One attacker campaign, one malicious indicator (an IP, file hash or phishing domain), aimed at the same six organizations in the same order — only the defense model changes between runs.
Isolated: no organization knows what any other has seen. Every single hit lands successfully the instant the attacker arrives, because detection only starts afterward and takes real time — the org stays compromised for the full detection delay before it can even patch itself, and that local fix never reaches anyone else.
Shared feed: the first organization hit is just as blind as in isolation and still gets hit successfully — nobody had seen this IOC yet. But the moment it detects and confirms the indicator, it publishes it to the shared feed almost instantly. Every other subscribed organization the attacker hasn't reached yet updates its blocklist immediately, so when the attacker arrives it is blocked pre-emptively — the campaign's own travel time between targets is what makes the head start possible.
isolated: hit → [detection delay] → local patch (too late to help)
shared feed: first hit → [share delay ≈ instant] → every future target pre-blocked
- Time between targets — how long the attacker takes to travel from one organization to the next; this is the window the shared feed exploits.
- Isolated detection delay — how long an unaided organization takes to notice and confirm the attack on its own.
Real-world relevance: this is the core argument for IOC sharing standards (STIX/TAXII) and MITRE ATT&CK-based threat-intel platforms — the value isn't stopping the first victim, it's collapsing the window every subsequent victim would otherwise face alone.