Collective Intelligence: A Systemic Debt in the Cybersecurity Community

Collective intelligence (CI) is defined as the emergent capacity of a group of individuals to achieve levels of understanding, creativity, and problem solving superior to those of any isolated member.¹ In business and social contexts, this notion has been widely studied through the lenses of psychology, sociology, and data science, demonstrating its value in collaborative projects, open-source communities, and distributed knowledge platforms. However, in the field of cybersecurity, the adoption of practices that foster the development of CI remains scarce and fragmented.

This concept must be understood from an interdisciplinary perspective and analyzed as a systemic debt in the defensive cybersecurity ecosystem. Contrasting the collaborative models of digital attackers with the fragmented structures of defenders allows for an exploration of the causes of this gap. Through a robust theoretical framework and analysis of real-world cases, key barriers, solutions, and recommendations can be identified in alignment with current security needs.

The Need for CI in Cyberdefense

In the face of increasingly sophisticated attacks, the lack of CI between cyberprofessionals is a systemic debt: An accumulation of structural, cultural, and technological failures prevents the collaborative potential of the cyberdefense community from being fully realized. Not unlike the concept of technical debt, the lack of CI represents a liability that undermines the efficiency, resilience, and adaptability of cyberdefense strategies.²

Adversarial groups, meanwhile, have demonstrated a remarkable ability to operate as CI ecosystems, sharing tools, tactics, and knowledge quickly and anonymously. Adversarial knowledge sharing is conducted through underground forums, ransomware as a service (RaaS) offerings, and advanced persistent threat (APT) networks. This collaborative advantage allows malicious actors to iterate and evolve more rapidly than can be countered by the centralized, siloed defenses of many organizations.

Technical and Systemic Debt

Software development expert Martin Fowler³ defines technical debt as the accumulated consequences of development decisions that prioritize rapid delivery over long-term quality. Edith Tom⁴ extends this notion to the organizational environment, incorporating cultural and process aspects.

Taking this concept a step further, systemic CI debt is identified as the lack of investment in collaborative infrastructures, processes, and cultures that enable effective knowledge sharing among defenders. This debt accumulates over time and increasingly hinders defense against adversaries.

Together, these concepts provide a solid foundation for understanding the enablers of, and barriers to, CI. Specific case studies and diagnostics help illustrate how these theories manifest in the real world of cybersecurity.

Practical Applications

CI has shown tangible results in a variety of environments, providing valuable takeaways for the cybersecurity field.

Open-Source Communities
The collaboration of thousands of developers on Linux Foundation and open-source projects makes it possible to detect and fix vulnerabilities quickly. This collaboration allows for increased testing coverage and the ability to share security patches in real time.⁵

Similarly, distributed governance models (seen in projects such as Kubernetes and Apache Foundation operating under open committees and working groups) demonstrate that transparency and technical meritocracy accelerate the continuous improvement cycle.

Hacktivism and Citizen Security
During large-scale incidents (e.g., natural disasters), citizen collaboration platforms such as Humanitarian OpenStreetMap use CI to map affected areas and coordinate responses.⁶

Meanwhile, initiatives such as Spamhaus and AbuseIPDB encourage users and organizations to report malicious IP addresses in real time, creating community databases that feed automated defenses.

Enterprise Environments and Collaborative Threat Intelligence
Industries such as finance, energy, and healthcare operate information sharing and analysis centers (ISACs), where members share information on specific threats, incident analysis and effective mitigations.⁷ In addition, cybersecurity organizations are exploring the adoption of federated learning to train threat detection models without exposing sensitive data, maintaining privacy while leveraging distributed data.

These cases demonstrate how CI can be successfully implemented through flexible governance structures, enabling technologies and a culture of trust. However, the translation of these models to the cyberdefense domain requires certain adjustments.

