Intelligence recommendations

A recommendation is an argument

Every Intel Fusion recommendation includes the evidence behind it: the underlying overlap percentages, the ATT&CK techniques affected, the annual cost, and the impact on portfolio coverage if the change is applied. A recommendation to drop a feed shows what coverage is lost (often zero — the feed was fully subsumed) and what spend is recovered. A recommendation to pilot a new feed shows the techniques it uniquely covers and the percentage-point lift to weighted coverage.

This matters because rationalization rarely fails on the math. It fails when an analyst, a procurement lead, and a CISO have to agree, and no one can show their work. Intel Fusion is opinionated about making the work visible.

Recommendation classes

The engine produces five recommendation classes, each with its own rationale template:

• Consolidate. Two or more sources are mutually redundant. The recommendation cites the asymmetric overlap analysis and identifies which feed to retain.
• Drop. A feed contributes nothing unique against the rest of the portfolio. The cost is freed for reinvestment.
• Renew. A feed contributes uniquely on techniques no other source covers; the renewal is defensible.
• Pilot. A candidate from the catalog closes a measured gap. The recommendation includes expected coverage lift and the techniques addressed.
• Replace. A cheaper or higher-fidelity alternative covers more of what a current paid feed covers, with quantified coverage lift.

Prioritization

Recommendations are ranked by expected operational impact, not just dollar savings. A consolidation that saves $40K but reduces weighted ATT&CK coverage by two percentage points may rank below a $15K pilot that lifts coverage by eight. Cost, coverage delta, and portfolio risk are all surfaced so security leadership can apply their own weighting if they disagree with the default.

Analyst review, not automation

Recommendations are designed to be reviewed by a human analyst before any action is taken. The engine surfaces the case; the analyst applies organizational context the engine does not have — contract timing, vendor relationships, classified intelligence requirements, sharing agreements. The AI-assisted analyst workflows provide a working surface for that review.

Related

• Use case: threat intelligence rationalization
• Use case: cyber intelligence investment optimization
• Platform: MITRE ATT&CK coverage mapping