# Three Threat-Intelligence Budget Questions Every Board Should Ask Before Approving the Annual Cybersecurity Plan
When board members and executive committees review the annual cybersecurity budget at Saudi financial institutions and critical infrastructure operators, threat intelligence often appears as a line item with a substantial cost but little explanation of what it delivers. Many organizations subscribe to global threat feeds that generate thousands of indicators daily, yet the intelligence rarely influences which controls the institution deploys, which vulnerabilities it prioritizes, or which risks it accepts. The board threat intelligence budget questions that matter are not about the volume of data but whether the intelligence answers three specific questions: which threat actors target our sector, which tactics bypass our current controls, and how intelligence findings will change next quarter's priorities.
This article shows what actionable answers look like and how directors can distinguish intelligence that drives decisions from vendor noise that fills reports.
The Problem with Generic Global Threat Feeds
Most commercial threat feeds deliver global indicators—IP addresses, file hashes, domain names—drawn from incidents worldwide. The feeds are comprehensive by design, covering ransomware campaigns in North America, phishing operations in Europe, and credential-theft botnets across Asia. For a Saudi financial institution or energy operator, the challenge is not the quality of the data but its relevance. A board approving a budget line for threat intelligence should expect the service to answer questions specific to the institution's risk profile, not to provide a global catalogue.
The three questions below define what actionable intelligence looks like. If the proposed service cannot answer them, the board should ask why the institution is paying for it.
Question One: Which Threat Actors Target Our Sector in This Region?
The first question a board should ask is whether the intelligence identifies the specific threat actors—state-sponsored groups, financially motivated syndicates, or ideologically driven collectives—that have demonstrated intent and capability to target organizations in the institution's sector and geography.
Actionable intelligence names the actors. For a Saudi bank, this means knowing which advanced persistent threat groups have conducted operations against financial institutions in the Gulf, which ransomware operators have targeted Arabic-language environments, and which insider-threat patterns appear in regional cases. For a critical infrastructure operator, it means understanding which state actors have probed supervisory control and data acquisition systems in the energy sector and which hacktivist groups have announced campaigns against utilities in the Kingdom.
Generic feeds report that "APT groups are active" or "ransomware attacks are increasing." Actionable intelligence states that a specific group, identified by its tactics and infrastructure, has compromised institutions similar to yours in the past twelve months, and explains how.
When reviewing the budget, ask the chief information security officer to name three threat actors that the proposed intelligence service tracks and to explain why those actors matter to your institution. If the answer is vague or global, the service is unlikely to inform real decisions.
Question Two: Which Tactics Bypass Our Current Controls?
The second question is whether the intelligence identifies the specific techniques that adversaries use to evade the controls the institution has already deployed. Every organization invests in endpoint detection and response platforms, security information and event management systems, firewalls, and email gateways. The value of threat intelligence lies in revealing which adversary tactics succeed despite those investments.
Actionable intelligence maps tactics to control gaps. It explains that a particular phishing technique bypasses the current email gateway because it uses a legitimate cloud service for command and control, or that a credential-dumping tool evades the deployed EDR because it operates entirely in memory without touching disk. It shows that a specific lateral-movement method is invisible to the SIEM because the institution's logging configuration does not capture the relevant Windows event IDs.
This level of detail allows the board to understand not only what threats exist but also where the institution's defenses are blind. It turns intelligence into a prioritization tool: if adversaries targeting your sector routinely bypass multi-factor authentication using a known technique, the budget discussion shifts from whether to invest in MFA—already done—to which additional controls address the bypass.
When the CISO presents the threat-intelligence budget, ask for an example of a tactic that the proposed service identified in the past year and how that finding led to a change in controls or configuration. If the service has not yet been procured, ask how the vendor will deliver this level of specificity. If the answer is that the service provides "threat reports" or "briefings," press for concrete examples of tactics and control recommendations.
Question Three: How Will Intelligence Change Next Quarter's Priorities?
The third question is whether the intelligence produces a forward-looking roadmap that links findings to the institution's quarterly or annual control priorities. Threat intelligence should not be a retrospective exercise. Its purpose is to inform decisions about where to allocate budget, which vulnerabilities to patch first, which user behaviors to address through training, and which detection rules to write or tune.
