Half your health-sector ISAC cannot consume a TAXII feed at all. How do you make sharing produce value?

## The problem is not the format A sector ISAC has members separated by two orders of magnitude in capability. One member has a threat-intel team, an OpenCTI instance and connectors; another has one IT manager who also owns printers, and whose mail security is operated by a regional managed provider. Publishing STIX over TAXII and declaring the job done means roughly half the community receives nothing usable, while the same half is the part of the sector an adversary reusing one phishing kit will actually land in. A business-email-compromise crew works a sector precisely because the small members share suppliers, billing intermediaries and staff with the large ones. ## Two tracks, published on purpose **Machine track.** A TAXII collection or MISP feed carrying properly modelled STIX: indicators with patterns and expiry, related to a malware or infrastructure object so the receiving analyst knows why the value is there, marked object by object. Members with platforms want relationships and stable ids so their own graph accumulates. **Human track.** A short note, in the format the recipient can act on today: what is happening in one paragraph, five or ten values worth blocking, the specific action ("block these sender domains; search consent grants for these application identifiers; enforce this setting"), and who to contact. Send it as mail, not as a portal login they will not use. Where a member is served by a managed provider, get the provider into the community as a member in their own right; that single move often does more for the small-member half than any format decision, because it puts the content where the controls actually are. A third track worth funding if the community can: a shared blocklist the small members' providers can subscribe to directly, so consumption requires no human at all. ## The two failure modes that kill communities quietly **Over-marking.** When the default handling is TLP:RED, nothing can be operationalised and the feed becomes theatre. Push the default to AMBER or GREEN, reserve RED for content that identifies a victim, and offer an **anonymised submission route** through the coordinator so a member can report being targeted without admitting it in their own name. The single largest brake on sector sharing is not tooling; it is that a member fears the submission becomes a disclosure story. **Measuring output instead of effect.** Object counts and feed volumes are the metrics that get reported and the ones that mean least. Better questions: how many members applied something in the last quarter; how long between a submission and the first other member confirming a sighting; did a small member's report give a large member early warning. A community that published 40,000 objects and changed nobody's controls has failed, and the metric will not say so. ## Asymmetric contribution is fine, and worth saying out loud Large members occasionally resent that small members mostly consume. Frame the exchange honestly: the sector's risk is shared through shared suppliers and shared staff mobility, so raising the weakest members' floor is the large member's own control. In return, the small members' submissions have a property the large ones' do not — they are often the first sighting, because they are hit first and have no filtering layer to absorb it. ## Enforcement without a chilling effect Communities do need consequences for handling violations, up to suspending an organisation's sharing privileges. The tension is real: heavy enforcement makes everyone over-mark and submit less, which is the same damage arriving by a different road. A workable balance is a documented process, proportionate first response focused on the mechanism that failed rather than the individual, and transparency to the membership about what happened — because the members' confidence depends on believing violations are handled, not on believing they never occur. ## What to say when asked to justify the spend The honest case is not "we ingested N indicators". It is that the community produced early warning a member acted on before the campaign reached them, and that the sector's smallest members — the ones with no detection capability of their own — received an action they could take. If neither of those is true after a year, the format was never the problem.