Cybersecurity has preached information sharing for decades. Conferences endorse it, regulators encourage it, and most security leaders accept that one company's breach should become another's early warning. In practice, intelligence still moves in impractical ways that rarely characterize a threat consistently.
AI is widening the cost of that discrepancy. CrowdStrike's 2025 Global Threat Report put average breakout time, the gap between initial access and lateral movement, at 48 minutes, with the fastest recorded case taking 51 seconds. Governments often have not matched that pace. Until now.
Deborah Galea, Open Source Cybersecurity Specialist at Filigran, told UC Today how the Dutch National Cyber Security Centre has taken a concrete step toward making threat intelligence more powerful after standardizing the open format STIX 2.1 across government. With the cybersphere more tumultuous now than at any time in decades, it raises the question of why enterprises don't follow suit.
Formats, Feeds and Lock-In
The first obstacle is format. "Most organizations don't really have a practical way to share intelligence," Galea says, because what they hold may sit "in a PDF, in an email, in maybe a proprietary database format" from whichever tool produced it. Sharing then means labor-intensive conversion, and that effort is the reason, she argues, organizations share less than they should.
Volume compounds the friction. Filigran's own State of Threat Management report found that organizations pull data from 14 different feeds on average. Without a way to unify them, Galea says, "there's just data overload," with duplicated entries and no view of how a piece of malware, a threat actor and an IP address connect. Analysts end up reconciling sources by hand instead of acting on what they say.
Speed makes that manual work expensive. Set a manual conversion step against a 48-minute breakout window, and the intelligence is stale before anyone uses it. "You really need to make this real-time and automated, otherwise we're not going to have the benefit that we could really get from this," Galea says. Automation depends on every tool reading the same language, which proprietary formats and different standards prevent.
Those formats also shape the market. Galea points out that a company wanting to switch platforms must either lose its data history or migrate it, with possible data loss and manual work along the way. Buyers can end up on a platform "that maybe isn't your choice," kept there by the cost of leaving. Lock-in therefore does two kinds of damage: it holds intelligence in silos and weakens the pressure on vendors to improve. Fixing it raises the question of who should set the rules.
What Businesses Can Do About Fragmented Intelligence
Galea's answer begins with a shared vocabulary. With STIX, "everyone knows what that means. It's going to be the same no matter which tool you're using." Galea describes a workable pipeline: collect from external feeds and internal security tools, standardize the data in STIX so relationships become visible, work out which threats are likely to target your sector, then feed the indicators into EDR, SIEM and firewalls. Only at that last step does intelligence become operational.