Defensive Cybersecurity World Diagnostics

Despite theoretical recognition of the benefits of CI, cyberdefense practices are characterized by six issues:

1. Organizational fragmentation—Many enterprises and government entities operate in silos, with security, IT, and compliance teams communicating threat information on a limited or delayed basis. This segmentation prevents the creation of a common knowledge space and reduces the ability to respond to threats in a coordinated manner. 2.
2. Culture of secrecy and reputational fear—Sharing information about security incidents is still perceived as a reputational risk, which contributes to significant delays in breach detection and containment. According to the IBM Cost of a Data Breach Report 2025, organizations take an average of 204 days to identify and 73 days to contain a breach—adding up to 277 days on average.⁸ Although the report does not provide a specific percentage of organizations that intentionally delay disclosure, it highlights that enterprises engaging external parties early—such as law enforcement—experience significantly lower breach costs. This reinforces the notion that delayed reporting increases both reputational and financial risk. In addition, much of the information shared focuses on adversary actions (indicators of compromise [IoCs], known tactics), but rarely discloses internal data about the organization itself, including vulnerable configurations, ongoing detections, and internal mitigation strategies. This asymmetry prevents learning from others' mistakes and adjusting defenses based on real community experiences.
3. Technological barriers and system incompatibility—Threat intelligence tools often use different formats and standards, such as Structured Threat Information Expression (STIX), Trusted Automated eXchange of Intelligence Information (TAXII), or OpenIOC, making interoperability difficult.⁹ In addition, the lack of unified application programming interfaces (APIs) limits the automation of data exchange and correlation in real time.
4. Lack of clear incentives and governance models—Unlike digital adversaries, who find direct value in exchanging exploit kits and zero day threats in underground markets, defenders lack equitable compensation mechanisms (e.g., cyberresilience credits or reputation schemes that recognize contributions). In most sectors, there are no formal structures that reward collaboration or penalize isolation. Cybersecurity programs tend to focus on individual compliance, not collective resilience. In the absence of clear incentives, many organizations do not prioritize participation in threat-sharing communities or open projects.
5. Focus on compliance rather than collaboration—Regulations such as the EU General Data Protection Regulation (GDPR), NIS2, and the US Sarbanes-Oxley Act (SOX)¹⁰ have increased the focus on data legality and privacy, but do not always promote initiative-taking collaboration. Regulatory compliance then becomes the primary focus, relegating the mission of sharing intelligence to mitigating threats.
6. Leadership and strategic vision limitations—Lack of executive sponsorship and systemic vision holds back data aggregation initiatives and communities of practice. The development of CI requires leadership that transcends individual interests and is committed to a common sectoral or cross-sectoral good. Without a shared and sustained vision at elevated levels of leadership, collaborative initiatives may be diluted or relegated to one-off efforts. Likewise, adopting these approaches requires a long-term strategic vision and leadership willing to assume risk, build networks of trust, and promote a culture of collaboration. However, many cybersecurity leaders operate with a short-term mindset focused on compliance and incident containment, which limits their ability to foster structural transformations.

In short, the accumulation of these barriers creates a systemic debt that undermines the effectiveness of collective defenses and reinforces the collaborative advantage of digital adversaries.

Contrast With the World of Attackers

Cyberadversaries, far from being fragmented, have demonstrated a sophisticated ability to collaborate. They have institutionalized at least five practices of knowledge sharing and systemic collaboration that give them significant advantages over defenders:

1. Clandestine collaborative structures—Dark web forums and encrypted platforms facilitate the exchange of exploit kits, zero day threats, and phishing tools. These environments operate with reputation and member validation systems, ensuring the quality of shared information.¹¹
2. RaaS—Business models that allow developers to sell or rent ransomware kits to affiliates help generate economies of scale and specialization. Furthermore, continuous feedback between developers and affiliates improves evasion and encryption techniques.¹² This model has transformed the threat landscape by allowing ransomware developers to distribute their software to affiliates through profit-sharing agreements. This form of criminal franchising lowers barriers to entry into cybercrime, specializes functions (development, infection, extortion, money laundering), and accelerates collective learning among malicious actors.
3. APT and attack labs—State-sponsored groups analyze cyberdefenses and develop countermeasures in collaborative test labs. These groups use private repositories and agile processes to share findings and tactics, such as DevOps practices applied to offense.¹³
4. Tactic, technique, and procedure (TTP) sharing—Platforms such as MITRE ATT&CK and clandestine threat intelligence forums allow for the mapping and validation of the effectiveness of TTPs in real time, refining offensive playbooks with empirical data from multiple participants.¹⁴
5. Economic models of malicious knowledge—The monetization of information (sale of stolen data, distributed denial of service [DDoS] tools, leaked credentials, and infostealers [malware designed to exfiltrate credentials, cookies, and sensitive data]) creates direct incentives to share findings and accelerate criminal innovation cycles, in contrast to the weak economic and reputational incentives in defensive collaboration. Platforms such as GitHub and specialized forums allow malicious developers to exchange code, obfuscation methods, and updates, achieving continuous improvements in detection evasion and exfiltration performance.¹⁵

This contrast reveals a structural and incentive gap: While adversaries optimize their collaborative networks to iterate quickly, cyberadvocates remain bound by bureaucratic processes and legal constraints.

