The Economics of Cybersecurity Threat Intelligence
X.B. Bouwman (TU Delft - Technology, Policy and Management)
M.J.G. van Eeten – Promotor (TU Delft - Technology, Policy and Management)
A.J. Klievink – Promotor (Universiteit Leiden)
More Info
expand_more
Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.
Abstract
Cybersecurity threat intelligence (CTI) promises to help organizations understand attackers, detect intrusions, and make better security decisions. Yet its real value is difficult to establish. The Economics of Cybersecurity Threat Intelligence examines how the incentives of those who produce, sell, share, and use CTI shape the security outcomes it delivers.
Positioned between computer science and the social sciences, this empirical dissertation combines large-scale measurements of threat data and attacker activity with interviews and analysis of market and community dynamics. It compares commercial providers, open sources, and volunteer sharing communities, showing how each captures different parts of the threat landscape.
The findings reveal substantial limits to common assumptions about CTI. Leading commercial providers offer largely non-overlapping data, while users often value curation and low false-positive rates more than broad coverage. Open sharing communities can identify unique threats, but scalable quality assurance may exclude the novelty they seek to uncover. Finally, many commercial indicators were published only after the associated attacker activity had ended, limiting their use for real-time detection. Together, these findings show why CTI needs to be evaluated not by promises or convenient technical metrics, but by the security and organizational outcomes it actually produces.