A recent Cyware survey conducted at InfoSec Europe 2025 highlights significant challenges in operationalizing threat intelligence programs, with 80 percent of security professionals noting their programs are not fully effective. The findings underscore a growing demand for AI-driven automation to address gaps in maturity, context, and response capabilities within cybersecurity operations.
80% of respondents report threat intelligence programs are not fully operationalized.
Top challenges: too many feeds (30%), lack of automation (29%), and staffing shortages (18%).
Most desired TIP features: automation (48%), contextualization (37%), accurate risk scoring (34%).
51% see AI as key for automating threat triage and prioritization with human oversight.
Only 20% of programs are fully integrated with response workflows.
75% recognize the need for improved threat intelligence sharing practices.
The Cyware survey, conducted Helaas from security professionals at InfoSec Europe 2025, reveals that while most recognize the importance of threat intelligence programs, 80 percent admit their programs lack full operational maturity. Key challenges include managing excessive data feeds with insufficient context (30 percent), limited automation and playbook capabilities (29 percent), and inadequate staffing (18 percent). These issues highlight the need for modern threat intelligence platforms (TIPs) that leverage AI to streamline processes and enhance actionable outcomes. “The survey confirms what many in the industry are already feeling – that traditional approaches to threat intelligence are no longer enough,” said Brett Candon, VP International at Cyware.
Security professionals identified automation (48 percent), contextualization and enrichment (37 percent), and accurate risk scoring (34 percent) as the most critical TIP capabilities. Over half (51 percent) believe AI is ideally suited for automating threat triage and prioritization, though 61 percent emphasize the need for human oversight for actions like blocking indicators of compromise or quarantining endpoints. “We are excited to see this validation, coming straight from security practitioners, for how we’ve designed automation across the threat intelligence management lifecycle,” said Anuj Goel, CEO and Co-founder of Cyware. Cyware’s platform automates ingestion, normalization, de-duplication, enrichment, and threat actioning to accelerate workflows.
The survey exposes significant gaps in response integration and intelligence sharing. Only 20 percent of respondents reported fully operationalized threat intelligence programs with integrated response workflows, while just 17 percent of legacy TIP users leverage automation for response workflows and 27 percent for incident enrichment. Furthermore, only 16 percent of TIP users actively share intelligence with partners, despite 75 percent acknowledging the need for improved sharing practices. Additionally, only 38 percent have defined processes for sharing threat intelligence with their supply chain, indicating missed opportunities for collaborative defense.
The growing complexity of cyber threats is driving demand for AI-powered tools that enhance context, automate workflows, and enable real-time decision-making. The survey highlights that 39 percent of respondents value AI-assisted correlation of indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) as the most valuable capability in an AI-powered TIP. This reflects a shift toward AI-driven solutions that maintain human oversight while improving efficiency in defending against sophisticated cyber threats.
Cyware’s InfoSec Europe 2025 survey underscores the urgent need for advanced, AI-driven threat intelligence platforms to bridge operational gaps. By automating key processes and enhancing collaboration, modern TIPs can transform fragmented data into actionable, real-time decisions, empowering cybersecurity teams to stay ahead of evolving threats. As the industry embraces AI and automation, organizations can achieve greater resilience and effectiveness in their security operations.
Cyware is leading the industry in operational threat Intelligence and collective defense, helping security teams transform threat intelligence from fragmented data points to actionable, real-time decisions. We unify threat intelligence management, intel sharing and collaboration, as well as hyper-orchestration and automation — eliminating silos and enabling organisations to outmaneuver adversaries faster and more effectively.
TechIntelPro empowers B2B technology decision-makers with the latest industry trends, deep insights, leadership perspectives and actionable intelligence to drive both organizational and professional milestones—and thrive on the tech pulse.