This attack ecosystem functions as a complex adaptive system in which actors share resources, specialties, and feedback, allowing them to iterate quickly and efficiently. CI is therefore not an aspiration for them, but an integrated and structural practice. Their success should be a warning sign for advocates: Lack of collaboration is no longer just a weakness; it is a structural vulnerability.

Factors Influencing the Lack of CI in Cyberdefense

The lack of CI in cyberdefense is influenced by 10 interdependent factors:

1. Fragmentation of the defensive ecosystem—Defensive cybersecurity is deeply segmented by sectors, regulatory frameworks, geographic jurisdictions, and organizational maturity levels. This heterogeneity complicates the creation of common collaborative structures and hinders technical and semantic interoperability between information systems.¹⁶ In addition, many organizations perceive threat information as a competitive asset, leading to a reluctance to share valuable threat intelligence for fear of losing an advantage or exposing vulnerabilities of their own.
2. Organizational stigmas and cultural silos—Internal competition often stems from structural misalignments and unaddressed rivalries between technical, legal, and business units. Although these teams operate under the same organizational umbrella, they are often driven by different priorities, key performance indicators (KPIs), and accountability models. This leads to a lack of trust, as each unit may fear being blamed for failures or sidelined in decision making. In practice, this mistrust manifests in behaviors such as withholding threat intelligence, delaying incident reporting to avoid scrutiny, or prioritizing departmental goals over shared security outcomes. Rather than collaborating openly, teams operate in parallel—treating information as power and focusing on protecting their mandates. These dynamics hinder cross-functional learning and prevent the emergence of a collective defense mindset.
3. Regulatory and compliance complexity—Strict privacy and data protection legislation (GDPR, the US Health Insurance Portability and Accountability Act [HIPAA]¹⁷) creates legal uncertainty about the permissible scope of information sharing, leading to conservative positions.
4. Technological deficiencies—Heterogeneity of platforms, exchange formats, and the lack of standardization concerning APIs hinder the automation and integration of threat intelligence flows.
5. Internal culture of secrecy—Many organizations still operate under a mindset that prioritizes concealment of failures and vulnerabilities from executives and key stakeholders. This inhibits collaborative feedback and prevents what is known as situated learning, which is the process of learning that emerges directly from real-world practice, such as post-incident reviews, red team exercises, or threat simulations. When incidents are hidden or sanitized, teams miss opportunities to reflect collectively and improve their responses. As a result, knowledge remains fragmented and lessons are not internalized across the organization.
6. Resistance to change and risk aversion—The adoption of new collaborative practices also comes with perceived risk (e.g., leaks, exploitation of shared information) that stops experimentation.
7. Lack of metrics and KPIs—Difficulties in quantifying the return on investment (ROI) of CI in terms of incident reduction or response time limits the justification of pilot projects.
8. Low levels of prosociality—Building on the work of researchers Hackman and Woolley, it is evident that many cybersecurity teams struggle with creating environments that encourage shared responsibility, mutual engagement, and equitable participation. While Hackman emphasized structural and relational conditions for team effectiveness—such as clarity of purpose, enabling environments, and expert coaching—these conditions often fail to emerge in siloed security teams. Woolley's research on CI demonstrates that group performance improves when members exhibit social sensitivity and take turns in conversation, pointing to the importance of relational dynamics. In this context, it is possible to extend their insights to what the author terms “organizational empathy:” the capacity of a team or institution to recognize, value, and respond to the emotional and cognitive states of its members. This form of empathy is not individual, but systemic—it reflects in how feedback is handled, how psychological safety is built, and how leaders enable collaboration across roles. Without it, prosocial behavior erodes, and collective intelligence is unlikely to flourish.¹⁸
9. Interorganizational distrust—Lack of trust between actors, even within the same sector, is a critical barrier. Historically, collaboration has been hampered by negative experiences of leakage, misuse of shared information, or differences in data sensitivity levels. This distrust is reinforced by the absence of effective anonymization, source attribution, and access control mechanisms in many threat intelligence platforms.
10. Asymmetry with adversaries—Attackers do not face the same regulatory, reputational, or ethical constraints as defenders. Their operational freedom allows them to experiment, share without reservation, and evolve with agility. This asymmetry amplifies systemic debt, because while defenders deal with bureaucracies and silos, attackers collectively optimize their knowledge and capabilities.

