What threat intelligence do you read regularly, and how do you decide whether to believe a vendor report?

On sources, the useful answer describes a spread rather than a brand list: your own telemetry first because it is the only thing scoped to your environment, national CERT and government advisories, vendor research teams, sector sharing communities, and a handful of independent researchers.

On believing a report, the test is what evidence it shows. A report that publishes its observables, explains how it collected them, and separates what it saw from what it concluded can be evaluated. One that asserts an attribution without showing the reasoning can only be trusted or not, which is a much weaker position.

I grade the source and the claim separately. Source reliability is a track-record judgement — has this team been right before, do they show their working, do they correct themselves. Credibility is about this specific claim — is it corroborated by genuinely independent reporting, and is it internally consistent. A very reliable vendor can publish a claim nobody else can corroborate, and that combination should lower confidence even though the source is good.

The failure to watch for is circular reporting. Four articles referencing a claim, three of which cite the fourth, is one source. So is two vendors who both draw on the same telemetry partner. I trace claims back to the earliest publication that presents original evidence.

I also read for incentive. Vendors publish partly to demonstrate capability, which biases toward novelty and toward "sophisticated" framing. That does not make the technical content wrong, but it does mean the emphasis is not neutral.