Does a great job distinguishing between "threat intelligence" and "incident response". Difficult to fix what you can't see, but just seeing what has already happened doesn't help us get to the promised land of true proactive protection. We here at Norse are very focused on "live" threat intelligence. Looking where most do not have visibility (dark side of the Internet) and making this information available within a few seconds. As you point out, bigger pipes, virtual environments and better tools all lead to the opportunity of fast change. If you're not looking, you'll miss it. Thanks for a really well written article.