Threat intelligence sharing between cybersecurity vendors: Network, dyadic, and agent views

Abstract

Real-time actionable threat intelligence is an emerging defense concept focused on detection and mitigation of cyber threats. The sharing of this information between parties reduces duplication of effort and allows one organization’s detection to become another’s prevention. Although there are deployments of threat intelligence sharing across different sectors, the partnerships formed between vendors in the cybersecurity market space have a significant coopetition attribute. This article aims to improve the understanding of those relationships through an empirical study by answering questions such as the following. What insights can be derived from the network structure formed between the vendors? What are the characteristics of the established relationships? Are there any properties that are common among sharing firms? The research is based on a uniquely coded dataset of vendors and their threat-sharing relationships studied from industry, dyadic, and firm perspectives. The methodology relies on a deductive-reasoning top-down approach and utilizes graph visualization and statistical analysis tools. The key findings are as follows: (i) the cybersecurity industry exhibits a small-world structure associated with communities, suitable for effective intelligence sharing, (ii) the collaborations are characterized by coopetition between loosely integrated complementary solutions, and (iii) the number of threat-sharing relationships of a firm is positively associated with its innovation level; the effect size is nearly three times stronger among publicly traded companies than privately held companies. The article aims to contribute to both domain knowledge and methodology by discussing a distinctive statistical and visual view of the analyzed ecosystem in the context of cyberspace and integrating multidisciplinary theoretical constructs into the researched domain from different study perspectives. The results may be used by security vendors, policy decision makers, and regulation authorities to assess the market dynamics, and the methodology and lessons can be generalized and applied to other domains.