What problem does it solve?
A cyber threat intelligence (CTI) team answers a short list of questions for its organization: which attackers are active against our sector, which vulnerabilities are being exploited in the software we run, and has anything happened at a company we depend on. The answers sit in hundreds of places: vendor blogs, government advisories, news sites, social media, regulatory filings and paid feeds. Elastic describes the starting point as analysts who "have traditionally relied on manual collection, documentation, and analysis", a process it says can take days or weeks.
The collecting and writing takes the time. RH-ISAC's threat intelligence team spent 10 hours a week just collecting intelligence, and one of its analysts spent two hours a day summarizing daily news. At gematik, an analyst read each article, translated it into German, summarized it and copied it into the wiki page for the morning briefing, and on busy days it took up to an hour. Sopra Steria's team needed 45 minutes to pull the indicators of compromise out of a single article, and some analysts chose not to spend the time.
Time spent collecting is time not spent on the analysis that stakeholders need, which is what a threat means for this organization and what to do about it. It also leaves gaps. Analysts have their favorite sources, nobody can tell whether the team caught everything, and a stakeholder learns about an incident from the news before the CTI team has said a word.
How does it work?
- Turn the intelligence requirements into standing queries. The team writes down what it must watch: its sector, its technology stack and suppliers, named threat actors, a list of member or customer companies. Each requirement becomes a feed that the AI keeps filtering, so it does not need an endless list of aliases and keywords.
- Collect and extract. The system scans the configured sources, removes duplicates and tags each article with the threat actors, vulnerabilities, techniques and indicators of compromise it mentions. Extracted indicators can flow straight into a threat intelligence platform such as MISP.
- Draft the summary. The analyst selects the relevant items and asks the assistant to write a summary, a threat actor profile or a report from a template stored in a knowledge base. Ask the assistant to name the articles it used, so the analyst can check each claim against its source.
- Review and add the analysis. The analyst checks the draft against the sources, edits it and adds what only a human can: why this matters for this organization and what to do next.
- Distribute. Approved items go into the daily briefing page, a newsletter, a ticket or a chat channel. Templates and schedules mean the daily and weekly products go out even when part of the team is away.
- Audience
- Employee facing
- Autonomy
- Copilot
- Adoption
- Early adopters
- Channels
- Internal tools, Email, API and system to system
What is it worth?
Benchmarks are computed from the public deployments below: one data point per organization per KPI, with who made each claim.
| KPI | Median | Reported range | Data points | Claimed by |
|---|---|---|---|---|
| Handling time reduction | Too few to pool | at least 70% | 1 | 1 vendor |
| Productivity gain | Too few to pool | 75% | 1 | 1 organization |
Value drivers: Employee productivity, Speed and cycle time, Risk and loss reduction.
Indicative value
An enterprise cyber threat intelligence team of 3 to 8 analysts
USD 19,008 to USD 353,280
Analyst time released from collecting and formatting, valued at cost per year
How this is calculated
Formula: analysts * hoursPerWeek * weeksPerYear * timeSavedShare * costPerHour. The low scenario uses every low input, the high scenario every high input.
| Input | Low | High | Basis |
|---|---|---|---|
| Analysts who collect and write threat intelligence analysts, analysts | 3 | 8 | Editorial assumption for a large enterprise team. Replace with your own headcount. |
| Hours per analyst per week spent collecting, summarizing and formatting hoursPerWeek, hours per week | 8 | 16 | Editorial assumption. RH-ISAC reports 10 hours a week on collection alone before Feedly, plus two hours a day on summaries. Replace with your own time study. |
| Working weeks per year weeksPerYear, weeks | 44 | 46 | Editorial assumption that allows for leave and public holidays. |
| Share of that time the AI saves timeSavedShare, fraction of collection and writing time | 0.3 | 0.6 | Below the figures on this page, where RH-ISAC's case study reports a 70% or higher cut in collection time and Elastic says its analysts recouped 75% of their time (one vendor reported, one reported by Elastic about its own team), because a first deployment rarely covers every source and report type. |
| Fully loaded cost of an analyst hour costPerHour, USD per hour | 60 | 100 | Editorial assumption, replace with your own fully loaded cost. |
What it leaves out: Counts analyst time only. It leaves out the license cost of the intelligence platform and the AI, the set up of feeds and templates, the time spent checking drafts, and the value of warning a stakeholder earlier, which is the benefit the teams on this page care most about.
Who already uses it?
4 public deployments, strongest evidence first. Grades: A regulator or audit, B the organization itself, C vendor case study, D anonymous or estimate.
Elastic
Global · Technology and software · 2025
Elastic's own information security team built a threat intelligence reporting assistant on Elastic AI Assistant for Security. The team stored a markdown template for each report type in the assistant's knowledge base, with sections and instructions for the model, and the assistant now drafts intelligence reports, single event reports, threat actor profiles, trend reports and summaries from the collected sources. Analysts refine and update each draft. Elastic says the analysts reclaimed 75% of their time and report output rose by 92% in the six months after launch.
