered) are inputs the vendor controls and cannot be verified from outside. What you can ask for is: which collections are original rather than aggregated; the price of the original slice on its own; a scoped trial where *you* run the overlap harness; and reference customers with an estate shaped like yours. A vendor who will not price a collection separately is telling you the bulk is where the margin is. ## The options, not two but four - **Renew as-is.** Justified when the funnel shows repeated matches, not one, and the lead time lands inside your exposure window. - **Halve it.** The common right answer: keep the one collection that produced the unique, matched indicators; drop the aggregated remainder that duplicates free sources. This is where the measurement pays for itself. - **Change the tier.** Sometimes the value is real but the delivery is wrong - an API or streaming tier for a fast-moving artefact class costs less than the full platform, and matches how you actually consume it. - **Cancel.** Justified when unique-and-matched is zero across a long window and the collection does not plausibly cover threats that reach you. ## The arguments against your own recommendation A principal-level answer names these before someone else does. - **Small-sample honesty.** Ninety days in a small estate may simply not contain the rare event the feed exists to catch. Absence of matches is weak evidence, and a longer window or a wider replay against stored telemetry strengthens it. - **You lose the counterfactual.** Once cancelled, you cannot measure what you would have caught. Keeping a minimal tier purely to preserve the comparison is sometimes worth it, and sometimes an expensive way to avoid a decision. - **Asymmetric loss.** One missed adversary-in-the-middle session theft in an identity-and-SaaS estate can cost far more in response hours than the subscription. If the feed's collection is genuinely aimed at that class of activity, a low match count is not automatically a cancel. - **The team's capacity.** A feed you have no one to operate - nobody normalising it, nobody wiring the matches into the alert record - will produce nothing whatever its quality. Buying intelligence you cannot deliver into a chair is the most expensive way to have none. ## Handling the vendor conversation Give them the funnel and the window, and invite them to dispute the method rather than the conclusion; a good account manager will point out real flaws, such as collections you never ingested or matching you only ran against fired alerts. Offer the halved contract as your opening rather than a cancellation threat, because you probably do want the one collection that worked. And put a review date in the calendar with the harness still running, so the next renewal is decided on twelve months of data rather than on whoever argues best in the room. ## What separates a good answer Not the decision - either way can be right. It is refusing to launder an anecdote into a metric, naming what the money is being taken from, and knowing that an artefact list is a rented asset while telemetry is an owned one.