The Fastest Threat Intelligence Engine on the Planet (With Receipts)
- Patrick Duggan
- Dec 16, 2025
- 4 min read
title: "The Fastest Threat Intelligence Engine on the Planet (With Receipts)"
slug: fastest-threat-intel-engine-receipts
date: 2025-12-12
author: Patrick Duggan
tags: [threat-intelligence, benchmarks, stix, mitre-attack, performance]
category: Threat Intelligence
featured: true
# The Fastest Threat Intelligence Engine on the Planet (With Receipts)
While enterprise threat intelligence platforms poll their feeds daily—sometimes weekly—we sweep every 10 minutes. And we can go faster. Much faster.
2 seconds, if we need to.
This isn't marketing. Every claim in this post is backed by a live API you can query right now. No signup. No paywall. Just `curl` and see for yourself.
The 2-Second Challenge
Most threat intel platforms are batch processors wearing real-time clothing. They pull from upstream feeds on a schedule, do some deduplication, maybe add a tag or two, and call it a day.
We built something different.
**PreCog Sweep Engine - Performance Modes:**
| Mode | Latency | What It Does |
|------|---------|--------------|
| **Fast** | 2 seconds | Pure collection, maximum velocity |
| **Sample** | 15 seconds | 10% novelty sampling |
| **Full** | 130 seconds | Complete enrichment pipeline |
Production runs at 10-minute intervals—not because we can't go faster, but because we're enriching every IOC to 97% depth and respecting upstream rate limits. The architecture supports sub-second sweeps when the situation demands it.
The Receipts
Here's where we put up or shut up. Every metric below comes from a live API endpoint. Go ahead, check our work.
IOC Freshness
| Metric | Value |
|--------|-------|
| Newest IOC Age | ~100 minutes |
| Median IOC Age | 2 hours |
| IOCs added (24h) | 814 |
| IOCs added (7d) | 933 |
| Feed span | 29 days |
**What this means**: When a new threat emerges, it's in our feed within hours, not days. Enterprise platforms typically show 4-24 hour latency. We're measuring in minutes.
Enrichment Depth
This is where we flex.
| Metric | Value |
|--------|-------|
| Avg Enrichment Points | **6.81 / 7** (97%) |
| MITRE ATT&CK Coverage | 86.8% |
| SSL/TLS Enrichment | 94.4% |
| ISP/ASN Data | 100% |
| Abuse Score | 100% |
| Bot Classification | 100% |
**Industry benchmark**: Enterprise feeds average 2-3 enrichment points per IOC. We hit 6.81.
Every indicator in our feed includes: geographic attribution, ISP identification, abuse confidence scoring, bot classification, SSL certificate analysis (where applicable), and MITRE ATT&CK technique mapping.
This isn't checkbox compliance. This is giving defenders the context they need to make decisions.
Community Contribution
| Metric | Value |
|--------|-------|
| OTX Indicators Contributed | **219,640+** |
| Pulses Created | 872 |
| Subscribers | 22 |
| Time to 200K | 15 days |
We don't just consume threat intelligence. We contribute back. In 15 days, we pushed over 200,000 indicators to the OTX community—putting us in the top contributor tier globally.
Profile: https://otx.alienvault.com/user/pduggusa
Who's Consuming This?
Microsoft Sentinel is polling our STIX feed 215 times per week.
That's not a typo. One of the largest security platforms on the planet is actively consuming our threat intelligence. The feed works. The format works. The data works.
The Secret Sauce
Here's where I get a little cagey.
We've developed patent-pending techniques for real-time threat intelligence at scale. The theoretical foundations draw from recent advances in computational mathematics—the same space Jensen Huang pointed to on Joe Rogan (#2234) when discussing where the future of computing is headed.
Our specific implementation is proprietary. What you need to know: we achieve real-time lookups across our entire IOC corpus using minimal memory. Traditional approaches don't scale. Ours does.
The benchmarks speak for themselves—query the live API and verify.
The $75/Month Flex
Let's talk about infrastructure.
Enterprise threat intelligence platforms run on millions of dollars of infrastructure. Dedicated security operations centers. Teams of analysts. Massive data lakes.
We run on:
- Azure Container Apps
- A single PostgreSQL instance
- Azure Table Storage
- Cloudflare for CDN
Monthly bill: approximately $75.
This isn't a limitation—it's a design choice. Efficient algorithms beat expensive hardware. Every time.
How to Consume the Feed
STIX 2.1 Bundle
Returns a complete STIX 2.1 bundle with indicators, threat actors, malware references, and relationships. Drop it into Splunk, Sentinel, Elastic, or any STIX-compatible platform.
OTX Integration
Subscribe to our pulses: https://otx.alienvault.com/user/pduggusa
Auto-sync with any OTX-integrated security tool.
Direct API
No API key required. No rate limiting (yet). We want defenders to have access to good threat intelligence.
What We Don't Claim
Epistemic honesty matters.
- We don't claim 100% accuracy. Our enrichment depth is 97%, not 100%. Some IOCs have incomplete data.
- We don't claim to catch everything. Novel threats take time to surface. We're fast, not omniscient.
- We don't claim the math is novel. The algorithms are well-established. The application at this speed is our contribution.
- We don't claim enterprise support. This is a small team. Response times reflect that.
What we do claim: verifiable benchmarks, live APIs, and results you can check yourself.
The Bottom Line
DugganUSA is the fastest threat intelligence engine on the planet.
- **2-second sweep capability** (production at 10 minutes)
- **6.81/7 enrichment depth** (industry average: 2-3)
- **86.8% MITRE ATT&CK coverage**
- **219,640+ indicators contributed** to the community
- **$75/month infrastructure**
Every number above is verifiable. Every endpoint is live. Every claim has receipts.
We're not asking you to trust us. We're asking you to `curl` and verify.
*DugganUSA LLC. Minnesota. Building threat intelligence infrastructure that billion-dollar vendors wish they had.*
*All benchmarks current as of 2025-12-12. Query the live API for real-time metrics.*
Comments