Key takeaway: Indicators are cheap, abundant and short-lived. Behavioural patterns are harder to obtain and vastly more durable, because attackers change infrastructure far more readily than technique.
The Pyramid of Durability
Not all indicators are equally valuable, and the difference is how easily an attacker can change them.
| Indicator type | Attacker cost to change | Useful lifetime |
|---|---|---|
| File hash | Trivial — recompile | Hours |
| IP address | Trivial — new host | Days |
| Domain name | Low — new registration | Days to weeks |
| Network signature | Moderate | Weeks to months |
| Tooling | High | Months |
| Technique and procedure | Very high | Years |
Feeds overwhelmingly supply the top rows because they are automatable. A hash blocklist is trivial to produce and trivial to defeat — changing a single byte produces a new hash.
The bottom rows require analysis rather than collection. Knowing that an actor establishes persistence through scheduled tasks with a specific naming convention, or reliably uses a particular archiving utility before exfiltration, yields detections that survive infrastructure churn entirely.
Where Indicator Feeds Do Help
Indicators are not worthless; they are just misapplied. They are genuinely useful for retrospective search — asking whether a newly published indicator appeared anywhere in the last ninety days of logs. That answers were we already compromised, which is a question worth asking and one that indicators are well suited to.
They are also fine as low-cost blocking, provided the expectation is correct. Blocking known-bad infrastructure stops opportunistic and unsophisticated activity. It will not stop anyone who reads the same feeds you do.
What indicators cannot do is provide detection coverage. An organisation whose detection strategy consists of feed matching is protected against attacks that already happened to somebody else.
Making Intelligence Actionable
The test for any intelligence report is whether it changes something. Most do not, and reading them is therefore a cost without a benefit.
A useful report answers three questions: does this actor target our sector or technology, do we have the exposure they exploit, and what detection or control would address it. If none of those produce an action, the report was interesting rather than useful.
Mapping to a framework such as MITRE ATT&CK converts narrative into coverage assessment. Once techniques are catalogued, you can ask which you detect, which you would miss, and where to invest — a question that a list of IP addresses cannot inform.
Prioritising by Relevance
Generic global reporting is far less valuable than sector-specific reporting, because actor targeting is not uniform. Industry sharing groups, sector CERTs and peer relationships supply intelligence about attacks aimed at organisations that look like yours.
Your own incident history is the most relevant source of all and the most neglected. Techniques that were used against you previously are disproportionately likely to be used again, and detections built from your own incidents are guaranteed to be relevant.
The Bottom Line
Use indicator feeds for retrospective hunting and cheap blocking, not for detection coverage. Invest analyst time in behavioural patterns mapped to a technique framework, prioritise sector-specific sources, and mine your own incident history first.
