CTI Providers: How to Compare Feeds, Platforms, and Services

CTI providers do not form one interchangeable product category. One sells machine-readable indicators. Another publishes finished research. A third provides a portal and analyst access. A platform vendor supplies software for managing threat knowledge. A managed service performs agreed intelligence work. Comparing all of them on one feature checklist produces a confident-looking but invalid decision.

Start with the decision or workflow that needs improvement, then select the provider category capable of changing it. Only after that should you compare candidates. This guide is the category-selection and procurement layer; use the linked deep guides to evaluate an individual feed, platform, or managed service.

The objective is not to find the provider with the most data, reports, integrations, or famous customers. It is to obtain a defensible capability that fits your requirements, evidence standards, operating model, sharing obligations, risk tolerance, and total cost—and that can be measured and replaced.

Start With Decisions, Not a Vendor List

Name the consumer, decision, time window, information gap, required confidence, delivery point, and consequence of being wrong or late. “Improve threat intelligence” is not a requirement. “Give the detection team weekly evidence-backed changes for techniques used against our exposed identity services” is testable.

NIST SP 800-150 recommends establishing information-sharing goals, identifying sources, defining scope and rules, joining appropriate communities, and using received information effectively. Translate those ideas into provider requirements: who will use the output, what may be shared, what evidence must accompany it, and which action should improve.

Record the baseline before procurement. Measure current discovery time, useful coverage, false escalation, analyst hours, integration failures, stakeholder wait time, and unresolved gaps. Without a baseline, a trial can demonstrate activity but not improvement.

Distinguish the Six Provider Categories

Most offerings contain one or more of these capabilities:

• Data or feeds: indicators, vulnerabilities, infrastructure, malware, telemetry, observations, scores, or enrichment delivered by API, TAXII, file, or integration.
• Research and publications: finished reports, alerts, actor and campaign tracking, forecasts, sector analysis, and executive products.
• Portal and analyst access: search, dashboards, collections, requests for information, briefings, and direct access to provider analysts.
• Threat intelligence platforms: software that ingests, normalizes, relates, governs, analyzes, and distributes threat knowledge.
• Specialist services: threat hunting, investigations, digital risk, dark-web monitoring, malware analysis, geopolitical analysis, or incident support.
• Managed CTI: recurring delivery in which provider people, process, sources, and technology perform an agreed service.

Bundles can cross categories. Decompose them anyway. A bundled feed may be excellent while the platform workflow is weak; a polished portal may hide limited export rights; a managed service may depend on sources that disappear when the contract ends.

Build a Requirement Matrix That Prevents Category Errors

For each priority use case, document inputs, output, recipient, cadence, latency, geography, language, sectors, threat types, evidence depth, confidence, handling, integration, retention, and service hours. Mark each requirement mandatory, scored, or informative. A mandatory requirement should have a pass/fail test and an accountable owner.

Add nonfunctional needs: availability, authentication, access control, audit, data location, privacy, incident notification, support, export, deletion, financial stability, and transition. Identify constraints the provider cannot change, such as a regulator, data residency rule, prohibited source method, or downstream system.

Separate selection criteria from discovery questions. “Has an API” is too vague; “retrieve updated and revoked records incrementally, preserve provenance, and reconcile after a 24-hour outage” can be demonstrated. Weight criteria before seeing proposals so attractive demonstrations do not rewrite the decision.

Test Coverage as Access, Not Marketing Geography

Coverage claims should identify collection access, source dependence, observation location, language, sector, threat type, historical depth, update cadence, and gaps. Ask which data is collected directly, licensed, shared by partners, derived, purchased through another aggregator, or inferred. Two candidates may resell the same upstream source while appearing independent.

Use representative entities, events, and quiet periods from your requirements. Measure relevant unique findings, unsupported noise, time advantage, overlap with the baseline, and coverage that remains useful after verification. Rare examples selected by sales teams do not establish systematic coverage.

Do not reward volume automatically. A million low-context indicators can create more review and blocking risk than a smaller set connected to behaviors, victims, time, source, and confidence. The commercial feed evaluation guide provides the detailed parallel-trial method for data products.

Examine Provenance, Confidence, Time, and Corrections

Select records and reports across several product lines, then trace each claim. Look for original source or collection description, observation and publication time, transformations, analyst judgment, corroboration, confidence basis, limitations, handling, version history, and correction or revocation behavior.

Ask how the provider distinguishes an observation from an assessment and how confidence maps to evidence. Test contested cases. Can an analyst explain why an entity is associated with an actor? Can the provider correct a relationship without silently erasing history? Do machine-readable records retain the same meaning shown in the portal?

Freshness is contextual. Infrastructure can change control quickly; a strategic assessment may remain useful for months. Require lifecycle behavior appropriate to the claim, including expiry, review, supersession, and downstream notification. Provider quality includes how transparently it says “unknown,” not only how often it supplies an answer.

Validate Delivery, Integration, and Data Semantics

Test the actual API, TAXII collections, files, portal exports, email, tickets, briefings, and downstream integrations included in the proposed tier. Review authentication, pagination, rate limits, schemas, identifiers, timestamps, markings, retries, errors, health monitoring, backward compatibility, and change notice.

A connector proves transport, not semantic fit. Confirm how provider confidence, severity, relationships, lifecycle states, and handling rules map into your systems. Test updates, duplicates, revocations, partial failures, and restoration after an outage. Assign an owner for every integration and a procedure for source changes.

If a platform is the actual need, use the cyber threat intelligence platform selection guide to evaluate data model, workflow, governance, administration, and exit. Do not purchase a platform merely to compensate for an undefined intelligence process.

