Any organisation that runs an online enquiry form, a booking calendar and a records portal ends up hearing confident claims about security from vendors, conference speakers and well-meaning colleagues. Several of those claims collapse when held up against evidence. This post tests six popular myths about ThreatOps, the practice of studying attackers and hunting for their traces, using figures and cases from the Ops Atlas. It concerns only the office and technology side of a health service and contains no clinical content or advice.
Myth 1: “More threat feeds means more protection”
The evidence. The Atlas lists this belief among its anti-patterns. Its worked quarter shows a feed that produced 120 alerts, of which 18 were genuine, a precision of 15 percent. The sensible verdict was to leave it in alert-only mode and mark it as a candidate for cancellation. Volume did not translate into value, because a feed matters only when it answers a question someone is asking and changes a decision.
Better practice. Keep a small register of priority questions and measure each source against it. If you have never counted how often a feed is right, begin there. A written ledger of this kind resembles the household habit described in a plain budget book approach for village families: nothing improves until it is recorded.
Myth 2: “Blocking should happen automatically by default”
The evidence. The Atlas quotes the incident-response community body FIRST, whose guidance says feeds suit flagging and alerting rather than automated blocking, and it notes that early-stage programmes should alert. A documented mishap shows why: a feed named an address inside a pool shared by thousands of harmless sites, so everyday visitors were refused until staff undid the block within minutes.
Better practice. Treat blocking as a privilege granted after measurement. The Atlas’s example gate requires a highly rated source, a credible claim, at least 0.9 precision over ninety days and no allowlist match. It also lets anyone on call revert, with an owner review inside an hour, and tracks reversals monthly.
Myth 3: “A hunt that finds nothing has failed”
The evidence. According to the Atlas, the opposite is true when the data is adequate: a confident negative, recorded as “would have seen it”, is a success. If the data was incomplete, the right outcome is a gap ticket and the hunt still produced something useful. The failure case is a hunt that ends with no artefact at all.
Better practice. Define success before the hunt starts, and insist on a written output. The Atlas adds a neat acceptance test: hand the notes to an outsider and see whether they can reproduce the hunt.
Myth 4: “Sharing information about attackers is too risky, so share nothing”
The evidence. The Atlas calls this a myth because tools exist to make sharing safe. Traffic-light labels, whose second version became authoritative in August 2022, set how far an item may travel. Pre-approved categories remove case-by-case worry, and Article 29 of the EU’s NIS2 directive describes voluntary sharing. The Atlas also notes one real hazard: passing amber-labelled material beyond its intended recipients.
Better practice. Agree the policy once and apply labels every time. Remember too that legal protections change; the Atlas flags that protections under an American sharing law lapse on 11 December 2026, so confirm where things stand before leaning on them.
Myth 5: “A coverage heat map shows we are protected”
The evidence. The ATT&CK catalogue describes behaviour, but the Atlas points out that its tactics are unordered according to the project’s own FAQ, and quotes the PEAK guide to the effect that much of the catalogue was never intended to turn into alert rules. A major update in October 2026 added a Stealth tactic and a Defense Impairment tactic, which broke earlier maps. A colourful chart therefore proves little.
Better practice. Pick a pair of behaviours that matter for your own estate, hunt for them every other week and record outcomes. In the Atlas’s lab exercise, three criminal groups used 92 different techniques between them, and only two techniques, valid accounts and external remote services, were common to all three. Matching a group name to a chart is a poor forecast; testing those shared behaviours is far more practical.
Myth 6: “Our worry is ransomware, so we need intelligence on everything about it”
The evidence. A topic that large produces reading, not decisions. The Atlas advises splitting such a worry into narrow questions, each paired with the single fact needed and the single decision it feeds, with no more than about eight active together.
Better practice. Ask something answerable, for example whether staff logins on the scheduling portal could be reached by outsiders through remote access, and what log evidence would show it. If your team plans seasonal spending, the same narrowing habit appears in a seasonal budget plan that keeps gifts and bills under control.
Why these six keep circulating
Every myth here swaps activity for evidence: more feeds, more blocks, more charts, more topics. The Atlas’s answer is to measure outcomes. Its sample quarter reads like a small scoreboard: five of six questions answered, 14 of 40 intelligence items acted upon, five of twelve hunts producing something concrete and four of nine gaps closed. Meanwhile it dismisses counts of indicators loaded or hunts begun. Anyone can calculate comparable ratios from their own records within a day.
For the full source text, including the maturity ladder and the ninety-day plan, read the Ops Atlas ThreatOps entry. It is candid that the term itself is not formally standardised, which is another reason to check claims against evidence before acting on them.