From Access to Action: What State and Local Agencies Are Learning About Threat Intelligence

Most of the agencies I work with can tell me, without pausing, how many threat intelligence sources they receive. A state bulletin. A sector community. Federal advisories. Something bundled into a security product they already own. Notes from a peer in the next county. By any reasonable standard, that is solid coverage, and it reflects years of deliberate effort by people who built it while doing three other jobs.

The question I have started asking instead is a quieter one. Not what intelligence you receive, but what happened after it arrived last month.

That question is harder, and not because anyone is doing anything wrong. It is harder because the steps between an advisory landing in an inbox and a firewall rule changing are mostly manual, and the people who would perform them are also running the help desk, managing the network, supporting a council meeting, and closing out a grant report. Research on local government security capacity bears this out consistently: roughly 80 percent of surveyed local governments operate with fewer than five dedicated security staff.

That reality shapes everything worth saying on this topic. Any recommendation that assumes a dedicated intelligence analyst is not a recommendation. It is a wish.

Why this is a useful moment to look

Last year, federal funding support for MS-ISAC membership ended and membership moved to a fee-based model. Reported participation shifted significantly, and a number of states responded by purchasing statewide memberships that preserved access for their agencies and eligible local entities. For many agencies, that intervention meant coverage continued largely uninterrupted.

The change is worth noting here not as a cause for concern, but because it created something agencies rarely get: a natural prompt to look at arrangements that had been running quietly for years. Information sharing organizations do essential work, and nothing in this piece suggests otherwise. What the change offers is an opening to ask a question most agencies have not had a reason to ask recently.

When coverage changed, what changed downstream?

For agencies where a source lapsed and nothing downstream moved, that is genuinely useful information. It does not mean the source lacked value. It usually means the path from that source to a defensive decision was never fully built, which is an entirely ordinary situation and a very fixable one. It also means that adding a replacement source, on its own, is unlikely to change the outcome.

What I am hearing in the field

I recently met with a top 80 U.S. City threat intelligence analyst.  He’s a one man shop that looks at a few OSINT sources every day, subscribes to a paid premium intel feed and has access to MS-ISAC intelligence. His concern is that he spends most of his day trying to correlate the various data sources and knows that he is missing threats and doesn’t have a good way to prioritize his work effort to the threats that apply to his City’s environment.  His manager told him that they do not have the budget for a Threat Intelligence Platform. He feels hopeless.

A state agency recently told me that they had bought a TIP but after 10 months, they were still struggling with connecting their TIP via STIX/TAXII to some of their agency's internal tools.  They were able to ingest some paid data and enrichment sources via the API but without connectivity with their state agencies tools, they weren’t able to take quick actions.  It was taking them days to manually take actions and they weren’t sure that all of their recommended actions were being acted on by the groups they were manually interfacing with. There was no single system of record for actions taken.

Water utilities have been in the news lately.  While meeting with a mid size municipal water utility, the cyber professional indicated that he was responsible for all things cyber and that he was actually a mechanical engineer by trade.  His primary responsibility for years was to keep the pumps pumping and that he’d just been assigned cyber responsibility two years earlier.  He was overwhelmed and was having trouble with handling just the basics.  His email box was full with advisories he hadn’t gotten too.

What stands out across these conversations is that these weren't simply problems of intelligence coverage or a lack of diligence. Each agency had access to threat information, but struggled to translate it into meaningful defensive action. One lacked the resources to correlate and prioritize intelligence. Another had invested in technology but couldn't operationalize it across existing systems. The third was overwhelmed by competing responsibilities and a growing backlog of advisories.

The common challenge wasn't access to intelligence. It was the ability to determine what mattered, prioritize the next steps, and ensure action was taken.

Where intelligence tends to slow down

In practice, intelligence that does not reach a defensive action usually slows at one of three points. Naming which one applies to your agency is worth more than any general improvement effort, because the three call for different responses.

Relevance. Intelligence arrives, but it is difficult to say with confidence whether a given threat applies to your environment. An advisory about an industrial control protocol is urgent for a water utility and not applicable to a courthouse. Without a current picture of what the agency runs, everything arrives looking similarly important. The usual root cause is simply that the record of what the agency operates lives in one experienced person’s memory rather than in a document. Closing this gap starts with context: knowing what you run, and assessing incoming intelligence against that picture rather than from scratch each time.

Processing. Several sources arrive in different formats, often describing the same campaign in different ways. Someone has to read across them, recognize the overlap, extract what matters, and judge priority. That work is skilled and repetitive, and it is being performed independently by every agency receiving the same advisories. It is also the one that gets harder as coverage improves, which is worth knowing before adding a source. The structural answer is consolidation into a single operating view, so that duplicate reporting is recognized as duplicate before it reaches a person.

Actioning. This one receives the least attention, because it sits at the end of a process everyone reasonably assumes is working. The threat was identified correctly and prioritized correctly. The indicator still has to reach the firewall, the endpoint platform, or the SIEM, and that path may run through a manual export, a ticket, a change window, or a service commitment written before anyone anticipated this scenario. Where the manual steps are the constraint rather than the decision, removing the repetitive handoffs is usually what moves the number.

These three interact, which is why single-point improvements can feel disappointing. More input into a process that is slow at the end produces more backlog rather than more defense.

A note on what technology does not fix

I work for a threat intelligence company, so it is worth being direct about this.

For a meaningful share of the agencies I speak with, the most valuable improvement available is not a purchase. If a review step has no named owner, better intelligence will reach the same unowned inbox. If a provider’s response commitment is measured in business days and the agency’s risk tolerance is measured in hours, that is a renewal conversation. If both parties believed the other was handling triage, that is a thirty minute clarification with a large return.

Those fixes are free, and they should come first. Agencies that work through them and still find a genuine capability gap are in a far stronger position afterward, both operationally and when they go to a budget holder, because they can show the inexpensive options were exhausted.

What is Next: Put Your Threat Intelligence into Action

Over the past several months, we have been working with state and local teams to understand the challenges of turning threat intelligence into meaningful defensive action. Those conversations have shaped a practical resource designed to help agencies assess their capabilities, identify gaps, and take actionable steps toward stronger cybersecurity.

Our new handbook, Collective Defense for State and Local Agencies – A Cybersecurity Handbook, is now available.

Built for lean security teams, the handbook includes practical tools agencies can put to work immediately:

• 10-minute intelligence-to-action diagnostic: Assess your current capabilities across five critical dimensions.

• Practical advisory exercise: Evaluate how effectively your agency translates threat intelligence into defensive action.

• One-page improvement plan: Identify priorities and build a roadmap for discussions with leadership and budget holders.

• Security provider assessment questions: Understand what to ask your existing providers and how to evaluate their responses.

The handbook does not assume that improving cybersecurity requires additional technology or budget. For many agencies, meaningful progress starts with making better use of existing resources, strengthening provider coordination, and turning shared intelligence into coordinated action.

Download the handbook and take the next step toward stronger, whole-of-state collective defense.