Evaluate Analyst Access and the Responsibility Boundary

Meet the analysts and service personnel who will deliver the contract. Test a representative request for information, a disputed assessment, an urgent event, and a request outside scope. Assess domain knowledge, reasoning transparency, writing, response, local context, escalation, and willingness to correct.

For recurring services, map who sets requirements, supplies internal context, accesses telemetry, analyzes, reviews, disseminates, receives feedback, makes risk decisions, and approves sharing. Retain an internal owner with authority and time. A provider can operate a service but cannot inherit accountability for your organization’s priorities and risk decisions.

The managed CTI services guide covers retain, co-source, and outsource decisions in detail. Use it after the category decision shows that external delivery—not merely data or software—is required.

Review Sharing, Privacy, Security, and Supplier Risk

Determine what your organization will send to the provider: requirements, identities, assets, telemetry, incidents, malware, customer information, vulnerabilities, or investigative context. Minimize it, classify it, and map where it is processed, retained, backed up, accessed, supported, and deleted. Review subprocessors and cross-border transfers with the appropriate legal, privacy, procurement, and security owners.

FIRST’s current Traffic Light Protocol defines sharing boundaries for sensitive information, but FIRST explicitly notes that TLP is not a licensing scheme, encryption rule, or general handling instruction. Contracts and technical controls must cover those separate obligations.

Apply supplier due diligence proportionately. NIST SP 1326 describes ICT supplier due-diligence elements including provenance, foreign ownership or control considerations, supply-chain tiers, foundational cybersecurity practices, and product or service resilience. Also test breach notification, vulnerability management, access controls, audit evidence, continuity, dependency concentration, and secure termination.

Run a Controlled Trial Against the Baseline

Give every shortlisted provider the same sanitized requirements, scenarios, time window, expected outputs, and scoring rules. Include both known cases and events whose answer is not known in advance. Keep evaluators blind to brand where practical. Record missing data and unsupported claims rather than filling gaps with assumptions.

Measure relevance, unique contribution, timeliness, evidence quality, false escalation, workflow time, integration effort, analyst interaction, correction behavior, stakeholder use, and outcome. Include the labor required to validate, normalize, tune, administer, and distribute the product. Compare performance with the existing baseline and with a simpler alternative.

Test failure deliberately: stale data, revoked indicator, API outage, schema change, urgent request, incorrect association, permission restriction, and export. A provider that performs well only during the curated demonstration has not passed an operational trial.

Price the Service and Contract for Exit

Price more than the subscription. Include implementation, connectors, storage, API and query tiers, premium datasets, analyst seats, training, validation, tuning, administration, legal review, security assurance, internal service ownership, travel, currency, renewal uplift, migration, and exit. Record which costs scale with users, data, requests, incidents, or retention.

Bundles can hide cross-subsidy. Ask for separable prices and responsibilities so a weak component can be removed without rebuilding the whole service. Compare the cost of doing nothing and the cost of a smaller intervention. A process correction, community relationship, targeted specialist engagement, or existing-tool improvement may solve the requirement.

For an additional provider, measure marginal value after overlap and operating effort. Count genuinely useful unique contribution, not the number of records that differ syntactically. More providers can reduce concentration risk, but they can also multiply reconciliation, licensing, integration, and governance work.

Put operational promises into the agreement or referenced service description. Define scope, delivery, availability, support, analyst access, response and correction times, change notice, source discontinuation, security evidence, incident notification, audit, business continuity, and named escalation paths.

Clarify ownership and permitted use of raw data, reports, annotations, enrichment, detections, derived analysis, cached records, and products shared with affiliates, customers, partners, or communities. State retention after termination and what must be returned or deleted. Do not assume a TLP marking grants a contractual right to reuse content.

Require usable exports, documentation, transition assistance, credential revocation, deletion confirmation, and a reasonable period for migration. Test export before signature. A theoretical exit right is weak if relationships, provenance, analyst notes, cases, and history cannot move with their meaning intact.

Score the Evidence and Make the Decision Auditable

Use a scorecard with mandatory gates and weighted criteria. Useful groups are requirement fit, coverage, evidence quality, timeliness, delivery, integration, analyst service, security and privacy, supplier resilience, contract fit, operating cost, and exit. Attach trial artifacts to each score and record uncertainty.

Reject candidates that fail a true mandatory gate even when their weighted total is high. Review correlated dependencies: two providers can rely on the same upstream collection, cloud service, subcontractor, or analyst team. Document conflicts of interest and any exception approved by an accountable owner.

Record the selected capability, alternatives, evidence, assumptions, risks, mitigations, price, owner, success measures, review date, and exit trigger. The decision should remain understandable to someone who did not attend the demonstrations.

Operate the Provider as a Measured Service

Assign a service owner and schedule operational, quality, security, and commercial reviews. Monitor delivery failures, stale sources, schema changes, missing provenance, correction time, analyst response, requirement coverage, unused features, licenses, cost drivers, and stakeholder feedback. Revalidate access and data flows when the service changes.

Measure outcomes tied to the original baseline: faster supported decisions, useful unique discoveries, improved detection or prioritization, reduced analyst effort, shorter investigation time, better warning, or higher consumer use. Pair every metric with context. A rise in delivered indicators may mean broader visibility or simply more noise.

Retire requirements, sources, and integrations that no longer earn their operating cost. Recompete or replace when coverage, quality, risk, support, price, or strategic fit changes. Provider selection is not a permanent endorsement; it is a controlled decision that should keep producing evidence of value.