Customer-Oriented Ranking of Cyber Threat Intelligence Service Providers

Abstract Cyber Threat Intelligence (CTI) is revolutionizing the cybersecurity ecosystem by enabling organizations to share threat data and allow for proactive defense against sophisticated intrusion attempts. Several cybersecurity vendors are offering a variety of CTI services and capabilities to their customers. The wide variety in the CTI service offerings by different providers makes it difficult for the security experts to decide which service provider is most suitable according to their security program requirements. Current approaches for ranking CTI service providers are based on a limited set of Key Performance Indicators (KPI) and do not consider the customer’s security program relevance and requirements. In this work, an extensive set of KPI to rank CTI service providers is defined. This paper proposes a framework which is a first of its kind that assigns weights to KPI based on the customer’s requirements and ranks CTI service providers. This framework significantly helps the security program leaders in decision making for CTI service provider selection. It is designed to improve the quality of service offerings by promoting healthy competition among CTI service providers.