From Noise to Signal: An Extensible Framework for Measuring Threat Intelligence Quality

Threat intelligence (TI), information about emerging threats that target an organisation to mitigate risks, can be acquired from various information sources. Despite its critical role in protecting business-sensitive assets and enabling security operations, the quality of TI varies significantly. This inconsistency poses a major challenge for organisations relying on TI for informed decision-making. To address this, we collaborated with security experts to identify key quality criteria for TI and operationalize these criteria in practice. Based on these insights, we present an extensible and customizable framework for assessment of threat intelligence quality. Our framework assigns quality scores to individual TI items, enabling more reliable and informed utilisation in security workflows. This work focuses on practical implementation and evaluation, offering guidance for improving TI processes.