A five-person IT team at a small manufacturing firm gets a phishing email disguised as a supplier invoice. The attachment's hash was flagged by three separate vendors that morning. Nobody at the company had a feed that said so. That gap — between intelligence that exists somewhere and intelligence a small business can actually act on — is the whole comparison in miniature.

Open-source and commercial options are not opposites. They are two ends of one trade: you pay in licence fees or you pay in staff hours, and the right answer depends on which your business has more of.

What a Small Team Actually Needs

Most small businesses do not need a threat intelligence platform in the enterprise sense. They need a short list of things they can block, plus enough context to judge whether an alert deserves attention.

That means four data types: malicious domains and IPs for DNS filtering and firewalls, file hashes for endpoint tools, phishing URLs for the mail gateway, and exploitation context — which vulnerabilities are being attacked right now. The CISA Known Exploited Vulnerabilities catalog is a good example of the last category: free, maintained, and readable by a human in five minutes.

What they do not need is raw volume. A feed pushing a million indicators a day into a one-person security operation produces blocked invoices and frustrated finance staff, not protection.

The Open-Source Route: Free Licence, Paid Attention

The open-source stack has matured. MISP and OpenCTI both handle storage, sharing and correlation of indicators. URLhaus, MalwareBazaar, Feodo Tracker and similar community projects cover phishing infrastructure, malware samples and command-and-control endpoints. Open rulesets for Suricata and YARA drop straight into tools you may already run.

Licence cost: effectively nothing. Real cost: someone has to own it. Feeds overlap heavily, indicators decay, and duplicates pile up unless you deduplicate and set expiry rules. A neglected MISP instance becomes a graveyard of two-year-old IP addresses that no longer resolve.

Coverage is genuinely good against commodity crime — the phishing kits, loaders and ransomware crews that hit everyone. It thins out quickly on targeted campaigns, sector-specific actors, and anything requiring attribution.

A feed nobody triages is just noise with a dashboard attached.

The Commercial Route: What the Licence Buys

Commercial platforms sell three things: curation, integration and accountability. Curation means human review, deduplication, confidence scoring and expiry — the work your team would otherwise do by hand. Integration means connectors for your mail gateway, SIEM and EDR, plus an API and a support desk when something breaks. Accountability means a contract, and on higher tiers, brand monitoring or takedown help.

Pricing is almost always quote-based, usually per seat or per protected asset, usually annual, often with a minimum. Watch for the extras: add-on modules, commit floors, and professional services to get the thing deployed.

One caution worth stating plainly: plenty of commercial feeds aggregate the same public sources you can reach for free, then wrap them in enrichment and a support contract. That can be worth the money. Ask for a sample feed and evidence before you assume it is.

Integration Effort: Where the Hours Go

The licence decision is the easy part. Integration is where projects stall. Whatever you choose, the work looks roughly the same:

1. Pick your enforcement points — DNS filter, mail gateway, endpoint, firewall. Indicators you cannot enforce are trivia.
2. Choose a transport: STIX/TAXII, a MISP feed, or a plain CSV a script picks up on a schedule.
3. Build the pipeline: ingest, deduplicate, score, push to the enforcement point.
4. Automate expiry. Most indicators go stale within days or weeks, and keeping them forever guarantees false positives.
5. Log every block so you can review what got caught and release mistakes quickly.
6. Name an owner and a weekly review slot. Ten minutes weekly beats a quarterly cleanup.

Expect the first month to be the heaviest. Commercial tools shorten this with connectors, but never to zero — you still map their taxonomy onto your own tools and tune thresholds.

Coverage and Precision: Volume Is Not the Metric

What matters is not how many indicators a feed contains, but how many describe something relevant to you, and how fast they arrive.

Track two numbers for a month: how many alerts touched an indicator you already had, and how long it took from publication of an indicator to it being blocked on your network. Those two figures tell you more than any feature comparison.

Relevance is sector-dependent. An accounting firm cares about tax-season phishing lures. A clinic cares about ransomware access brokers. A small SaaS company cares about credential stuffing and cloud token theft. Free feeds cover the commodity end of all three; sector groups and paid feeds cover the specific end.

The Middle Path Most Teams Take

For most small businesses the workable arrangement is hybrid: free authoritative feeds for the blocking layer, one paid source for context and alerting, and membership in a sector information-sharing group if one exists for your industry. Keep a strict allowlist process so a bad indicator never keeps a customer's email out for long.

Read the licence terms on every free feed before you build on it. Several restrict commercial use, redistribution, or use above a volume threshold — a detail that matters more when your business resells services. If it is unclear, get it checked before your process depends on it.

Start With Four Weeks and Two Questions

Before buying anything, answer two questions. Which decisions will this intelligence change — block, investigate, or patch? And who spends the thirty minutes a day to review it?

If you cannot answer both, more feeds will not help. If you can, run a four-week trial. Load two free feeds into your mail gateway and DNS filter in monitor-only mode, log the hits, and review weekly. Then take one commercial trial and compare the same two weeks of data. Keep whatever reduces real alerts or catches things your free feeds missed. Drop the rest, and revisit the decision once a year as your team and your exposure change.

Budget for the staff hours, not just the subscription. That is the line item that decides whether threat intelligence protects anything at all.

Photo: geralt / Pixabay