Collective Cyber Defense: How to Share Intelligence Safely

An AI-enabled cyberattack that succeeds against one company could soon be turned against dozens more. That’s part of the urgency behind an open letter from more than 100 companies, including major AI developers, cybersecurity firms, banks and internet infrastructure providers, calling on businesses and governments to build a collective defense against AI-driven threats. As AI makes sophisticated attacks faster and easier to scale, protecting any one organization may increasingly depend on how well the broader community works together.

There’s a clear advantage to organizations learning from one another’s experiences. But sharing security intelligence isn’t as simple as forwarding a warning—customer privacy, intellectual property and potential legal exposure all complicate the equation. Current federal guidance on AI cybersecurity collaboration recognizes the importance of establishing protections and processes for exchanging information, highlighting the need to balance cooperation with responsible risk management.

Turning the call for collective defense into meaningful action raises important questions about what organizations can contribute and how much they can safely reveal. Here, members of the Senior Executive Cybersecurity Think Tank explore how organizations can strengthen shared cyber defenses while protecting their own sensitive information and business interests.

“Collective defense should mean better-informed defense, not shared vulnerability.”

– Kumar Ritesh, Founder, Chairman and CEO of CYFIRMA

SHARE IT

Share Threat Patterns, Not Private Data

Kumar Ritesh, Founder, Chairman and CEO of CYFIRMA, emphasizes the importance of establishing clear boundaries around the intelligence that organizations exchange.

“Collective defense only works if intelligence sharing is structured, not ad hoc,” Ritesh says. “Organizations should contribute anonymized indicators, adversary TTPs and campaign-level signals—not raw internal data—through trusted frameworks like ISACs, where context is preserved but sensitive details are stripped.”

He also stresses the role of standardized methods in making information both useful and safe to exchange.

“Legal and competitive risks are managed by sharing threat patterns, not proprietary systems or customer data, and using standardized formats like STIX/TAXII so intelligence stays actionable without exposing IP,” he says.

Ritesh sees an opportunity for that shared intelligence to help organizations act before attackers succeed.

“Instead of reacting after compromise, organizations can correlate external threat vectors—adversary infrastructure, campaign activity and exposed assets—with their own identified threat vectors, spotting convergence before exploitation happens,” he says. “Shared at the pattern level, this strengthens the ecosystem without exposing any one company’s internal posture.”

His bottom line: “Treat adversary intent as shared knowledge, but keep your own attack surface private. Collective defense should mean better-informed defense, not shared vulnerability.”

Put Guardrails Around Information Sharing

Premsai Ranga, an Independent Researcher at Bellevue University, also emphasizes the need to balance the value of shared intelligence with the responsibility to protect sensitive information.

“Collective cyber defense should focus on sharing what helps others detect and stop attacks faster without exposing sensitive business or customer information,” Ranga says. “Organizations can contribute anonymized indicators, attack patterns, detection logic, identity-abuse techniques, AI-driven phishing behaviors and lessons learned from incidents.”

For Ranga, identity and access management is an especially important part of the discussion.

“From an IAM perspective, patterns involving credential theft, token abuse, multifactor authentication bypass, privilege escalation and nonhuman identity compromise are especially valuable as AI makes attacks faster and more adaptive,” he says.

Making these contributions responsibly requires more than good intentions. Ranga points to established sharing channels and formal safeguards as essential parts of the process.

“Leaders should use trusted channels such as ISACs and industry partnerships, backed by legal agreements, data minimization, anonymization, access controls and retention rules,” he says. “Organizations can also share reusable detection rules, threat models and red-team scenarios.”

The goal, Ranga concludes, is collective visibility without collective exposure.

“Strengthen the ecosystem while protecting privacy, intellectual property and competitive information.”

“Near-misses are never disclosed because nothing legally reportable happened, so the ecosystem learns only from failures, never from the far larger set of close calls.”

– Harikrishnan Muthukrishnan, Principal IT Developer for BCBS FLORIDA

SHARE IT

Turn Near-Misses Into Shared Lessons

Harikrishnan Muthukrishnan, Principal IT Developer for BCBS FLORIDA, draws attention to a potentially valuable source of cybersecurity intelligence that often goes unshared.

“The most valuable intelligence an organization holds is the attack that almost worked: The AI-generated phishing message that passed the first filter, the deepfake voice call an employee nearly trusted, the automated probe that found a gap before anyone patched it,” Muthukrishnan says. “Near-misses are never disclosed because nothing legally reportable happened, so the ecosystem learns only from failures, never from the far larger set of close calls.”

Muthukrishnan believes a different approach to reporting, supported by appropriate legal protections, could help address that gap.

“Organizations should contribute structured near-miss reports the way aviation does, with legal protection built around them so that admitting a weakness is not evidence in a future lawsuit,” he says. “Leaders can support this by advocating for safe-harbor provisions and by treating their own near-misses as a public good rather than an embarrassment.”

Share Security Tools, Not Incident Details

Collective defense doesn’t have to depend entirely on organizations exchanging information about individual threats or incidents. Ken Grohe, President of LeverageGTM, Inc., approaches the challenge from an engineering perspective.

“Companies can implement platform engineering to unify an enterprise’s system construction,” Grohe says. “When applied to security, it shifts the focus from sharing specific incident narratives—which might expose customers—to sharing the functional engineering code, behavioral footprints and automated guardrails needed to block those attacks globally.”

There’s already a practical foundation for this kind of collaboration. For example, the open-source Sigma project maintains a shared repository of detection rules that security teams can use and adapt to identify suspicious activity across different environments. Such resources illustrate how organizations can contribute technical defenses to a broader community without necessarily disclosing the sensitive details behind their development. 

The Collective Cyber Defense Playbook

• Share threat intelligence without exposing sensitive data. Contribute anonymized attack indicators, adversary behaviors and campaign-level insights rather than proprietary systems or customer information.
• Use shared intelligence to anticipate threats. Adopt standardized information-sharing formats and compare external threat signals against internal vulnerabilities to identify potential attacks before they succeed.
• Prioritize intelligence about identity-based attacks. Share insights into credential theft, authentication bypass, privilege escalation and other emerging identity threats as AI makes attacks more sophisticated.
• Establish clear safeguards for information sharing. Use trusted partnerships, legal agreements, access controls and data retention policies to protect privacy and minimize competitive risks.
• Turn cybersecurity near-misses into learning opportunities. Document and share lessons from attempted attacks that nearly succeeded, even when no reportable breach occurred.
• Advocate for legal protections that encourage transparency. Support safe-harbor provisions that allow organizations to report security weaknesses and close calls without creating unnecessary legal exposure.
• Contribute reusable security tools instead of sensitive incident details. Share detection code, behavioral indicators and automated defenses that help other organizations strengthen their protections.
• Leverage collaborative security resources. Participate in open-source initiatives and use shared detection rules to build stronger defenses across the cybersecurity community.

Building a Stronger Defense Through Shared Responsibility

As AI-enabled attacks become faster and more sophisticated, no organization can afford to view cybersecurity as an entirely independent responsibility. Sharing intelligence, learning from close calls, and contributing practical defenses can help businesses respond more effectively to threats that extend far beyond their own networks.

The challenge is making collaboration both valuable and safe. Organizations that establish trusted partnerships, clear safeguards and responsible sharing practices now will be better positioned to contribute to collective defense without compromising their own security. As AI continues to reshape the threat landscape, that balance between cooperation and protection will become increasingly important to building lasting cyber resilience.