Prioritizing Risks Based on Threat Intelligence
Focusing resources on real risks
Prioritizing risks based on threat intelligence means no longer treating all vulnerabilities and threats equally and focusing the security team's limited resources on what really has a chance of affecting the organization, according to the specific context of its industry, geography and technology. In practice, this means cross-referencing information on active threats with the real inventory of internal assets and vulnerabilities, so a vulnerability that's critical according to its technical score but has no known active exploitation may receive lower priority than a medium-severity vulnerability already being actively exploited against organizations in the same sector. An important nuance is that threat intelligence must directly feed vulnerability and risk management processes, not live isolated in reports nobody connects to operational patching decisions. A typical case of this effective prioritization is speeding up the patching of an internet-facing system as soon as it's confirmed that a ransomware group is actively exploiting that specific vulnerability in recent campaigns.