15 Years of CINS Army: The State of Cyber Threat Intelligence in the Age of AI

This month, Nomic is celebrating 15 years of Collective Intelligence Network Security (CINS).

Way back in December 2011, CINS launched as a small list of offending IPs, shared for free, before “cyber threat intelligence” was even a thing. Today, it’s one of the most popular threat intelligence feeds on the planet.

Considering that change, we thought it was time for a State of the Union on threat intelligence. We’re going to explore where it came from, where it stands, and whether it still matters as both attackers and defenders use AI. Our answer (as you might expect) is yes, but with some obvious caveats: Intelligence only matters if it is timely, collective, and acted on.

A Short History of Threat Intelligence, Told Through CINS

But before we get to that, let’s set the stage by whizzing through the past 15 years of cyber threat intelligence, told through CINS. 

• ‍2011: CINS launches, free and updated hourly, so any defender can block known bad actors
• ‍2013: The list expands beyond the original Top 100, growing from a short blocklist into broad coverage‍
• 2015:The Cybersecurity Information Sharing Act formalizes sharing in the US. STIX/TAXII and threat intel platforms become an industry‍
• 2017: The CINS algorithm is reworked to improve scoring accuracy‍
• 2021:The 10-year milestone. Our free feed outlasts many paid products‍
• 2023: Sentinel becomes Nomic Networks‍
• Today:The shared intelligence infrastructure is proving to be fragile. Some major players (like the ISACs) depend on shaky funding, legal authority, and people willing to keep it running

Intelligence is Collective, or it isn't Much Use

Teamwork makes the dream work. Organizations in the same region or sector often face the same attackers, so one organization's sighting can serve as an early warning to another. Unfortunately, competitiveness can get in the way.

Municipalities tend to be better at collective defense than private companies. They don’t compete with each other, so they’re much more willing to share information. Industries like banking, where the stakes are high, sometimes share common problems and trade notes on them. That’s a beautiful thing, but we don’t see enough of it.

CINS automates that collaboration and builds it into its network of sensors. Every sensor learns from the others, so a probe of one network helps protect the rest.

Organizations with limited resources benefit most from this kind of model. Water systems, local governments, and hospitals run essential services with skeleton cybersecurity teams, and an attack on one can quickly ripple through the whole community. Collective defense allows them to pool resources and, ultimately, contribute to nationwide resilience.

Regulators are Writing Sharing Into Law, Even as Funding Wobbles

Intelligence sharing is in a bit of a weird spot. As regulators demand it, the infrastructure that makes it possible is on increasingly shaky ground.

In the EU, for example, intelligence sharing forms an increasingly significant part of several frameworks:

• NIS2 Article 29 sets out a framework for cybersecurity information-sharing arrangements among in-scope entities
• DORA Article 45 allows financial entities to exchange cyber threat information and intelligence within trusted communities, and requires them to notify authorities when they join or leave such arrangements
• The Cyber Resilience Act (CRA) requires manufacturers to send an early warning within 24 hours of learning that a vulnerability in their product is being actively exploited

In the US, however, the legal and organizational support for sharing has been much less steady. CISA 2015, which provides vital liability protections, FOIA exemptions, and privilege safeguards for organizations sharing cyber threat indicators, sunset on September 30, 2025. While it has since been reinstated, that lapse remains concerning.

MS-ISAC, meanwhile, began charging for feeds after DHS ended its federal funding in 2025. It had 18,574 members the day funding stopped. Following the transition to a tiered paid membership model, MS-ISAC has onboarded 5,992 public-sector organizations. On October 15, 2026, CIS announced that State and Local Cybersecurity Grant Program funds can be applied toward membership, but the uncertainty remains.

This is why free, independent, community-sustained feeds are so important. Without them, it’s not impossible that small organizations would lose access to shared intelligence entirely.

Threat Intelligence When AI Shrinks the Clock

AI has allowed attackers to move at warp speed.

Mandiant’s M-Trends 2026 report found that the median time from initial access to hand-off to a second attacker fell from more than eight hours in 2022 to 22 seconds in 2025. Unit 42, meanwhile, found attackers scanning for new vulnerabilities within 15 minutes of a CVE announcement.

That said, AI is good at quickly combining and accelerating existing tactics, but it’s not necessarily introducing fundamentally new attack methods (yet). VulnCheck even found that only 14 of the 1071 AI-discovered vulnerabilities were exploited in the first half of 2026, about the same rate as vulnerabilities overall.

What that means is that actionable intelligence is more important than ever. When integration of the intelligence is timely and autonomous, it prevents known-bad infrastructure from connecting in the first place, so AI-enabled attackers can’t exploit it, however fast they’re moving. In Gartner’s terms, it’s the “Deny” in the 3 Ds, and it’s why blocking at the Edge still matters.  

What Has 15 Years Taught Us?

15 years ago, we started CINS because we thought defenders shouldn’t have to pay to find out who was knocking on their network’s front door. We still believe that, but the goalposts have moved. Intelligence has to be timely and collective, and someone has to act on it, and AI has raised the cost of getting that wrong.

Last we checked, users around the world download the CINS Army list hundreds of thousands of times a day. To everyone who has pulled the list, built it into a tool, reported an issue, or told us when we got something wrong: Thank you. If you haven’t yet, get the CINS Army list for free, or see how CINS works inside Outpost with an instant demo.