Our SOAR playbooks are dead because we treat external threat intel APIs as a hard dependency. This is a design flaw.
* Automations (auto-blocking, alert enrichment) fail when the vendor's API has an outage.
* No local caching of critical IOCs means we're blind during their downtime.
* This creates a single point of failure in our threat response.
Current flawed pattern looks like this:
```python
response = requests.get('https://api.vendor.com/v1/indicators') # No fallback, no cache.
if response.status_code != 200:
raise Exception("Intel feed down") # Playbook stops.
```
We need to decouple. What's your fallback strategy?
* Stale-but-usable local cache with a TTL?
* Secondary feed from a different provider?
* Fail-open vs. fail-close logic in the playbook?
Building resilience is more important than the latest IOC update.
Least privilege is not a suggestion.