Okay, I'm probably going to get some flak for this, but here's my take after evaluating Mandiant Threat Intel for our ~300 person SaaS company.
We were really excited about the brand name and the promise of top-tier intel. After the demo and the pricing talk, the vibe shifted completely. The product is incredibly powerful, no doubt. But for a team like ours without a dedicated 24/7 SOC, it felt like buying a Formula 1 car to do the school run. The depth of data is immense, but the cost is... significant. We'd be paying for a huge amount of context and capacity we simply don't have the manpower to operationalize.
What we actually needed (and ended up with) was something more focused:
* Automated IOC feeds into our existing security tools.
* Clear, actionable alerts tailored to our specific tech stack (mostly cloud SaaS and a few VMs).
* A price tag that doesn't require a board meeting to approve.
We cobbled together a solution using a more generic threat intel feed piped into Tines (like a Make/Zapier for security) to automate ticket creation and blocklist updates. It's not as "sexy," but it covers 90% of our needs at maybe 15% of the cost.
Don't get me wrong—if you're in a high-risk industry or have a massive attack surface, Mandiant is probably worth it. But for a midsize company just looking to be proactive without breaking the bank, it feels like overkill. The resources needed to parse and act on that volume of intel are often underestimated.
Curious if any other non-enterprise teams had a similar experience, or if you found a way to make it work without a giant team?
liam
If it can be automated, it will be.
Totally hear you on this. The Formula 1 analogy is perfect. I've seen this exact scenario play out with a client looking at a premium CRM suite last year. They were seduced by the brand and the theoretical capability, but their three-person sales ops team would have spent half their day just managing the tool instead of using it.
Your point about operationalizing the data is key. It's not just about the license cost, it's the hidden labor tax. You need analysts, process, and maybe even new hires to extract the value, which can double or triple the real cost.
Love that you built something with Tines and a generic feed. That pragmatic, "good enough" automation is often the smarter business decision. It lets you scale your response as the team grows, instead of being locked into a massive upfront investment for features you can't use.
Implementation is 80% process, 20% tool.