Practitioners Reveal What Makes Threat Intelligence Programs Mature

This article explores threat intelligence program maturity based on insights from practitioners at Global Payments, Adobe, and Superhuman. The 2025 State of Threat Intelligence Report surveyed 615 cybersecurity executives, revealing that 76% of organizations spend over $250,000 annually on threat intelligence, with 91% planning increased spending in 2026 and 87% expecting to advance program maturity within two years. Key maturity indicators include workflow automation, high-fidelity indicators to reduce noise-to-signal ratios, cross-functional collaboration, and strategic use of intelligence for business decision-making rather than solely for detection. Practitioners emphasize that maturity transforms threat intelligence from operational tool to strategic asset for risk communication and executive education. The article notes that AI will reshape junior analyst workflows but won't replace them entirely.

Threat intelligence practitioners from Global Payments, Adobe, and Superhuman reveal how mature CTI programs transform data overload into strategic business value. Learn proven approaches to automation, cross-functional collaboration, and executive communication.

This article explores threat intelligence program maturity based on insights from practitioners at Global Payments, Adobe, and Superhuman. The 2025 State of Threat Intelligence Report surveyed 615 cybersecurity executives, revealing that 76% of organizations spend over $250,000 annually on threat intelligence, with 91% planning increased spending in 2026 and 87% expecting to advance program maturity within two years. Key maturity indicators include workflow automation, high-fidelity indicators to reduce noise-to-signal ratios, cross-functional collaboration, and strategic use of intelligence for business decision-making rather than solely for detection. Practitioners emphasize that maturity transforms threat intelligence from operational tool to strategic asset for risk communication and executive education. The article notes that AI will reshape junior analyst workflows but won't replace them entirely. Threat intelligence practitioners from Global Payments, Adobe, and Superhuman reveal how mature CTI programs transform data overload into strategic business value. Learn proven approaches to automation, cross-functional collaboration, and executive communication. Key Takeaways Intelligence drives better decisions. High-performing teams use threat intelligence not just for detection, but to inform strategic business decisions and communicate risk to leadership. Maturity means efficiency. Advanced programs focus on automation, high-fidelity indicators, and cross-functional collaboration—freeing analysts to concentrate on strategic initiatives. Information overload is the top challenge. Teams need better integrations and AI-powered tools to transform massive data volumes into actionable insights. AI will reshape the analyst role. While junior analysts won't be replaced, their workflows will evolve significantly as AI augments their capabilities. Recorded Future recently hosted two webinars to unpack key insights from the 2025 State of Threat Intelligence Report and hear directly from customers who are putting these findings into practice. Based on survey responses from 615 cybersecurity executives and practitioners, the report showed clear industry trends. Threat intelligence spending is up, with 76% of organizations spending over $250,000 annually and 91% planning to increase spending in 2026. Even more critically, 87% said they expect to advance the maturity of their threat intelligence programs over the next two years. But what does maturity actually look like in practice? Our customers offered candid perspectives on how they're turning intelligence into impact. Intelligence as a strategic asset Our webinar panelists noted that the availability of rich threat intelligence has transformed how their organizations approach decision-making. According to Jack Watson, Senior Threat Intelligence Analyst at Global Payments, “Understanding that one alert opened and one alert closed does not necessarily equate to one single adversary being stopped” has led his team to take “a much more holistic approach to looking at problems.” Omkar Nimbalkar, Senior Manager of Cyber Threat Research and Intelligence at Adobe, said, “Once you start doing this work day in and day out, you uncover patterns in your environment. You uncover what your posture looks like, where your true risk resides, and you can use that as a means to inform the business on the changing threat landscape for better decision-making.” Ryan Boyero, Recorded Future’s Senior Customer Success Manager, said context and storytelling are key benefits of threat intelligence. “You can have a precursor or malicious activity that has occurred,” he said, “but without threat intelligence, you can’t really tell the story or paint the picture to deliver to senior leadership in order to help make the best and informed decisions possible.” How threat intelligence delivers organization-wide value Nimbalkar said his team provides tailored threat intelligence to business units and product teams across Adobe so they can monitor for specific behavioral activities and block specific threats in their environments. Boyero shared that Recorded Future customers in EMEA use threat intelligence to educate leadership. “We're able to inform leaders,” he said. “We're able to speak with executives, get them in the room, not so much scare them that a situation could happen or has happened, but ultimately just educate and let them know that this is what Recorded Future is able to do and how we can bring success to the table.” Erich Harbowy, Security Intelligence Engineer at Superhuman, said that in addition to educating leaders about risk, his team also uses threat intelligence to show the value of their work. “Not only am I using this very current news, I am also using the statistics that come along with that,” he said. “How much damage occurred during the first attack that was similar to this? And are [my adversaries] done? Are they coming back?” Harbowy appreciates Recorded Future for...