Actionable intelligence includes a quarterly roadmap. It states that based on current adversary activity, the institution should prioritize patching a specific class of vulnerabilities in the next thirty days, should deploy additional monitoring for a particular network protocol by the end of the quarter, and should update incident-response playbooks to address a new ransomware tactic observed in recent regional incidents. The roadmap is specific enough that the board can return in three months and ask whether the recommended actions were completed and whether subsequent intelligence validated or revised those priorities.
This approach transforms threat intelligence from a passive information feed into an active planning tool. The board's role is to ensure that the intelligence budget delivers a decision-making input, not a reading list. Ask the CISO how the proposed intelligence service will be integrated into the quarterly risk review and which executive is accountable for acting on its recommendations. If the answer is that "the security team will review the reports," the intelligence is unlikely to influence priorities.
What Boards Should Expect in a Threat-Intelligence Proposal
When the executive committee reviews the cybersecurity budget and encounters a line item for threat intelligence, the proposal should include clear answers to the three questions above. The board should expect to see:
- A list of named threat actors relevant to the institution's sector and region, with a brief explanation of why each matters.
- Examples of tactics, techniques, and procedures that adversaries have used to bypass controls similar to those the institution has deployed, and a description of how the intelligence service will identify new bypasses.
- A sample quarterly roadmap showing how intelligence findings translate into prioritized actions—specific patches, configuration changes, detection rules, or training topics—with timelines and accountable owners.
If the proposal does not include these elements, the board should ask the CISO to revise it or to explain why the proposed service cannot deliver them. The absence of specificity is a signal that the service may be a generic feed rather than actionable intelligence.
The Regulatory Context in Saudi Arabia
Saudi financial institutions and critical infrastructure operators face explicit regulatory expectations for threat intelligence. The Saudi Central Bank's Cyber Security Framework requires institutions to maintain awareness of threats relevant to their operations and to use that awareness to inform risk assessments and control decisions. The National Cybersecurity Authority's Essential Cybersecurity Controls and Cloud Cybersecurity Controls frameworks both emphasize the importance of threat-informed defense—designing and operating security controls based on an understanding of adversary behavior.
These frameworks do not prescribe a specific threat-intelligence service, but they do establish the board's duty to ensure that the institution's cybersecurity posture reflects current threats. A generic global feed that does not answer the three questions above is unlikely to satisfy that duty. The board's oversight role includes verifying that the intelligence budget produces the specificity the regulators expect.
Distinguishing Actionable Intelligence from Vendor Noise
The cybersecurity market offers dozens of threat-intelligence products, and many vendors emphasize the volume of indicators, the speed of updates, or the breadth of coverage. These attributes matter for certain technical use cases—blocking known-bad IP addresses, for example—but they do not answer the strategic questions a board must ask.
Actionable intelligence is distinguished by relevance, specificity, and forward orientation. It is relevant because it focuses on the threats targeting the institution's sector and region, not the global threat landscape. It is specific because it names actors, describes tactics, and identifies control gaps, not because it delivers thousands of indicators. It is forward-oriented because it produces a roadmap for the next quarter, not a retrospective report on last month's incidents.
When evaluating a threat-intelligence proposal, the board should ask the CISO to demonstrate these three qualities with concrete examples. If the vendor or internal team cannot provide them, the board should question whether the proposed budget will deliver value.
How CISO Consulting Delivers Actionable Threat Intelligence
Organizations that need threat intelligence focused on the threats targeting Saudi institutions—rather than generic global feeds—require a service that answers the three questions this article describes. Actionable cyber threat intelligence focused on the threats targeting Saudi organizations informs real decisions about which controls to deploy, which vulnerabilities to prioritize, and which risks to accept.
The value of such intelligence is measured not by the number of reports it generates but by the clarity of the decisions it enables. Boards and executive committees that ask the three questions before approving the threat-intelligence budget will ensure that the investment delivers actionable intelligence, not vendor noise.
If your institution is preparing its annual cybersecurity budget and the threat-intelligence proposal does not answer which actors target your sector, which tactics bypass your controls, and how intelligence will change next quarter's priorities, it may be time to reconsider what you are buying and from whom.