- Productivity gain: 75%, share of analysts' time recouped, mainly from less time spent aggregating information for threat intelligence reports, six months after launch
"The team has recouped 75% of analysts’ time while increasing threat intelligence report output by 92%."
Claimed by: organization - Productivity gain: 92%, increase in threat intelligence reports created, six months after launch
"The assistant drove a 92% increase in threat intelligence reports, enabling a more proactive defense and better stakeholder engagement."
Claimed by: organization
gematik
Germany · Government and public sector · 2025
gematik, the German agency responsible for digitizing healthcare products, runs a Cyber Defense Center that used to read trusted websites, translate articles into German, summarize them and copy them into a wiki page for the daily threat briefing. With Feedly AI Feeds, Team Boards and its API, the team collects relevant articles, loads them into the briefing page automatically and sends a daily digest to the security department and a weekly report to management. An analyst still chooses which articles go on the daily board.
No outcome disclosed.
RH-ISAC
United States · Retail and ecommerce · 2025
RH-ISAC, the Retail and Hospitality Information Sharing and Analysis Center, monitors threats for more than 300 member organizations. Its threat intelligence team turned its two priority intelligence requirements into AI Feeds in Feedly, one for the sub industries it covers and one for a list of member companies, and uses the Ask AI panel to write first draft summaries of daily news and of reporting during a geopolitical crisis. The analyst fact checks and edits each summary before it goes out. The ISAC reports that collection time fell from 10 hours to two or three hours a week.
- Handling time reduction: at least 70%, weekly intelligence collection, from 10 hours to two or three hours
"The team reduced intel collection time from 10 hours to just two or three hours per week — a 70–80% time savings — and cut report summarization time from two hours per day to just 15–20 minutes."
Claimed by: vendor
Sopra Steria Scandinavia
Europe · Professional services · 2023
The cyber threat intelligence team at Sopra Steria Scandinavia, which sells managed security services, uses Feedly AI Feeds to collect indicators of compromise and vulnerabilities that match its customers' technology. Saving an article to a board extracts the indicators and sends them with context to its MISP instance, and Feedly AI writes a summary of each article for daily and weekly newsletters sent to more than 150 recipients. Analysts check the summaries and add notes before sending. The team says inbound customer tickets about threats and new vulnerabilities were significantly reduced.
No outcome disclosed.
How do you implement it?
A model agnostic playbook: what to prepare, the order to build in, and what goes wrong.
Data you need
- Written priority intelligence requirements, with the sectors, technologies, suppliers and actors to watch
- A list of trusted sources and any paid feeds the organization already licenses
- An asset or technology inventory, so vulnerabilities can be matched to what the organization runs
- Report templates for each product (daily digest, incident report, actor profile, newsletter)
- Past reports, to calibrate tone and level of detail
Systems to integrate
- Threat intelligence platform such as MISP or OpenCTI, for indicators of compromise
- SIEM or ticketing system, for vulnerabilities and detection requests
- Wiki, email or newsletter tool for the daily and weekly products
- Chat tool such as Slack or Microsoft Teams for alerts
- Asset inventory or CMDB for matching vulnerabilities to systems
Complexity: Medium
The software side is a configured platform plus a few integrations. Written intelligence requirements, a list of trusted sources, one report template per product and an agreement on who checks which output before it leaves the team take longer to settle than the set up. Newsletters sent to customers also need an owner for tone and legal wording.
- 1
Write the requirements before you buy a tool
List the questions your stakeholders ask and the sources you read to answer them. Measure how many hours a week the team spends collecting, summarizing and formatting. That baseline is what you compare against later.
- 2
Start with one product
Pick the report with the most routine writing, usually the daily or weekly digest, and build its template and feeds first. A narrow start makes errors easy to spot and gives analysts a reason to trust the next product.
- 3
Keep the analyst as the author
The AI drafts and the analyst signs. Require a source link for every claim in a draft, and have the analyst check indicators and technique names against the source before anything is pushed to a platform or a customer.
- 4
Connect the outputs
Push indicators into the threat intelligence platform, vulnerabilities into the ticketing system and summaries into the briefing page, using the same review step as the manual process.
- 5
Review the misses every month
Compare what the AI surfaced with incidents the team learned about elsewhere, and tune the feeds. Track how often stakeholders learn about something before the team tells them.
- 6
Spend the saved time on analysis
Decide in advance what the freed hours go to: trend reports, stakeholder briefings or hunting requests. Elastic and RH-ISAC both name this as the point of the exercise.
