The Unknown Unknown Problem in Threat Intelligence

There's a quiet assumption baked into most threat intelligence programs: that if we just monitor enough feeds, subscribe to enough platforms, and map enough TTPs to MITRE ATT&CK, we'll eventually have