Regardless of the source of your [[Threat Intelligence]] information, you need to assess it. A number of common factors come into play when you assess a threat intelligence source or a specific threat intelligence notification. - Is it **timely**? A feed that is operating on delay can cause you to miss a threat, or to react after the threat is no longer relevant. - Is the information **accurate**? Can you rely on what it says, and how likely is it that the assessment is valid? Does it rely on a single source or multiple sources? How often are those sources correct? - Is the information **relevant**? If it describes the wrong platform, software, or reason for the organization to be targeted, the data may be very timely, very accurate, and completely irrelevant to your organization. ### Confidence Score One way to summarise the threat intelligence assessment data is via a confidence score. Confidence scores allow organisations to filter and use threat intelligence based on *how much trust they can give it*. A lot of threat intelligence *starts with a lower confidence score*, and that score *increases as the information solidifies* and as additional sources of information confirm it or are able to do a full analysis. Low confidence threat information shouldn't be completely ignored, but it also shouldn't be relied on to make important decisions without taking the low confidence score into account. > [!note] > Many threat feeds will include a confidence rating, along with a descriptive scale. For example, one approach uses six levels of confidence: > - **Confirmed** (90–100) uses independent sources or direct analysis to prove that the threat is real. > - **Probable** (70–89) relies on logical inference, but does not directly confirm the threat. > - **Possible** (50–69) is used when some information agrees with the analysis, but the assessment is not confirmed. > - **Doubtful** (30–49) is assigned when the assessment is possible but not the most likely option, or the assessment cannot be proven or disproven by the information that is available. > - **Improbable** (2–29) means that the assessment is possible but is not the most logical option, or it is refuted by other information that is available. > - **Discredited** (1) is used when the assessment has been confirmed to be inaccurate or incorrect.