No organisation’s detection and response capability, however sophisticated, can match the breadth of visibility that collective intelligence sharing creates. A single organisation observes a fraction of the threat landscape. Its detection programme identifies the adversary techniques that target its specific environment, its sector, and its technology stack. The intelligence it generates from its own incidents and investigations is operationally specific and highly relevant, but it is also necessarily limited to what that organisation has directly encountered.
When organisations share threat intelligence with each other and with public sector bodies, that limitation dissolves. The criminal group’s infrastructure identified during one organisation’s incident investigation becomes a detection indicator for every organisation in the sharing community before the same group launches its next campaign. The novel phishing technique observed in one sector is flagged to adjacent sectors before it is adapted for their environments. The zero-day exploit being actively used against one organisation triggers defensive preparation across the community before the adversary has broadened its targeting.
The adversary community already operates this way. Criminal groups share tools, techniques, and target intelligence through their own networks. Coordinated attack campaigns leverage collective capability that exceeds what any individual actor could deploy alone. The defensive community’s collective intelligence sharing is the structural response to that asymmetry.
The Benefits of Collective Defence #
Faster detection of emerging threats is the most immediate operational benefit. When an organisation detects a novel technique and shares the indicators with its intelligence community, every member of that community can update its detection logic before the technique has been used against them. The detection latency that would otherwise exist between the first victim’s discovery and every other potential victim’s awareness is compressed from weeks or months to hours or days.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
