Proving the Value of Threat Intelligence in 2027: Metrics the Board Will Understand

Key takeaways

• 43% of UK businesses reported a cyber security breach or attack in the last 12 months, rising to 69% of large businesses.

• The NCSC handled 204 nationally significant incidents in a year, up from 89, or roughly four every week.

• Recent UK attacks show the real cost: £300 million off M&S operating profit, £206 million in lost Co-op revenue and £1.9 billion to the UK economy from the Jaguar Land Rover attack.

• Only 11% of UK businesses used or invested in threat intelligence, and just 31% have a board member responsible for cybersecurity.

• Boards respond to financial exposure, speed, third-party risk and reputation, so frame threat intelligence metrics in those terms rather than alert counts.

Why does the whole organisation need to understand the value of threat intelligence?

Threat intelligence is often seen as a specialist function that sits quietly inside the security team. That view no longer holds. 43% of UK businesses reported a cyber breach or attack in the last year, and the NCSC handled an average of four nationally significant incidents every week. The cost is just as stark: the M&S attack knocked around £300 million off operating profit, while the Jaguar Land Rover attack cost the UK economy an estimated £1.9 billion. When a cyber attack takes systems offline, empties shelves or pushes a message to millions of customers, the impact lands on finance, operations, legal, communications and the board all at once.

UK retail has seen this play out repeatedly. On 6 October 2026, ASOS customers received an extortion message through the retailer's own app, and the names, addresses and recent search data of millions of customers were later reported to have been accessed. Less than a week later, TFG London confirmed a cyber incident affecting IT systems at three UK fashion brands: Phase Eight, Hobbs and Whistles.

These incidents show that cyber risk is business risk. Threat intelligence is one of the few disciplines that can see that risk forming before it becomes a headline, by tracking threat actors, leaked credentials, supplier exposure and the tactics being used against similar organisations. But that value only gets recognised, and funded, if the wider business and the board understand it.

Why is the value of threat intelligence so hard to prove?

The challenge is that threat intelligence works best when nothing happens. A phishing campaign spotted early, a leaked credential reset before it is used or a supplier compromise flagged before it spreads all produce the same visible outcome: no incident. Without the right metrics, that success is invisible.

The data suggests many UK organisations are not yet measuring it. Only 11% of businesses used or invested in threat intelligence, and among medium and large businesses that update senior leaders on cyber security, only 61% include the number of significant attacks detected in those updates.

Governance is also uneven. Just 31% of businesses have a board member responsible for cyber security, falling to 20% in retail and wholesale, one of the sectors most heavily targeted over the past two years.

Which threat intelligence metrics will the board understand?

The metrics below translate intelligence activity into outcomes the board already tracks: money, time, exposure and reputation. Each one can be reported as a simple figure with a trend over time.

1. Financial loss avoided

• What to measure: the estimated cost of incidents prevented or contained early, using benchmark costs for your sector.

• Why the board cares: it puts threat intelligence in the same currency as every other investment decision.

• Example: with the average UK breach costing £3.13 million, preventing a single incident can outweigh the annual cost of an intelligence programme many times over.

2. Time to detect and contain

• What to measure: mean time to detect (MTTD) and mean time to respond (MTTR), comparing intelligence-led alerts with those found through other routes.

• Why the board cares: every day of disruption has a price, from lost sales to idle production lines.

• Example: JLR's disruption was estimated at around £108 million a week. UK organisations with extensive security automation identified breaches 20 days faster and contained them 22 days faster than those without.

3. Threats identified before impact

• What to measure: the number of early warnings raised, such as leaked credentials, brand mentions on criminal forums or threat actor chatter, and the percentage that were acted on.

• Why the board cares: it shows the organisation is seeing threats coming rather than reacting to them.

• Example: in the ASOS incident, attackers directed customers to a Telegram channel. Monitoring these channels and leaked credentials gives security teams a chance to act quietly, before an attack becomes public.

4. Third-party and supply chain exposure

• What to measure: the percentage of critical suppliers under continuous monitoring and the number of supplier exposures flagged.

• Why the board cares: an attack on one supplier can halt the whole business.

• Example: only 15% of UK businesses review risks from their immediate suppliers, and 6% their wider supply chain. Meanwhile, the M&S attack reportedly began when hackers tricked a third-party contractor into granting access.

5. Phishing and impersonation activity

• What to measure: lookalike domains detected, phishing campaigns targeting your brand and average time to takedown.

• Why the board cares: impersonation damages customer trust and drives fraud losses.

• Example: phishing accounted for 93% of businesses that experienced cyber crime. After major incidents such as ASOS, criminals quickly follow up with scams offering refunds or compensation.

6. Fraud losses prevented

• What to measure: compromised payment data, fraud schemes and refund abuse targeting your brand, identified and blocked.

• Why the board cares: fraud is a direct, measurable loss that finance teams already track.

• Example: an estimated 43,000 UK businesses fell victim to cyber-facilitated fraud, across around 130,000 fraud events in a single year.

7. Vulnerability prioritisation

• What to measure: the percentage of patches prioritised based on evidence of active exploitation, and time to patch for those vulnerabilities.

• Why the board cares: it shows resources are focused on the weaknesses attackers are using.

• Example: the NCSC found that three vulnerabilities alone were linked to 29 incidents it managed in a single year.

8. Reputational and market risk

• What to measure: incidents that reached the public domain, brand exposure on criminal forums and the potential market impact of credible threat scenarios.

• Why the board cares: share price and customer trust are board-level responsibilities.

• Example: ASOS shares fell by more than 14% before the facts of the incident were established, and over a billion pounds was wiped from M&S's market value.

9. Governance and compliance alignment

• What to measure: coverage against the principles of the Cyber Governance Code of Practice and threat intelligence requirements under ISO 27001.

• Why the board cares: directors are increasingly expected to show active oversight of cyber risk.

• Example: the Cyber Governance Code was launched in April 2025, yet only 16% of UK businesses had heard of it.

How can CYJAX help prove the value of threat intelligence?

At CYJAX, we know how challenging it can be to communicate a fast-changing threat landscape to senior leadership. Our analysts monitor criminal forums, marketplaces and messaging channels such as Telegram for leaked credentials, brand mentions and supplier compromise, and our cyber threat intelligence turns that activity into validated insight your team can act on and report with confidence.

To see how CYJAX can help you demonstrate the value of threat intelligence to your board, book a demo or ask one of our analysts about a threat actor, emerging threat or potential exposure.