"Threat intelligence" is often used loosely. This guide covers what the underlying data actually is, where it comes from, and how it's used operationally in email and link security. (For why real-time processing of that data matters specifically, see our Real-Time Threat Intelligence Guide.)
What the Data Actually Is
Email threat intelligence typically combines several data types: domain registration data (age, registrar patterns associated with disposable infrastructure), hosting and SSL certificate signals, known-malicious indicator feeds, and behavioral telemetry from prior attack campaigns.
Collaborative Intelligence Networks
No single vendor sees the entire threat landscape. Collaborative marketplaces like PolySwarm crowdsource detection from a network of independent security engines, each providing an independent verdict on submitted artifacts. DefenceNet operates as a registered detection engine on the PolySwarm network, contributing URL verdicts and drawing on the consensus of other participating engines for borderline cases.
From Data to Action
Raw intelligence is only useful if it's applied at the point of decision. That means the data needs to be queryable fast enough to inform a real-time verdict — not just logged for later analyst review — and it needs to be combined with the behavioral and structural signals covered in our AI Email Security guide, since infrastructure intelligence alone misses threats with no prior footprint.
Frequently Asked Questions
What is PolySwarm?
A decentralized threat intelligence marketplace that crowdsources malware and phishing detection from a network of independent security engines and researchers.
Is threat intelligence the same as a blocklist?
No. A blocklist is a static output; threat intelligence is the broader set of contextual data (infrastructure patterns, behavioral signals, collaborative verdicts) used to generate a decision, including for threats that have never appeared on any list.