Dead Intelligence: The Hidden Cost of Running Your SOC on Expired Threat Data

The threat intelligence market has expanded dramatically over the past decade, and the pitch has remained consistent: ingest more indicators, detect more threats. Security teams have largely accepted this framing, building detection stacks that consume feeds from multiple vendors, open-source repositories, and government sharing programs simultaneously. The volume is impressive. The utility is often not.

The uncomfortable reality facing many security operations centers is that a substantial proportion of the indicators of compromise populating their detection rules are no longer operationally relevant. IP addresses rotate. Domains are abandoned and re-registered. Command-and-control infrastructure gets sinkholed within days of public disclosure. Yet the rules built around these indicators persist, generating noise, consuming analyst cycles, and creating the appearance of a robust detection capability that does not, in practice, reflect how current adversaries operate.

The Indicator Decay Problem

Indicators of compromise have a half-life. The precise duration varies by indicator type, threat actor sophistication, and the speed of public disclosure, but the pattern is consistent: the moment an IOC appears in a shared feed, its operational value begins declining.

For commodity malware campaigns using shared infrastructure, that decline can be measured in hours. Threat actors monitoring public feeds—and sophisticated ones do—will rotate infrastructure the moment they detect their indicators have been published. The IOC that your SIEM ingested this morning may already be pointing at infrastructure that has been repurposed, abandoned, or taken over by a sinkhole operator.

Longer-lived indicators, such as file hashes for specific malware samples or behavioral signatures tied to a particular threat group's tooling, retain value for longer periods. But even these degrade as adversaries iterate on their capabilities. A detection rule anchored to a hash from a 2022 campaign provides no protection against a recompiled variant deployed in 2025.

The Economics of Threat Intel Subscriptions

Enterprise threat intelligence subscriptions represent a meaningful budget line for most security organizations. Annual costs for commercial feeds range from tens of thousands to hundreds of thousands of dollars, depending on coverage breadth and vendor tier. Government-adjacent sharing programs like ISAC memberships add further overhead in staff time required to process and operationalize incoming data.

The return on that investment is rarely measured rigorously. Most organizations track the volume of indicators ingested and the number of alerts generated against those indicators. Few measure what percentage of those alerts correspond to genuine threats versus aged infrastructure that is no longer associated with malicious activity.

This creates a perverse incentive structure. Vendors are rewarded for feed volume and novelty. SOC teams demonstrate program activity through alert counts. No one is systematically asking whether the indicators driving those alerts represent realistic current threats or expensive historical artifacts.

Benchmarking Detection Coverage Against Operational Cost

A more disciplined approach begins with decomposing the detection program by indicator source and measuring outcomes at each layer. For each feed or sharing program the organization consumes, security teams should be able to answer the following questions:

• What percentage of alerts generated from this feed result in confirmed true positives over a rolling 90-day window?
• What is the average age of indicators in this feed at the time of ingestion?
• What is the median time-to-rotation for infrastructure-based indicators from this source?
• What analyst hours are consumed responding to alerts from this feed per quarter?

Teams that conduct this analysis for the first time are frequently surprised by the results. Feeds with the highest vendor visibility scores often produce the lowest true-positive rates, because they are optimized for breadth and timeliness of publication rather than operational relevance to any specific organization's threat profile.

A Framework for IOC Triage and Purge

Not all indicators deserve equal treatment, and not all should be retained indefinitely. The following framework provides a structured basis for determining which IOCs merit active monitoring and which should be retired.

Tier 1 — Active Monitoring: Indicators directly correlated with threat actors known to target the organization's sector, geography, or technology stack. These should be sourced from intelligence with demonstrated relevance, reviewed monthly, and retired if no corroborating activity is observed within 60 days.

Tier 2 — Passive Logging: Indicators from credible feeds with no direct sector relevance but meaningful prevalence in recent campaigns. Log matches without generating analyst alerts. Review quarterly for promotion to Tier 1 or retirement.

Tier 3 — Archive or Purge: Indicators older than 90 days with no confirmed true positives, sourced from feeds with consistently low signal-to-noise ratios, or corresponding to infrastructure types known to rotate rapidly. Remove from active detection pipelines and document the rationale for retirement.

This tiering approach does not reduce detection coverage—it concentrates detection resources on indicators with demonstrated relevance, which improves both detection fidelity and analyst efficiency.

Behavioral Detection as the Long-Term Complement

The structural limitation of IOC-based detection is that it is inherently retrospective. By definition, an indicator of compromise describes something that has already been observed. Adversaries who understand this dynamic invest in capability development that outpaces indicator publication cycles.

The most resilient detection programs treat IOCs as a tactical layer within a broader strategy anchored in behavioral analytics. Detecting the techniques and patterns associated with adversary behavior—lateral movement, credential access, command-and-control communication patterns—provides coverage that does not degrade as infrastructure rotates. MITRE ATT&CK provides a useful framework for mapping behavioral detection coverage across the tactics and techniques most relevant to an organization's threat profile.

Investing a portion of the budget currently allocated to high-volume, low-fidelity IOC feeds into behavioral detection rule development and tuning will, for most organizations, yield a substantially better return.

The Budget Conversation

Security leaders making the case for reallocating threat intelligence spend face a familiar challenge: volume metrics are easy to present, and behavioral detection improvements are harder to quantify. The most effective approach is to run the IOC triage analysis described above, document the analyst hours consumed by low-fidelity alerts, and present the cost of that noise as a concrete operational expense rather than an abstract risk discussion.

Dead intelligence is not free. It has a price measured in analyst attention, alert fatigue, and the opportunity cost of detection capacity directed at expired infrastructure rather than current adversary behavior. Making that cost visible is the first step toward spending the threat intelligence budget on data that actually defends the organization.