A paid, subscription-based threat intelligence service is best classified as closed-source intelligence because access is restricted to authorized subscribers rather than being freely available to the public. Commercial threat-intelligence providers typically collect, analyze, correlate, and curate indicators and adversary information before distributing that intelligence through authenticated portals, APIs, or feeds.
NIST identifies several external intelligence-source categories, including open-source repositories, commercial threat feeds, and external information-sharing partners . A commercial feed relevant to a company's specific industry may provide higher-context intelligence regarding threat actors, infrastructure, malware, vulnerabilities, campaigns, and indicators affecting that vertical.
OSINT, by contrast, originates from publicly accessible sources and normally does not require restricted subscription access. Threat mapping is the activity of associating adversary behavior or intelligence with infrastructure, campaigns, frameworks, or organizational assets. Threat modeling is a structured process used to identify potential threats and weaknesses in systems or applications; it is not an intelligence-source classification.
The examination clue is “paid subscription.” Restricted commercial access distinguishes the feed from publicly obtainable OSINT.
Study Guide Reference: Security Operations → Threat Intelligence → Intelligence Sources → Open-Source Intelligence → Closed/Commercial Intelligence → Industry-Specific Threat Feeds.
