The Inbox Nobody Finishes
Picture a four-person security team at a 300-person company (this is an illustrative composite, not a specific customer.) Between them, they get vendor advisories, government alerts, security newsletters, a couple of paid commercial feeds, and whatever a helpful executive forwards after reading about a breach in the news.
Every one of those reports is technically useful. None of them says whether it matters at your organization. So the team does what any busy team does: skims the headlines, saves a few links, and gets dragged back to the alert queue. Two weeks later, one of those unread reports turns out to describe exactly the technique used against a company like theirs.
That is not carelessness; it is basic arithmetic. Threat intelligence is written for the whole world. Your team has to answer a much narrower question: “Could this happen to us, and would we notice?”
Why Small Teams Struggle with Threat Intelligence
- Volume. There are more reports in a week than one person can read in a month.
- No filter for relevance. A report about attacks on hospitals reads the same as one about attacks on your industry.
- It ends at “interesting.” Reading a report rarely produces an action, so it feels like a luxury next to a full alert queue.
- No memory. Even when someone reads a good report, the conclusion (“we don’t detect this”) lives in their head and leaves when they do.
Four Questions That Turn a Report Into a Decision
For any report, ask these in order. Most reports stop at question one or two, which is the point.
- Does it involve technology we actually run? A new attack on a platform you don’t use can wait.
- Does it target organizations like us? Your industry, your size, your region, your suppliers.
- Is there something we can do? A behavior to look for, a setting to change, a patch to apply. If there isn’t, note it and move on.
- Do we already catch it? This is the question teams skip, and the most valuable one. If you already detect the technique, you’re done. If you don’t, you’ve found a gap.
Only reports that pass all four deserve real time. The output should be one of three things: “already covered”, “fix a setting”, or “we need a detection for this.”
A 30-minute Weekly Routine, No Software Required
- 10 minutes: skim your feeds and discard anything that fails question one.
- 10 minutes: for what’s left, answer questions two and three. Write one line per report.
- 10 minutes: for anything that fails question four, write a detection request: what behavior, which systems, why it matters, and who owns it.
Keep the requests in a single list that everyone can see. That list is your team’s memory. It also answers an owner’s favorite question: “What are we doing about the news?”
You can run this with a shared document and a calendar reminder. Many small teams do. The weak points are consistency and the fourth question, because “do we already detect this?” is hard to answer from memory.
Where SCOUT Helps
SCOUT is built around the same four questions, so the routine above becomes a workflow instead of a habit you have to keep up:
- One place for your feeds. It reads feeds from news, vendor and government sources and a standard intelligence format, so reports arrive where the rest of your work is.
- Relevance, not just volume. It compares what a report describes with what your team has configured, and flags items that matter and that you may not detect, with the reasoning shown so a person can agree or disagree.
- Gaps you can see. A coverage map shows which attacker techniques your detections address, and which of them the intelligence you read is actually talking about.
- Gaps become work. A reported gap becomes a detection request that someone can pick up. SCOUT can draft a first version of the detection and tests for it, and nothing goes live without a person reviewing and approving it.
What it doesn’t do: it doesn’t decide for you, and it isn’t a substitute for judgment about your business. The point is to put the right two or three reports in front of a person, with the evidence.
Next in the series: From report to detection: closing coverage gaps, on how to turn a gap into something your team can actually detect, and how to tell if it works.
