Threat Intelligence
Evidence-based information about attacker tactics, exploits, and known threats. ORDR incorporates CISA KEV data and EPSS probability scores to contextualize threats within the actual asset environment.
What is Threat Intelligence?
Evidence-based information about attacker tactics, exploits, and known threats. ORDR incorporates CISA KEV data and EPSS probability scores to contextualize threats within the actual asset environment.
Threat intelligence is evidence-based knowledge about the tactics, techniques, and procedures (TTPs) of threat actors, the exploits and tools they use, and the indicators (IoCs) that identify their activity. Threat intelligence enables security teams to anticipate and detect threats rather than only reacting to them after damage is done. Applied to connected asset environments, threat intelligence operationalizes knowledge about known ICS attacks, OT-specific malware, and IoT botnets.
The operational application of threat intelligence to IoT and OT requires context that generic IT threat feeds don't provide. A threat intelligence feed that surfaces a new Cobalt Strike command-and-control IP is valuable for IT detection but irrelevant to a PLC. ICS-specific threat intelligence — CISA ICS-CERT advisories, ICS-targeted malware signatures, OT-specific attack TTPs — is directly applicable to industrial environments. Healthcare threat intelligence covering medical device exploitation, DICOM vulnerabilities, and ransomware group TTPs targeting HDOs is similarly specialized.
The CISA Known Exploited Vulnerabilities catalog is a form of operationalized threat intelligence: it converts the abstract threat landscape into a specific list of CVEs that are actively weaponized. KEV integration is one of the highest-value threat intelligence applications for connected asset vulnerability management.
Key Facts
- CISA's ICS-CERT publishes 200+ industrial-specific security advisories per year
- The average time from threat intelligence publication to attacker exploitation is now less than 15 days
- ORDR automatically maps new CISA KEV additions to affected devices in the environment within hours of publication
- ICS-specific threat intelligence requires OT context to apply accurately — generic IT feeds miss industrial threat actor TTPs
How ORDR Addresses Threat Intelligence
ORDR integrates threat intelligence from CISA (KEV catalog, ICS-CERT advisories), EPSS data, and commercial threat intelligence feeds into its risk scoring and detection engines. When new threat intelligence identifies a vulnerability or IoC relevant to connected assets in the environment, ORDR immediately surfaces affected devices and updates their risk scores — turning threat intelligence into device-specific, actionable insight.
See ORDR in actionFrequently Asked Questions
Complete visibility across your entire attack surface.
ORDR unifies IT, IoT, and OT asset intelligence so your team can see—and act on—what matters most.