Rebuilding a Collection Portfolio After a 30% Budget Cut

Map every source to a PIR and to a decision it changed. Volume is not a criterion.

• Commercial feeds ($180k, 4,100 indicators, 3 blocks, 0 attributable): these are supporting detection content, not intelligence. Two feeds with near-identical coverage is a redundancy purchase. Keep one, selected on coverage of infrastructure seen against financial services in the last 12 months, and require the vendor to demonstrate it in a bake-off against free and ISAC-sourced indicators. Cut the second. This alone recovers most of the cut.
• ISAC: the best decision-utility per dollar in the portfolio - 7 of 12 advisories changed a control. Do not cut; negotiate an upgrade to the tier with early-access advisories and the email-security and fraud working groups, funded from the feed savings. This directly serves PIRs 2 and 4.
• Paste monitoring ($24k, one stale hit): the source is not the problem, the targeting is. Retarget the requirement from "pastes" to "bank domains, executive email addresses, and combolists naming our brand" and require an alert only when the artifact is not already public. If the vendor cannot meet that, cut it and fold the requirement into the ISAC's credential-exposure service.
• Telegram bot (unvalidated, 15 analyst-days): this is ungoverned collection with unquantified legal and OPSEC exposure and no validation path. With three analysts you cannot afford it. Either formalize it - named collector, approved account and infrastructure, a written requirement tied to PIR 1, and a rule that every lead is validated against a second source within 48 hours - or suspend it. My recommendation is suspension of 38 of the 40 channels and formalization of two.

State the trade-off to the CISO explicitly: the cut does not reduce coverage of the PIRs if executed this way; it reduces indicator volume, which was producing no decisions.

A requirement is actionable only when a collector can execute it without asking you what you meant.

PIR-2: BEC campaigns targeting treasury and wire-desk staff. Requirement CR-07: Collect all internally reported BEC lures (reports to phish@ and the fraud mailbox) and all newly registered domains matching bank brand tokens, from the ISAC email-security working group feed and the internal report queue. Correlate against mail-gateway blocks and wire-desk staffing lists.

• Source(s): ISAC working-group feed; internal phishing report mailbox; commercial domain-registration alerting (retained).
• Cadence: continuous ingestion; triage within business hours; weekly roll-up.
• Owner: Analyst B (collector), with the fraud operations lead as the named consumer sponsor.
• SLO: four business hours from report to triage; 24 hours to a defensive recommendation (block, takedown request, or staff warning); eight hours median from first report to domain block.
• Consumer and decision: fraud operations decides whether to hold wire callbacks or push a staff warning; email security decides blocks.
• Success criterion: median first-report-to-block under eight hours and zero wire-desk staff interacting with an unblocked lookalike domain.

Note the SLO is written against a decision, not against data delivery. That distinction is what lets you defend the requirement at the next budget review, because you can show what the decision would have cost without it.

Replace indicator counts with a decision-utility scorecard reviewed quarterly:

• Actionable rate - percentage of collected items that changed a control, a hunt, or a decision. The old portfolio's figure was roughly 3 blocks per 4,100 indicators, which is the number to beat.
• Timeliness against SLO - median time from source event to consumer decision, per requirement. A requirement that misses its SLO repeatedly is either mis-specified or under-resourced; find out which.
• PIR coverage - for each PIR, whether at least two independent sources can answer it. Single-source PIRs are the structural weakness to report upward.
• Cost per actionable finding, by source. This is the metric that survives a CFO conversation.
• Consumer feedback - a one-line usefulness rating from the fraud and email-security leads per product. Silence is not satisfaction.

Re-look triggers, written into the plan up front: a PIR answered twice by a source you cut; a feed failing two consecutive quarterly utility reviews; an SLO missed for three consecutive weeks; or any collection activity that generates legal or OPSEC questions (which is what the Telegram bot risks). Pre-committing to triggers protects the team from arbitrary cuts later and shows the reviewers that the portfolio is managed rather than accumulated.