Is commercial cyber threat intelligence doomed?

Virtual Routes is pleased to welcome the 2025-2026 cohort of European Cybersecurity fellows to our community. As part of their application, each fellow wrote an essay on one of three set questions addressing some of the biggest issues facing European cybersecurity policy and practice. We are delighted to introduce this group of talented young cybersecurity professionals with a short series of excerpts from their essays, grouped by question.

In our first installment, three fellows tackled the question, What’s the biggest blind spot in our understanding of cyber conflict, and why can’t we afford to ignore it?

In this second installment, Kritika Roy of the German Cyber Security Organisation (DCSO) and Michaela Prucková of the National Cyber and Information Security Agency of the Czech Republic answer the question, Is commercial cyber threat intelligence (CTI) doomed to fail or poised to thrive?

Kritika Roy, senior threat intelligence researcher and analyst at the German Cyber Security Organisation (DCSO)

Cyber threat intelligence has become a significant part of cybersecurity strategies, providing organisations with critical insights to detect, mitigate, and prevent cyber threats. However, the debate persists: is commercial CTI poised to thrive, or is it destined to fail in the face of free and open-source intelligence (OSINT)? With the proliferation of publicly available threat intelligence, some argue that commercial CTI is an unnecessary expense – too costly, lacking transparency, and offering incomplete coverage.

Yet dismissing CTI as redundant ignores a crucial truth: raw data without context is as dangerous as no data at all. OSINT is like an all-you-can-eat buffet, plentiful but often of questionable quality and taste. While one can still find valuable pieces of information, relying on it alone is a gamble. Commercial CTI, on the other hand, offers carefully curated, validated intelligence, helping organizations cut through the noise and focus on real threats rather than getting distracted by high-profile but irrelevant cyber incidents. Additionally, commercial CTI provides essential context, helping organisations avoid unnecessary panic and respond appropriately to threats.

Some may argue that the absence of a ‘cyber Pearl Harbor’ signals CTI’s ineffectiveness. However, perhaps the very reason we have not witnessed a catastrophic digital meltdown is that CTI is working. The success of intelligence is not measured by the number of high-profile breaches but by the countless attacks prevented.

The growing market for threat intelligence, projected to reach $16.4 billion by 2031, underscores its increasing importance. Regulatory pressures and the rising costs of breaches further drive the demand for CTI. Moreover, advancements in AI and machine learning are enhancing threat intelligence capabilities, making them more effective and efficient.

So, is commercial CTI doomed to fail? Only if organisations choose to navigate the cyber landscape blindfolded. The real question is not whether threat intelligence will survive, but rather if businesses will be wise enough to leverage it. 

Michaela Prucková, legal and policy officer for the EU and NATO at the National Cyber and Information Security Agency of the Czech Republic

General estimates say the CTI market will continue to grow in coming years, especially in the EU. There, the single market principle and new cybersecurity regulations such as the NIS 2 Directive, the Cyber Solidarity Act, and the Digital Operational Resilience Act, as well as related national cyber security laws, have opened a window of opportunity for CTI. The question of how states can and should utilise commercial CTI is vital to understanding the future of the field.

The magic term ‘public-private partnership’ occurs increasingly frequently in policy statements and strategic documents. Nonetheless, the practical configuration of such partnerships faces many obstacles. These are just the tip of the iceberg: states rely on classified information and intelligence that cannot be freely handed over to the private sector, and they need to maintain their strategic autonomy, which can become harder if they outsource too much or rely on unreliable providers. As such, states should only choose services from trusted providers, while simultaneously taking measures to prevent vendor lock-in.

Outsourcing CTI is not only a financially beneficial way to avoid the demanding work of building in-house CTI capabilities, but also a way to let in new air and challenge state approaches of ‘doing security’, which can be systematically reluctant to test new ways. 

However, states cannot rely solely on the private sector. Commercial CTI providers are unable to fully understand these customers’ security priorities, the complexity of critical infrastructure, or geopolitical aspects of malicious actors. Even if they could access all the resources needed to fully grasp the threats states face, including classified information, commercial CTI providers cannot offer a threat picture sufficiently complex yet straightforward enough to drive states’ strategic decisions, nor should they attempt to do so.

Finding the right balance of private-public partnership while still developing core internal CTI capabilities should be every state’s priority. A commercial provider of CTI who understands this has a great opportunity to establish a strong collaboration with customers who are not driven by market rules but create them and who will occasionally ask particularly interesting questions with geopolitical impact. In such a collaboration, both the public-private partnership concept and commercial CTI could thrive.