Team Cymru, a leading provider of cyber intelligence, recently unveiled its Voice of Cybersecurity Strategist Report. Findings showed that:
- Despite increased investment, many organizations still operate with limited visibility of external attack surfaces and active threat infrastructure, leaving blind spots.
- Meaningful gaps are being found between perceived readiness and operational capability, particularly around external visibility, threat intelligence, and AI-driven security priorities.
- 50 percent of security practitioners say they experienced a major security breach in the past year.
- 72 percent of those breached say their threat hunting program played a key role in preventing or mitigating the breach.
- 38 percent report comprehensive, real-time visibility into threats beyond the network perimeter.
- AI-enabled threats are the top emerging concern (22 percent), ahead of ransomware (20 percent) and cloud service vulnerabilities (17 percent).
- 45 percent cite insufficient real-time threat intelligence as their biggest external threat intelligence gap.
- 60 percent allocate 20 to 40 percent of their threat intelligence budget to external threat intelligence and monitoring, and 32 percent allocate more than 40 percent.
- The ability to leverage AI is the top evaluation criterion for threat intelligence investments (52 percent).
- AI-enhanced threat detection and response is ranked the most critical security capability (61 percent).
"The data shows many are still operating without the real-time external visibility needed to stay ahead,” said Joe Sander, CEO, Team Cymru. “This report validates what we hear every day from cyber defenders of all types: threat hunting and external intelligence can change outcomes, but only if organizations can translate threat data into action quickly.”
Investment and operating models are shifting toward external, technology-driven defense, with 92 percent of respondents allocating at least 20 percent of their threat intelligence budget to external threat intelligence and monitoring, including 32 percent who allocate more than 40 percent.
When it comes to resourcing, 44 percent report a mostly technology-focused approach to balancing tools and people, signaling a push toward automation, orchestration, and integrated workflows to increase team efficiency.
Measuring value is increasingly tied to proactive outcomes. The primary metric respondents use to assess external threat intelligence effectiveness is spotting threats before they affect the organization (27 percent), followed closely by faster threat detection (26 percent).
When communicating to boards and executive leadership, respondents most often cite the number of incidents prevented or detected (50 percent) and mean time to detect and respond (50 percent), reflecting a focus on tangible outcomes and operational speed.
The report also highlights why progress can stall. The biggest challenge to funding threat intelligence initiatives is a focus on compliance requirements over threat-driven investments (26 percent), followed by competing priorities within the security program (23 percent) and limited executive understanding of external threats (22 percent).
Looking ahead, the top planned strategic shift over the next 12 to 24 months is increasing the efficiency of the existing security team (45 percent), alongside aligning with increasing regulatory compliance (40 percent) and consolidating threat intelligence suppliers (39 percent).
