Question 1

Are your security controls seeing the full threat picture?

Over the years I’ve worked with organisations that have invested heavily in cybersecurity. They have enterprise firewalls, endpoint protection, SIEM platforms, SOC services and skilled security teams. On paper, they appear to have all the right components in place.

What I’ve come to realise is that security effectiveness is often dictated by something less visible: the quality, breadth and timeliness of the threat intelligence feeding those controls.

One of the things that immediately stood out to me when I started working with Centripetal was the sheer scale of the intelligence ecosystem behind the platform. They aggregate intelligence from hundreds of threat intelligence providers, ingest thousands of data feeds and correlate more than 10 billion threat intelligence indicators. The platform is designed to make more than 10²¹ decisions per second and reportedly blocks 99.94% of high-risk traffic at the network edge before it ever reaches a customer’s environment.

Those numbers are impressive, but the real lesson for me was something much simpler.

Those numbers are impressive, but the real lesson for me was something much simpler.

Even the best security products have blind spots. The question isn’t whether your firewall or SOC is good. The question is how broad the intelligence picture behind it really is.

The reality is that a security tool can only identify threats that have already been recognised by the threat intelligence ecosystem feeding it. If a threat is discovered somewhere outside that ecosystem, there is inevitably a delay before that knowledge reaches your controls.

That reinforced an important point for me. This isn’t necessarily about whether one vendor is better than another. It’s about how broad your intelligence picture is.

Many organisations assume they have complete visibility because they have good security technologies. Yet the question I think every CISO should ask is whether their controls are benefiting from the broadest possible intelligence set.

In highly regulated industries such as financial services, legal, healthcare and critical infrastructure, that question matters more than ever. Regulators increasingly expect organisations to demonstrate resilience, risk awareness and proactive security governance. That becomes much harder if your security decisions are based on a limited view of the threat landscape.

Security leaders should be asking themselves:

How many independent intelligence sources are informing our security controls?

How quickly does new intelligence become active protection?

Are we relying on a small number of intelligence providers for our view of risk?

Would we know if another intelligence provider had identified a threat before ours did?

Because ultimately, the effectiveness of your security controls depends on the intelligence that drives them.

And your SOC can only see what it knows.

Question 2

How exposed are you before a vulnerability becomes public knowledge?

Most organisations think about cyber risk in terms of CVEs, patches and vendor advisories.

The reality is that attackers don’t wait for vulnerabilities to become public before they start exploiting them.

One of the biggest lessons I’ve learned from working with threat intelligence specialists is that suspicious activity is often being observed long before a vulnerability becomes widely recognised across the industry.

In some cases, specialist intelligence providers may detect unusual traffic patterns, malicious behaviour or indicators of compromise weeks or even months before a vulnerability receives widespread attention.

By the time a CVE becomes public knowledge, there is every chance that attackers have already been looking for ways to exploit it.”

— Michael Rooney

That is an important distinction.

The challenge for security leaders is that a vulnerability disclosure often creates a race against time. Security teams must assess exposure, test patches, implement remediation and verify that systems have not already been compromised.

As attack automation accelerates and threat actors increasingly leverage AI, the gap between disclosure and exploitation continues to shrink.

That raises an important strategic question:

Are you relying solely on published threat information, or do you have visibility into emerging threats before they reach the mainstream security ecosystem?

Question 3

Is rapid patching still fast enough?

For years, the cybersecurity industry has encouraged organisations to patch faster.

I agree completely.

Rapid patching remains one of the most effective security controls available.

What I’ve learned, however, is that patching speed alone doesn’t always eliminate risk.

I’ve seen organisations react incredibly quickly when a critical vulnerability was disclosed. Systems were patched within hours, internal teams mobilised immediately and remediation plans were executed exactly as they should have been. Yet during subsequent investigations, evidence sometimes suggested the attackers had already begun probing or compromising systems before the patching process was complete.

You could patch within 12 or 24 hours and still discover evidence that somebody got there first.

