Cybersecurity has preached information sharing for decades. Conferences endorse it, regulators encourage it, and most security leaders accept that one company’s breach should become another’s early warning. In practice, intelligence still moves in impractical ways that rarely characterize a threat consistently.
AI is widening the cost of that discrepancy. CrowdStrike’s 2025 Global Threat Report put average breakout time, the gap between initial access and lateral movement, at 48 minutes, with the fastest recorded case taking 51 seconds. Governments often have not matched that pace. Until now.
Deborah Galea, Open Source Cybersecurity Specialist at Filigran, told UC Today how the Dutch National Cyber Security Centre has taken a concrete step toward making threat intelligence more powerful after standardizing the open format STIX 2.1 across government. With the cybersphere more tumultuous now than at any time in decades, it raises the question of why enterprises don’t follow suit.
Formats, Feeds and Lock-In
The first obstacle is format. “Most organizations don’t really have a practical way to share intelligence,” Galea says, because what they hold may sit “in a PDF, in an email, in maybe a proprietary database format” from whichever tool produced it. Sharing then means labor-intensive conversion, and that effort is the reason, she argues, organizations share less than they should.
Volume compounds the friction. Filigran’s own State of Threat Management report found that organizations pull data from 14 different feeds on average. Without a way to unify them, Galea says, “there’s just data overload,” with duplicated entries and no view of how a piece of malware, a threat actor and an IP address connect. Analysts end up reconciling sources by hand instead of acting on what they say.
Speed makes that manual work expensive. Set a manual conversion step against a 48-minute breakout window, and the intelligence is stale before anyone uses it. “You really need to make this real-time and automated, otherwise we’re not going to have the benefit that we could really get from this,” Galea says. Automation depends on every tool reading the same language, which proprietary formats and different standards prevent.
Those formats also shape the market. Galea points out that a company wanting to switch platforms must either lose its data history or migrate it, with possible data loss and manual work along the way. Buyers can end up on a platform “that maybe isn’t your choice,” kept there by the cost of leaving. Lock-in therefore does two kinds of damage: it holds intelligence in silos and weakens the pressure on vendors to improve. Fixing it raises the question of who should set the rules.
What Businesses Can Do About Fragmented Intelligence
Galea’s answer begins with a shared vocabulary. With STIX, “everyone knows what that means. It’s going to be the same no matter which tool you’re using.” Galea describes a workable pipeline: collect from external feeds and internal security tools, standardize the data in STIX so relationships become visible, work out which threats are likely to target your sector, then feed the indicators into EDR, SIEM and firewalls. Only at that last step does intelligence become operational.
Open standards also change what buyers can demand. If data moves freely between platforms, Galea says, the winners will be “the platforms that give the best analysis, the best automation, best integrations.” Vendors compete on capability instead of on the cost of leaving. For security leaders, portability belongs in procurement criteria alongside detection quality.
Government can accelerate this, and Galea sets the bar at recommendation rather than mandate. Sharing, she says, “only works if it’s done widely,” and smaller organizations without a large CTI team gain the most from intelligence others share. Europe already points that way. Article 29 of the NIS2 Directive encourages entities to join information-sharing arrangements, and sector ISACs and ISAOs are built on members exchanging intelligence even when they compete. Galea adds that anonymizing data and labeling what can and cannot be shared keeps that practical.
Complexity and cost are the usual objections, and she dismisses both. A common standard reduces complexity, and open-source options remove the price barrier. Filigran’s own platform, OpenCTI, is free and is built on STIX and TAXII.
Why Shared Intelligence Matters Going Forward
The tension at the heart of this discussion is that sharing has long been endorsed and rarely engineered. Standards turn goodwill into infrastructure. Without them, each organization’s intelligence stays trapped in its own formats, while attackers are free to reuse methods across many victims. “The only way to keep up with them is to share our knowledge,” Galea says, adding that attackers would prefer defenders not to.
That puts the focus on three developments. One is whether the Dutch approach spreads to other governments and moves from internal use to guidance for enterprises. Another is how firmly NIS2 enforcement pushes organizations toward sharing groups. The third is whether vendors support open formats natively or keep treating data portability as a risk to retention.
For technology leaders, the practical test is straightforward. Ask whether your threat intelligence can leave your current platform in an open format and whether it can reach your security stack within minutes instead of days. If the answer is no, AI-assisted attackers have a structural advantage, and closing it requires agreement on a common language more than another tool.
