Threat Intelligence Sources: OSINT, Closed-Source Feeds, ISACs, and Internal Telemetry

Threat intelligence sources fall into four broad buckets: open-source intelligence (OSINT) gathered from publicly available material, closed-source intelligence obtained through paid subscriptions or restricted access, information sharing communities such as Information Sharing and Analysis Centers (ISACs), and internal intelligence derived from your own organization’s telemetry. Each bucket trades cost against curation, and access against relevance. A mature cyber threat intelligence (CTI) program blends all four, because no single source type answers every question a Security Operations Center (SOC) asks — choosing that blend is the collection phase of the threat intelligence lifecycle in action.

Open-source intelligence (OSINT)

OSINT is any intelligence gathered from publicly available sources that require no special access, payment, or clearance to obtain. That definition is the anchor: if anyone with an internet connection can read it, it is open source. Classic examples include news articles covering breaches, security vendor blogs publishing malware analyses, social media posts from researchers, public government advisories (such as national computer emergency response team bulletins), freely published vulnerability databases, and public code repositories where attackers sometimes leak tooling.

OSINT’s strengths are cost (free) and breadth — the community surface is enormous, and major campaigns are usually discussed publicly within days. Its weaknesses are the mirror image: no one curates it for you, quality is wildly uneven, attribution claims are frequently wrong or unverifiable, and popular indicators get republished endlessly, making it hard to tell independent confirmation from an echo chamber. OSINT consumers do their own vetting, which costs analyst time even when the data itself is free.

Closed-source intelligence

Closed-source (also called proprietary or commercial) intelligence is collected through channels the general public cannot freely access. The two examples worth internalizing are a paid commercial vendor feed — a subscription service delivering curated indicators and reporting — and a vendor’s or team’s private collection from restricted spaces, such as monitoring access-controlled criminal forums or drawing on the vendor’s own proprietary sensor network and customer telemetry. What makes a source “closed” is the barrier to access: money, membership, or privileged collection capability. A free public blog post is OSINT no matter how good it is; a paywalled feed is closed-source no matter how mediocre.

The legitimate advantages of paying for a closed feed are curation and vetting (a professional analysis team validates indicators before publishing, reducing false positives), timeliness (dedicated collection often surfaces campaigns before public reporting), context (reports arrive with attacker tactics, techniques, and procedures, targeting information, and confidence ratings rather than bare indicators), and support (you can ask the vendor questions). Closed-source is not automatically more accurate than OSINT — vendors make mistakes too — but the signal-to-noise ratio is contractually somebody’s job.

ISACs and information sharing communities

An Information Sharing and Analysis Center (ISAC) is a sector-specific community where member organizations share vetted threat intelligence with peers in the same industry — healthcare, financial services, energy, aviation, and so on. Membership is the defining mechanic: a hospital network that joins a healthcare ISAC both receives intelligence contributed by other healthcare organizations and contributes its own sanitized incident data back to the community. The model is reciprocal by design.

ISACs occupy a middle position between open and closed source. They are not public (membership is required, and shared data is often protected by traffic-light-protocol handling rules), but they are also not commercial products — the value comes from peers who face the same adversaries you do. That sector focus is the killer feature: intelligence from an organization in your own industry is pre-filtered for relevancy in a way no general-purpose feed can match. Related structures include Information Sharing and Analysis Organizations (ISAOs), which serve communities not organized around a single critical-infrastructure sector.

Internal intelligence: your own telemetry

The most underrated source is the one you already own. Internal intelligence is produced by analyzing your organization’s own data — Security Information and Event Management (SIEM) alert history, past incident tickets, endpoint detection and response (EDR) telemetry, firewall and DNS logs — to identify the attacker infrastructure and behaviors that specifically target you, then feeding those findings back into detection rules.

The primary advantage over relying solely on external feeds is relevance by construction. External intelligence describes what attackers do to someone; internal intelligence describes what attackers actually do to you — the phishing lures your users receive, the infrastructure that keeps reappearing in your logs, the recurring initial access attempts against your specific perimeter. Every indicator is pre-qualified as applicable to your environment, which eliminates the relevancy problem that plagues broad external feeds (see how analysts grade intelligence quality). Internal analysis also detects targeted campaigns that no external vendor will ever publish, because you are the only victim.

Comparing the source types

Source type	Access barrier	Cost	Curation	Relevance to you
OSINT	None — publicly available	Free (analyst time to vet)	None — self-vetted	Variable, often low
Closed-source / commercial	Payment or restricted access	Subscription fees	Vendor-vetted, high	Depends on feed focus
ISAC / sharing community	Sector membership	Membership dues	Peer-vetted	High — same-industry peers
Internal telemetry	Already yours	Analyst effort	Self-produced	Highest — targets your environment

In practice these are layered: OSINT for breadth, closed feeds for curated early warning, an ISAC for sector-specific relevance, and internal analysis to ground everything in what is actually hitting your network. Feeds from multiple layers then get aggregated and deduplicated downstream — the mechanics of that are covered in threat data enrichment and SOAR orchestration.

How the CS0-003 exam tests this

• A definition-style question describes information gathered from news articles, vendor blogs, and social media with no special access required and asks for the term — the answer keys on OSINT, and the “no special access or clearance” phrasing is the tell.
• A “choose two/three” item mixes source examples and asks you to classify them — sort by the access barrier: paid feeds and restricted-forum collection are closed-source; public advisories, blogs, and social media are OSINT.
• A scenario describes an industry organization (a hospital, a bank) joining a sector community that shares vetted intelligence among peers and contributes data back — the reciprocal, sector-specific arrangement is an ISAC.
• A scenario describes a team mining its own SIEM history, incident tickets, and EDR telemetry to build detections, then asks the advantage over external feeds alone — the exam wants direct relevance to the organization’s own environment and attackers, not “it’s cheaper” or “it’s faster.”
• A question asks for a legitimate advantage of a commercial feed over OSINT — pick curation/vetting, context, or dedicated timely collection; reject absolute claims like “guaranteed accurate” or “covers all threats.”

Source-classification items sit in the Security Operations domain — see the full CS0-003 study guide for domain weightings and exam format. These are some of the easier points on the exam, and a few rounds of realistic practice questions make the access-barrier tell unmistakable.

Quick reference

• OSINT = publicly available, no special access, payment, or clearance required; free to obtain but self-vetted.
• Closed-source = access-restricted collection: paid commercial feeds, private forum monitoring, proprietary vendor telemetry.
• Commercial feed advantages: professional vetting, added context (TTPs, targeting, confidence), early warning, vendor support.
• ISAC = sector-specific membership community; members receive vetted peer intelligence and contribute sanitized incident data back.
• ISAC intelligence is pre-filtered for relevancy because it comes from organizations facing the same sector threats.
• Internal intelligence (SIEM history, incident tickets, EDR telemetry) is the most relevant source — it describes attacks on your environment.
• Internal analysis catches targeted campaigns external vendors will never publish.
• Mature CTI programs layer all four source types rather than depending on any single one.