That isn’t a criticism of the security teams involved. Quite the opposite. It highlights how compressed the timeline has become.

As attackers increasingly automate reconnaissance and exploitation, the window between disclosure and attack continues to shrink. AI is only likely to accelerate that trend.

For me, this changes the conversation.

The question is no longer simply, “How quickly can we patch?”
It’s also, “What protection exists while we’re patching?”

Question 4

Are you preventing attacks or simply detecting them?

Most security architectures are built around detection.

We collect telemetry, generate alerts, investigate anomalies and respond to incidents.

All of that is important.

But over the years I’ve found that one of the most effective ways to improve security isn’t detecting more threats. It’s preventing more threats from reaching the environment in the first place.

Every piece of malicious traffic that is stopped before it enters the network is one less alert, one less investigation and one less opportunity for an attacker to gain a foothold.

The earlier you stop malicious traffic, the less chance it has to interact with your environment.

When I look at security investments, I always ask whether they’re helping us detect attacks or helping us avoid them altogether.

For organisations dealing with increasing volumes of threats and limited security resources, that distinction becomes critically important.

Particularly when security teams are already struggling under the weight of alert fatigue and investigation workloads.

Question 5

How visible are you to attackers?

One of the concepts I find most interesting is something I often describe as an “invisibility cloak”.

No organisation can become completely invisible, of course.  But organisations can become more difficult to identify, profile and target.

Attackers routinely scan the internet looking for technologies that may be vulnerable. They’re building target lists. They’re looking for exposed systems. They’re identifying known technologies associated with known weaknesses.

The easier it is to identify your technology stack, the easier it becomes to prioritise you as a target.

If attackers can’t easily see what’s behind the front door, it becomes much harder to build an accurate target profile.

That matters because many attacks begin long before exploitation.

They begin with reconnaissance.

The less useful information an attacker can gather during that reconnaissance phase, the harder it becomes to execute targeted attacks at scale.

For highly regulated organisations, reducing visibility to attackers can be an important part of reducing overall risk.

Question 6

Is your SOC overwhelmed by noise?

I’ve spent enough time around SOC environments to know that a lack of alerts is rarely the problem.

The challenge is usually the opposite. Too many alerts. Too many events. Too much noise.

Security teams can find themselves spending enormous amounts of time processing information that ultimately leads nowhere.

What impressed me most during demonstrations of Centripetal wasn’t simply the threat intelligence itself. It was the visibility and context being provided around what was actually happening across the environment.

Once you see the activity, you can’t unsee it.

I’ve seen organisations discover network activity, device behaviour and outbound communications they previously had little or no visibility into. The issue isn’t that their SOC wasn’t doing its job.  It’s that the SOC was operating with an incomplete picture.

At the same time, if more malicious traffic can be blocked before it reaches internal systems, then less noise ultimately reaches analysts and investigation teams.

That’s valuable because human attention remains one of the most limited resources in cybersecurity.

Every hour spent chasing false positives is an hour not spent investigating genuine threats.

Question 7

Are you buying intelligence, or buying outcomes?

This is probably the most important question of all.

Many organisations invest in threat intelligence.  Far fewer can clearly explain what outcomes that intelligence delivers.

Does it reduce risk?

Does it improve visibility?

Does it help analysts make better decisions?

Does it reduce the likelihood of compromise?

Does it strengthen resilience?

Those are the questions I believe security leaders should focus on.

One of the things that stood out to me during our discussions was the scale of investment many organisations make across individual intelligence subscriptions, monitoring tools and specialist services. Yet despite those investments, they often continue to struggle with fragmented visibility.

The goal shouldn’t be to collect more intelligence.

The goal should be to turn intelligence into protection.

Threat intelligence only becomes valuable when it changes the outcome.

For me, that’s the real lesson.

Security leaders shouldn’t be measuring the number of feeds they consume.

They should be measuring how effectively those feeds help them reduce risk, improve resilience and make better security decisions.

Because ultimately, organisations don’t buy threat intelligence to gather information.

They buy it to stay ahead of threats.