You receive TLP:RED intelligence in a trust group indicating a specific vulnerability is being exploited against your sector. Your organisation is exposed. What do you do?

TLP:RED means the information stays with the individuals in that specific exchange. Not my team, not my manager, not my organisation — the people in the room. So on the face of it I cannot even tell my own patching team.

That is a real conflict, and pretending it is not is the wrong start. I have an obligation to the sharing community and a duty to protect my organisation, and they point in opposite directions here.

The correct first move is to go back to the originator, quickly, and ask. Specifically: can I act on this internally, and can I have a downgraded version — TLP:AMBER+STRICT, or just the vulnerability and the fact of exploitation without the sourcing and the victim detail — that I can take to my own people. In my experience originators say yes to this far more often than analysts expect, because they shared it precisely so recipients would be safer. What they are protecting is usually the source and the victim, not the technical fact.

While waiting, I would look at what I can do that does not depend on the intelligence. If the vulnerability is one we should be patching anyway, accelerating it through normal vulnerability management is legitimate — the action is justified by our own exposure, not by the restricted material. That is a genuinely different thing from disclosing.

The subtlety worth raising is that an action can disclose. Deploying a narrow detection or block that only makes sense if you knew this specific thing can tell the adversary what you know, and can tell other recipients where the leak came from. So the mitigation should look like routine hygiene, not like a targeted response.

If the originator cannot be reached and the exposure is severe, I escalate internally — to my own management and, depending on the group's rules, to the group's coordinator — and I make the decision visible and documented rather than taking it alone in a chat window.

What I would not do is decide unilaterally that this case is special. TLP is a trust agreement, not a technical control; it works only because people honour it when it is inconvenient. Breaching it ends the relationship, and the intelligence I would lose access to afterwards is worth more than one early warning.