This threat intelligence case study of a Saudi financial institution starts with a problem many CISOs will recognize. The institution subscribed to several feeds, received a large daily volume of indicators, and could not point to a single blocking, patching or reporting decision that a feed had changed. The details below are anonymized and describe a pattern rather than a named engagement.
The situation: volume without decisions
The security operations team ingested indicators from global sources. Analysts spent time triaging alerts that referred to campaigns with no visible connection to the Kingdom or to the financial sector. Meanwhile, the board received a quarterly slide with counts of indicators processed, which told directors nothing about exposure.
Three symptoms stood out:
- Feed volume was reported as a success measure, while no one tracked what action followed.
- Patching priorities were set by severity scores alone, without regard to which weaknesses were being used against Saudi organizations.
- Board reporting described activity, not risk, so directors could not decide anything from it.
Signs it is time to change the approach
An organization usually needs a different intelligence approach when several of these are true:
- Analysts cannot say which feed produced the last meaningful block.
- Alerts are closed as irrelevant far more often than they lead to action.
- Vulnerability queues are ordered by generic scores, and the business questions why one item comes before another.
- Leadership asks whether a publicized threat applies to the institution and the answer takes days.
- Spending on feeds renews each year without evidence of use.
The principle: intelligence is judged by the decision it informs
Our Threat Intelligence service is built on one idea. It provides actionable cyber threat intelligence focused on the threats targeting Saudi organizations, not generic global feeds, but intelligence that informs real decisions. That sentence also defines the test applied in this case. A source earns its place only if it can be tied to a decision someone made or should have made.
Step one: map every feed to a decision
The first piece of work was an inventory. For each feed and report, the team recorded who consumed it, what decision it could inform, and whether it had actually done so in the recent past. Decisions were grouped into three families: what to block or detect, what to patch first, and what to tell leadership.
The result was uncomfortable but useful. Some feeds fed automated blocking and were clearly used. Others were read by one analyst out of habit. A few produced indicators that nobody had ever matched to the institution's own environment. The feeds that drove decisions were kept and tuned. The ones that only added noise became candidates for removal at renewal.
Step two: narrow the focus to threats aimed at Saudi organizations
The next change was relevance. Rather than treating all global activity as equal, the institution oriented its intelligence around actors, campaigns and techniques directed at Saudi organizations, with particular attention to financial services. The question for every item became: does this plausibly apply to us, given our technology, our customers and our position in the Kingdom?
This filter changed three working areas.
Blocking
Indicators were prioritized by relevance and confidence rather than ingested in bulk. Detection content was written around the behavior of threats seen against Saudi targets, which gave analysts fewer but more meaningful alerts. Blocking rules were reviewed so that each had an owner and a reason.
Patching priorities
Vulnerability management had relied on severity scores. The team added a second question: is this weakness being exploited against organizations like ours? Items that met that condition moved up the queue, with a documented reason that engineering teams could accept. Items with high scores but no relevant activity were scheduled normally rather than treated as emergencies. The effect was a shorter, better-justified list for operations to work through.
Board reporting
The quarterly slide of indicator counts was replaced with a short narrative. It named the threats most relevant to the institution, stated what the institution had done in response, and set out decisions that needed board attention, such as funding a control gap or accepting a stated risk. Directors could now see why a recommendation was made and what would happen if it were deferred.
Aligning with regulatory expectations
Saudi financial institutions operate under the Saudi Central Bank (SAMA) Cyber Security Framework, which includes expectations on threat management and on keeping senior leadership informed. The National Cybersecurity Authority (NCA) also publishes controls, including the Essential Cybersecurity Controls, that address cybersecurity monitoring and governance. Intelligence tied to decisions gives the institution evidence that threat information is used in operations and in governance, rather than collected and left unused. We do not cite specific control numbers here, because applicability depends on the institution's licensing and scope.
What a good outcome looks like
A well-run intelligence function is recognizable by its behavior rather than its volume. In this case, the institution could demonstrate the following:
- Each retained feed was linked to at least one named decision.
- Analysts could explain why a given indicator or report mattered to the institution.
- Patching order reflected both severity and relevance to threats in the Kingdom.
- Board papers contained decisions and rationale, not counts.
- Renewal conversations with feed providers started from evidence of use.
A test you can run on your own feeds
You can apply the same method internally without outside help. Take each feed and answer five questions:
- Who reads it, and how often?
- What decision can it inform: block, patch or report?
- When did it last change one of those decisions?
- Does it say anything specific to Saudi organizations or to our sector?
- If it disappeared tomorrow, what would we miss?
Feeds with clear answers to questions three and five drive decisions. Feeds without them are probably adding noise, and the cost is analyst attention as much as the subscription fee.
Common pitfalls
Some patterns recur. Teams sometimes cut feeds before establishing what they do, which removes useful coverage along with the noise. Others add a Saudi-specific source but never connect it to blocking or patching workflows, so it joins the pile of unread reports. A third pitfall is reporting to the board in the language of the SOC. Directors need exposure, action and choices, not technical artifacts.
Next step
If your organization pays for threat information but cannot show what it has changed, our Threat Intelligence service is designed for that gap. It focuses on the threats targeting Saudi organizations and on intelligence that informs real decisions. To discuss whether your current feeds are earning their place, contact CISO Consulting and we will start from the decisions you need to make.