These factors interact and reinforce systemic debt, requiring a comprehensive approach to address them simultaneously. However, their explicit recognition is the first step in designing realistic and effective strategies to overcome them. Adversarial groups have managed to circumvent these constraints to build highly effective collaborative ecosystems. Important conclusions can be drawn from their functioning to inform the evolution of cyberdefense.

Strategic Proposal and Practical Steps

To address the systemic debt of CI in defensive cybersecurity, actions can be structured across cultural, technological, and governance domains to promote the treatment of knowledge as a public good. Unlike traditional assets, intelligence is not depleted when it is shared; it multiplies. An IoC, an emerging tactic, a contextualized anomaly, a well-told forensic analysis—each piece of knowledge is more valuable when it circulates.

Assuming this approach implies breaking with the proprietary logic that many organizations still maintain, the fear of sharing knowledge for reputational, legal, or competitive reasons is understandable but unsustainable in the face of systemic threats. Sharing is about uncovering what the adversary does, not what the organization does.

Certain types of knowledge—especially those that contribute to collective security—should function as a global public good: accessible, replicable, and reusable.

Cultural and Organizational Level
Organizations should foster prosocial cultures and collaborative CISO networks. This can be achieved by implementing training programs in organizational empathy, shared responsibility, and interdepartmental collaboration.¹⁹ A particular focus should be on strengthening CISOs' prosocial capabilities, including inclusive leadership skills, active listening, and trust building, to act as catalysts for intelligence-sharing security communities. Furthermore, organizations should establish formal networks of CISOs and security professionals to promote mutual mentoring, periodic discussion groups, and support spaces, where social propensity is the key factor for sharing strategic insights.

Technological Level
Adopt interoperable standards and platforms by unifying exchange formats, such as STIX 2.x, TAXII 2.1, and deploying threat intelligence platform (TIP) solutions that support open APIs and workflow automation. In addition, federated learning via collaboration with vendors helps train detection models without exposing sensitive data. Finally, tools such as Kibana or Grafana can be used to visualize threat trends, TTPs, and collaborative metrics in real time.²⁰

Metrics and Continuous Assessment
Define collaborative health indicators to assess the maturity and effectiveness of CI initiatives. These indicators may include:

• The number of actionable contributions, such as shared IoCs, vulnerability reports, or contextual threat analyses submitted by member organizations
• The average exchange time between detection and reporting across the network
• The adoption rate of shared intelligence feeds
• Measurable improvements in mean time to detect (MTTD) and mean time to respond (MTTR) resulting from collective inputs

In addition, tabletop exercises (TTXs) can be conducted with multiple organizations to measure the effectiveness of collaborative channels and adjust processes.

The implementation of these strategies must be guided by a roadmap for the short, medium, and long term, with clear milestones and defined responsibilities. The combination of cultural, technological, and governance initiatives will make it possible to transform systemic debt into a strategic asset, matching the defensive capacity to the collaborative agility of adversaries. 

The proposed strategies aim to reduce systemic CI debt through cultural, technological, and governance interventions. Prosocial skills training for CISOs and the creation of formal networks have the potential to accelerate trust and genuine information sharing. However, the effectiveness of these measures will depend on the ability of leaders to sustain long-term commitment and to align organizational incentives.

Conclusion

CI represents an underutilized strategic asset in defensive cybersecurity and its systematic absence has generated a debt that compromises the operational resilience and adaptability of organizations. Moreover, the lack of CI reduces responsiveness to attacks and increases the window of exposure to cyberadversaries that consistently engage in CI. The lack of efficient collaborative structures, an insufficient prosocial culture, and the lack of clear incentives have favored digital adversaries, who operate highly agile clandestine networks and evolve their tactics through continuous feedback loops.

