Evaluating the Effectiveness of Third-Party Cyber Threat Intelligence in Supporting Cyber Regulatory Readiness
Dr. Byron Busby · California Intercontinental University · 2026
Summary
Regulators such as the Basel Committee on Banking Supervision and NIST have raised the bar for supervisory examinations — moving beyond control checklists toward outcome-oriented assessments that demand traceable decision rationale, board-level accountability, and sustained governance rigor. In response, many financial institutions have invested heavily in third-party cyber threat intelligence (CTI) providers and vendor-supported regulatory readiness services, yet there is limited empirical evidence on whether these services meaningfully improve regulatory-readiness outcomes.
This qualitative single-case study explores how cybersecurity, risk, and compliance professionals at a large, U.S.-based, globally systemically important bank (G-SIB) evaluate the effectiveness of third-party CTI and vendor-supported services. Through semi-structured interviews, purposive sampling, and thematic analysis, the study examines how decision-makers define and operationalize effectiveness within a regulatory context, how vendor investment decisions are justified, and how external intelligence is translated into governance processes and examination-ready documentation.
The findings inform more defensible vendor governance frameworks, strengthen evidence-based compliance investment decisions, and contribute to the growing body of knowledge on cybersecurity governance in regulated financial environments.
Keywords: cyber threat intelligence, regulatory readiness, cybersecurity governance, qualitative single-case study, third-party vendors, globally systemically important bank