Why The Same Threat Means Different Things To Different Companies

Anuj Goel is CEO and co-founder of Cyware, a company focused on intelligence-led cybersecurity and operational resilience.

gettyEvery threat intelligence feed shares a blind spot: It knows the threat but nothing about our specific environment.

Feeds identify malicious IPs, malware hashes or live campaigns, but cannot tell if these reach our systems, touch critical identities or expose business dependencies. They describe abstract threats broadcast the same way to every subscriber.

The feed carries threat data; only our environment provides context. The industry has spent a decade refining data when it should have focused on environment-specific context.

As a practitioner, the hardest conversations were never about explaining suspicious activity. They were about explaining why it reached us when the best intelligence available had already flagged it. We had the indicators. We just weren’t connecting them to the assets they might reach. What surprised me then, and still does, is that the problem was never a shortage of intelligence or its accuracy. It was the missing step between knowing about a threat and knowing, in real time, that it applied to us. That experience shaped how I think about this space, and it is why I believe context, not volume, is where the real work is.

Intelligence has no universal version; “good intelligence” depends on sector and geography, not sheer volume.

Financial institutions require fraud-focused reporting, while industrial operators need OT intelligence built around controllers and plant-floor realities. Neither is “better,” but they aren’t interchangeable. Relevance is inherently specific to who we are and where we operate.

No feed can see inside our walls, and that’s where we decide which known threats matter to our environment.

Relevance is derived from the assets we actually run. The identities and access paths that connect them. What is business-critical versus incidental? Where our controls are strong and where they are thin. This is the ground truth every external indicator has to be measured against. An indicator evaluated against our environment becomes elevated to a prioritized, actionable risk. The same indicator, without an environment behind it, is just a rumor about someone else’s network.

Relevance is the product of the two: the intelligence our sector trusts, correlated with the infrastructure, data and assets we have. Neither input alone produces it. The best feeds in the world, unmeasured against our environment, cannot tell us what to do first on Monday morning. A perfect map of our environment, with no sector intelligence flowing into it, has nothing to act on either.

Consider when identical intelligence arrives at two different organizations.

For one, the indicator maps to a critical, internet-facing application reachable by elevated identities. This context resolves to a high-urgency risk, requiring immediate isolation and escalation.

For the second, the same indicator maps to a decommissioned service or a segment with existing controls. This context resolves to a low-urgency risk requiring only logging.

Same feed. Same indicator. Same morning. Two entirely different answers, and two entirely different actions determined by adding the context.

This is what customer-specific context means in practice. It is not a cleaner presentation of the same data. It is a different computed result for every organization, because the inputs on the other side of the equation differ for every organization. It determines not only whether to act, but what action is warranted, in what order and with how much confidence. Any system that skips this step applies one global severity score to environments that share almost nothing in common.

One line is worth drawing sharply, because the industry constantly blurs it. Tagging an indicator as malicious is enrichment, attaching a known attribute to a piece of data. Knowing that the same indicator belongs to a campaign actively targeting our sector, that a machine on our finance team touched it three days ago and that the identity behind that machine is exposed, that is context. Enrichment adds metadata. Context fuels risk reduction.

This is also why dozens of feeds never added up to an answer. More raw indicators, unmeasured against our environment, is a larger pile to triage, not a clearer picture. Most security leaders have a graveyard of unused subscriptions to prove it.

Increasingly, the systems making security decisions are not human analysts reading a feed. They are platforms and agents consuming intelligence to prioritize, correlate and act, and a decision engine is only as good as what we put into it.

Feed a system raw, one-size-fits-all intelligence and it inherits the problem we started with: It cannot tell a live risk from an irrelevant one, because the feed never carried that distinction. The input has to be measured against that specific environment, already resolved into what is relevant, exposed and worth acting on.

This reframes what “having threat intelligence” should mean. A feed is not the same as threat context, and a raw feed piped into a decision-making tool does not become context on arrival. Intelligence has to be made relevant before it becomes an input, per sector, per environment, per organization or every tool consuming it is reasoning from a rumor.

We don’t subscribe to relevance. It is something produced: the intelligence our sector trusts, measured continuously against the environment only we can see and resolved into an answer before we hand it to anyone, or anything, that has to act on it.

The organizations—and increasingly, the systems—best positioned for what is coming are not the ones holding the most feeds. Instead, the organizations receiving actionable context are those that understand what threat intelligence means for them and are equipped to drive necessary security actions.​​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?