Threat Intelligence & OSINT

Bring the measured funnel - unique, matched, acted on - and the verdicts that came out differently, then weigh them against what the same money buys in telemetry you own. Halving to the collection that worked is often the right answer.

A written, counsel-approved collection policy: never authenticate to systems you do not own, never buy stolen data, never fund a sanctioned party, and use an invented identity on infrastructure and funding that do not trace back to the company.

Work backwards from the decisions on that person's calendar, draft a small ranked set of requirements naming each decision and its date, and make them cut it down. Priority comes from their competing decisions, not from analyst interest.

Correct it with at least the reach of the original claim, and be precise: the shared indicators still stand, the linkage does not. Then fix what let a merge built on commodity overlap be published.

Stop counting products and start tracking decisions. Every product should name one action with an owner and a date, and you should go back and record whether it was taken, refused or deferred. A recorded refusal is a real outcome; silence is the failure.

Publish on two tracks: machine-readable STIX for members with platforms, and a short note naming a few blockable values and one action for members without. Measure actions taken, not objects published, and keep default markings loose enough that members still submit.