Can Cyber Threat Intelligence Prove Its Value?
Cyber threat intelligence programs face a persistent challenge: their work may be operationally valuable while remaining difficult to express in financial terms. Reports produced, indicators collected, and briefings delivered can demonstrate activity, but they do not necessarily show whether intelligence reduced risk, prevented loss, or improved organizational decisions. In A Product-Level Profit & Loss Model for Cyber Threat Intelligence, Luke Pomichter introduces TRACER, or Threat Adjusted Risk and Cost Evaluation for Reporting, as a proposed method for assigning financial value to individual intelligence reports and indicators of compromise.
Activity Is Not the Same as Value
Traditional CTI metrics often count visible outputs because those outputs are relatively easy to measure. A team can report how many threat reports it published, how many indicators it processed, or how many briefings it delivered. Those numbers may describe workload and productivity, but they do not reveal whether the intelligence changed a decision, improved a control, accelerated a response, or reduced an organization’s exposure to loss. TRACER begins with the premise that intelligence should be evaluated by its relevance and effect rather than by volume alone.
What TRACER Attempts to Measure
TRACER proposes separate valuation methods for intelligence reports and indicators of compromise. Reports are evaluated using factors such as baseline risk exposure, potential risk reduction, relevance to receiving teams, intelligence quality, threat actor activity, and the declining value of recommendations after controls have already been implemented. Indicators are evaluated according to their probability of being observed, the loss they could help prevent, existing coverage, and the labor required to process them. The model also separates the value produced by an analyst from the value ultimately realized by the organization. This distinction recognizes that strong intelligence may be delivered even when another team fails to act on it.
The Challenge of Quantifying Intelligence
Assigning financial value to intelligence inevitably requires assumptions about likelihood, relevance, control effectiveness, and potential loss. TRACER acknowledges this difficulty. The current version uses illustrative inputs that would need to be calibrated with an organization’s own incident data, control implementation history, and operational experience. It also does not yet fully capture the strategic value of intelligence that shapes long-term decisions without producing an immediate control change. These limitations do not make the model unhelpful. By stating its assumptions and inviting empirical testing, TRACER gives practitioners something concrete to examine, question, and improve.
A Framework Worth Testing
TRACER’s immediate value may lie less in producing a final dollar figure than in changing the questions CTI teams and organizational leaders ask. Which intelligence products influenced decisions? Which recommendations reduced exposure? Did operational teams act on the intelligence they received? Could the claimed value be supported with evidence? By extending the financial logic associated with Open FAIR to individual CTI products, TRACER offers a starting point for answering those questions in language that technical teams and financial leadership can examine together. The model still requires testing and calibration, but its effort to move CTI measurement from activity toward demonstrable value deserves serious consideration.
References
- A Product-Level Profit & Loss Model for Cyber Threat Intelligence, Luke Pomichter, 2026.
- The Open FAIR Body of Knowledge, The Open Group.