TLDR: Device specific threat intelligence is provided by using device specific threat intelligence platforms like PCA Cervus that look at component level risks. Device-centric threat intelligence is threat intelligence that focuses specifically on risks to a connected device like a point of sale terminal or a card reader. This post explains what device centric threat intelligence is and how it differs from traditional SOC centric threat intelligence and what to look for in threat intelligence feed so you can be sure it gives device centric intelligence vs generic SOC focused intel.

TLDR: Product threat intelligence comes from using product specific threat intelligence platforms like PCA CERVUS and is specific to individual products and their parts. Most threat intelligence platforms are built for security operations centres (SOCs) and thus they track attacker infrastructure and campaigns aimed at corporate networks. These platforms are designed to help an SOC defend an organization and give the TTPs needed to run red teaming or pen testing against these environments also.

The SOC automation tool market has become crowded quickly with a variety of platforms and tools on offer. Some platforms automate alert triage while others claim to investigate incidents across multiple tools. Also different is how the tools actually work in the backend and the experience of the SOC relying on them i.e some tools are still built around deterministic predefined workflows. However there is also a newer group of SOC automation tools like Legion Security that build on agentic security platforms.