Which of the following is the MOST useful information an organization can obtain from external sources about emerging threats?

While solutions are useful, detecting the threat first is paramount. Solutions are often specific to an organization's environment and may not be universally provided or applicable from external sources.

The cost to mitigate is highly dependent on an organization's specific environment, existing controls, and financial situation, making external, general cost information less directly useful than detection capabilities.

Indicators of Compromise (IoCs) or other threat indicators, such as signatures, hashes, IP addresses, or Tactics, Techniques, and Procedures (TTPs), derived from external threat intelligence, allow an organization to detect active threats within its environment before significant damage occurs. This enables proactive monitoring and defense.

While knowing the source and identity of attackers can be valuable for attribution or law enforcement, it is less immediately useful for preventing or detecting an active attack than knowing how to identify the threat itself within an organization's systems.