Threat intelligence supply chain is full of weak links, researchers find

Georgia Tech researchers demonstrate that the global threat-intelligence ecosystem is vulnerable to adversarial influence and uneven data sharing: their experiment using benign, trackable binaries revealed that most vendors perform shallow analysis, few share binaries or comprehensive telemetry, and a small set of "nexus" vendors drive propagation while bottlenecks cause delays. They propose encoding provenance for threat intelligence and creating transnational governance structures so operators can trust and use policy-compliant intelligence without relying on source country, aiming to improve timely and secure sharing across geopolitical boundaries.