Guardrails
- Every claim in a draft links to the source article, and an analyst reads the source before publishing
- Indicators of compromise and framework technique identifiers are validated against the source or the framework before they enter a platform
- Content from the open web is treated as untrusted input, so text hidden in a page cannot steer the assistant or its tools
- Sharing restrictions such as the Traffic Light Protocol are applied by the analyst, never inferred by the model
- Confidential or member data is not sent to a model or service the organization has not approved for it
KPIs to instrument
- Analyst hours per week on collection, summarizing and formatting, before and after
- Share of AI drafts published with no change, with light edits and with major edits
- Errors found after publication (wrong actor, wrong indicator, wrong date) per month
- Time from first public report to an alert reaching stakeholders
- Incidents or vulnerabilities the team learned about elsewhere before its own feeds showed them
Human in the loop
An analyst owns every report that leaves the team. The AI selects, extracts and drafts; the analyst checks the sources, edits the text and adds the assessment of impact. Alerts to members or customers that name a victim need a second reviewer. RH-ISAC's analyst describes a quick fact check and edit of each AI summary, and in a crisis report he added his own analysis to the summary.
Common failure modes
- Invented details
- The model names a threat actor, technique or indicator that the source does not mention. mnemonic reports that its first attempt in 2023 failed because the models invented MITRE techniques that did not exist. Use an output schema, check identifiers against the framework and sample drafts against their sources.
- A confident summary of a wrong article
- Vendor blogs and social posts get ahead of the facts during a crisis. A fluent summary hides that. Keep the source list visible in the draft and label reporting by how well it is evidenced.
- Noise instead of signal
- Broad feeds return the whole internet. Narrow each feed to a requirement, name the owner of each feed and retire feeds nobody has acted on in a quarter.
- Analysts stop reading sources
- Once drafts look right, review becomes a glance. Rotate who reviews, and measure errors found after publication.
What are the risks and rules?
EU AI Act
Minimal risk
Summarising public threat reporting for an organization's own cyber defense is not an Annex III use, and recital 55 of the AI Act says components used solely for cybersecurity purposes do not qualify as safety components. The tier stays minimal while the assistant works on public sources and an analyst reviews and takes responsibility for what is published. It changes if the same tooling is used to profile or score employees.
Guidance
- Traffic Light Protocol (TLP) (FIRST, Global). The standard labels (red, amber, green, clear) that tell recipients how far a piece of intelligence may be shared; a draft written by an AI must keep the label of its sources.
- MITRE ATT&CK (MITRE, Global). The shared catalog of attacker techniques that reports and extraction tools map to, and the reference to validate technique identifiers against.
- OWASP Top 10 for LLM Applications (OWASP, Global). Lists prompt injection and excessive agency among the main risks of LLM applications, relevant when an assistant reads attacker controlled web pages.
Controls to put in place
- Named owner for the intelligence requirements and for each feed
- Source link on every claim, kept with the published report
- Validation of extracted identifiers and indicators before they enter a threat intelligence platform
- Approved model and data handling for confidential and member information
- Monthly sample of published reports checked against their sources
When it went wrong elsewhere
- mnemonic's first attempt to extract structured data from threat reports (2023). The security services company reports that its 2023 experiment with language models on threat intelligence reports was not good enough for production, because the models invented MITRE techniques, could not take long reports and gave inconsistent answers.
Frequently asked questions
- How much time does AI save a threat intelligence team?
Two organizations on this page report figures. RH-ISAC's case study, written by its vendor Feedly, says collection fell from 10 hours to two or three hours a week, a 70% to 80% cut. Elastic says its analysts recouped 75% of their time on report aggregation while report output rose by 92%, although its page calls these results illustrative. Both are self reported or vendor reported, so time your own baseline.
- Can AI write the threat intelligence report on its own?
It can write a first draft from your template and the articles you select, and the teams here publish only after an analyst checks it. RH-ISAC's analyst describes a quick fact check and edit of the AI summary, and in a crisis report he added his own analysis to it. The value of the report is the assessment of what the threat means for your organization, which the model does not know without your context.
- What goes wrong when a model reads threat reports?
Invented details and fluent summaries of weak sources. mnemonic says that in 2023 the models invented MITRE techniques that did not exist, and its 2026 detection engineering workflow (a related but separate use case) adds output schemas, tool access and reusable skills and still treats every result as a draft for an analyst. Validate identifiers against the framework and keep the source link on every claim.
- Is this the same as security alert triage?
No. Alert triage works on events inside your own systems. Threat intelligence works on reporting from outside, and its output is a briefing, a report or an indicator list. The two meet when an indicator or a new vulnerability from a report is matched against your own alerts and assets.
How to cite this page
Blits.ai AI Use Case Library, "AI for threat intelligence collection and reporting", last verified 13 October 2026, https://www.blits.ai/ai-use-cases/threat-intelligence-collection-and-reporting. Licensed under CC BY 4.0. Method: how we verify use cases.
Changelog
- 13 October 2026: First published