CTI overlap analysis

Who this is for

CTI program managers, threat intelligence team leads, and security operations directors responsible for the composition of the organization's intelligence portfolio. The shared characteristic of this role is accountability for spend across multiple feeds, often without a quantitative tool to show what each is contributing.

The operational pain

A typical mature CTI program runs eight to twenty distinct feeds across commercial, open-source, and government tiers. Each was added for a defensible reason at the time. The pain emerges over the next two budget cycles: renewal time comes, and the program manager cannot prove which feeds are still pulling weight. Vendors lead with quality metrics that look impressive in isolation. Analysts have opinions but no shared evidence. Procurement asks for a justification document. The default action is to renew everything, because cutting a feed without proof carries career risk.

The result is steady portfolio drift: spend grows, overlap accumulates silently, and coverage gaps go undiagnosed because no one is measuring the union.

How Intel Fusion helps

Intel Fusion converts a feed portfolio into a measured one. Every pair of sources is correlated for indicator, technique, and adversary overlap. The output is a ranked list of pairs with the strongest redundancy, accompanied by the counterfactual: if we drop this feed, what coverage is lost? The answer is often "none," because the dropped feed was fully subsumed by another paid feed or by an OSINT source. That is the case the program manager can take to leadership.

See the engine behind it in CTI source overlap analysis and the rationalization output in intelligence recommendations.

Expected outcomes

• A quantified overlap matrix across the active CTI portfolio.
• A short list of consolidation candidates with the coverage loss for each.
• An evidence pack suitable for procurement and budget review.
• A baseline for ongoing measurement — overlap is not a one-time exercise.

Relationship to MITRE ATT&CK®

Overlap analysis without ATT&CK context can produce misleading recommendations: two feeds may overlap 80% on indicators while diverging on the techniques they uniquely cover. Intel Fusion reports both dimensions, so a redundancy on indicators is not treated as a redundancy on coverage. See MITRE ATT&CK coverage mapping for how the coverage dimension is constructed.

Related

• Use case: threat intelligence rationalization
• Use case: cyber intelligence investment optimization