The consolidation of prosocial capabilities in CISOs and security professionals has the potential to bolster defensive CI. The individual development of skills such as empathy and assertive communication, together with collective mentoring dynamics and communities of practice, will allow the construction of trust networks capable of sharing sensitive intelligence without compromising privacy or competitiveness. These networks, aligned with interoperable technological standards and governed under clear frameworks, will set in motion an ecosystem where the sum of defensive knowledge overcomes the current atomization of the cyberdefense ecosystem.

By paying off the systemic CI debt, organizations will be able to anticipate threats faster, optimize defensive resources, and create a collaborative barrier that reduces the window for vulnerability exploitation. This systemic and holistic approach not only strengthens organizational security posture but also redefines cyberdefense as a community and strategic effort, aligned with global best practices.

Endnotes

¹ Lévy, P.; L'intelligence collective: Pour une anthropologie du cyberspace, La Découverte, 21 March 1997; Surowiecki, J.; “The Wisdom of Crowds: Why the Many are Smarter Than the Few and How Collective Wisdom Shapes Business, Economies, Societies, and Nations,” Doubleday & Co.
² Tom, E.; Aurum, A.; et al.; “An Exploration of Technical Debt,” Journal of Systems and Software, vol. 86, iss. 6, 2013
³ Fowler, M.; “Technical Debt,” Martin Fowler, 21 May 2019
⁴ Tom; Aurum; “An Exploration of Technical Debt”
⁵ Raymond, E.S.; The Cathedral & the Bazaar: Musings on Linux and Open Source by an Accidental Revolutionary, O'Reilly Media, 2001; Fitzgerald, B.; “The Transformation of Open Source Software,” MIS Quarterly, vol. 30, iss. 3, 2006
⁶ Humanitarian OpenStreetMap Team, “Our Work” 
⁷ European Union Agency for Cybersecurity (ENISA), Information Sharing and Analysis Center (ISACs) - Cooperative models, European Union, February 2018, ; ENISA, “Information Sharing & Analysis Centres: Exploring the Value of Cross-Sector Exercises,” European Union, April 2022,  Hernandez- Ardieta, J.; “Information Sharing Models for Cooperative Cyber Defence,” 5^th International Conference on Cyber Conflict, 2013
⁸ IBM, Cost of Data Breach Report 2025, 2025
⁹ Cloudflare, “What Is STIX/TAXII?,”  Gibb, W.; Kerr, D.; “OpenIOC: Back to the Basics,” Google Cloud, 1 October 2013
¹⁰ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation [GDPR]); European Commission, "Directive on Security of Network and Information Systems (NIS 2 Directive)," European Union, Sarbanes-Oxley Compliance Professionals Association, “The Sarbanes-Oxley Act”
¹¹ Alzahrani, A.; “The Dark Web Economy: How Cybercrime Networks Operate,” LinkedIn, 10 September 2024
¹² Sophos, The State of Ransomware 2025
¹³ Mandiant, Google Cloud Security, M-Trends 2024 Special Report
¹⁴ MITRE, “ATT&CK Matrix for Enterprise” 
¹⁵ Trend Micro, “Pushing the Outer Limits Trend Micro 2024 Midyear Cybersecurity Threat Report,” 15 August 2024
¹⁶ ENISA, “The ENISA Threat Landscape 2024 Report,” 19 September 2024
¹⁷ US Department of Health and Human Services, “Summary of the HIPAA Security Rule,” USA
¹⁸ Hackman, R.; Leading Teams: Setting the Stage for Great Performances, Harvard Business Review Press, 2002; Malone, T.; Laubacher, R.; et al.; “The Collective Intelligence Genome,” MIT Sloan Management Review; Woolley, A. W.; Chabris, C. F.; et al.; “Evidence for a Collective Intelligence Factor in the Performance of Human Groups,” Science, vol. 330, iss. 6004, 2010, p. 686–688
¹⁹ Hackman; Leading Teams; Malone; Laubacher; et al.; “The Collective Intelligence Genome”
²⁰ Elastic, “Kibana,”  Grafana Labs, “Grafana Cloud” 

ANDRES ALMANZA | CISM, ISO 27001 SENIOR LEAD IMPLEMENTER, ITIL V3, LPIC-1

Is an international researcher and lecturer in cybersecurity and leadership. He is also a volunteer mentor of the Quiero Mentoria program at the Universidad de los Andes (Colombia) and part of ISACA’s International Mentoring Program. He serves as a virtual chief information security officer (CISO) and chief privacy officer (CPO).