Evaluation of Cyber Threat Intelligence Maturity Models: A Comparison Based on Maturity Model Design Principles

Cyber Threat Intelligence (CTI) has become a trending alternative for organizations to improve their security posture in the last few years. In 2022, a survey conducted by SANS showed a significant increase in organizations that are newly developing their CTI capabilities. Three of four survey participants feel the significant impacts of CTI on their ability to detect, respond, and prevent cyber threats. However, 21% are still determining the impact of CTI on their companies, meaning the effectiveness of CTI is questioned in this case. To help organizations to measure the effectiveness of a process systematically, researchers are developing maturity models. CTI maturity model is the model that tries to meet this objective, specifically in the CTI domain. In this paper, we compare several publicly accessible CTI maturity models against the maturity model design principles framework. This research aims to give insights to organizations on which model is the most comprehensive based on its design and as a reference for researchers to know what must be improved in the current models. In this study, we found that the CTIM model developed by TUDelft University and Cyber Threat Intelligence Lab is the model that completes most of the design principles’ points compared to the other analyzed models. Therefore, we conclude that organizations can consider the model for assessing their CTI maturity.