How Real-Time Threat Intelligence Can Guide PAM and Network Security | SSH

Written by Jani Virkkula | Jan 13, 2026 9:00:00 AM

Modern cyber threats do not operate on business hours, and they do not respect geographic boundaries. Organizations require constant visibility into their IT networks, and increasingly across OT, cloud, industrial, and hybrid environments.

Security Operation Centres (SOC) were built precisely for this challenge. A good SOC provides:

24/7 global monitoring, powered by distributed operational centers

Threat intelligence fusion, giving early detection of emerging campaigns

Real-time incident response that scales with the severity of threats

This level of situational awareness is essential for detecting lateral movement, supply chain attacks, and sophisticated intrusion attempts before they escalate.

Threat intelligence can be delivered in real time from a SOC and provides actionable signals about which systems, identities, network segments, or geographies are at risk. This information can directly influence how critical cybersecurity solutions like Privileged Access Management (PAM) and Network Encryption enforce protections.

We can break this into two categories.

1. Real-Time Threat Intelligence Feeding Access Control Decisions

Modern privileged access management solutions can be fed with information from SOCs to temporarily increase their controls in high-risk scenarios. Threat intel can dynamically influence:

Who gets access (e.g., block, restrict or elevate verification requirements for users linked to threat activity)

What access paths are allowed (e.g., block risky geolocations, devices or behavior patterns)

How access is granted (e.g., enforce step-up authentication when certain indicators appear)

When access is automatically temporarily suspended (e.g., if a threat actor is probing a target system)

Examples:

Threat intelligencesignal	PAM adjustment
Suspicious login patterns from a region	Block or require step-up authorization for that region (e.g external authorization of access)
A vulnerability detected in a certain server	Temporarily restrict admin access
Compromisedcredentials detected	Immediately invalidate related sessions to terminate them in real-time
Elevated threat level for OT/ICS systems	Enforce stricter JIT access or session oversightwith. e.g. session monitoring or enforcing site manager approval for all sessions

A PAM with dynamic, just-in-time model makes it ideal for reacting to live threat feeds, because there are no passwords or static credentials that could be exploited during periods of heightened risk.

2. Real-Time Threat Intelligence to feed Network Protection Decisions

A modern network security solution can adapt protection levels or network segmentation based on real-time threat assessment.

Threat intel can inform:

Which network segments must be isolated

Which communication channels require quantum-safe or high-assurance encryption

Where additional routing restrictions are needed

When to switch networks into a more hardened security mode

Examples:

Threat intel signal	Network Encryption action
Active man-in-the-middle (MITM)attempts targeting remote links	Increase link assurance or re-route traffic through secured paths
Zero-day exploit targeting VPN technologies	Shift from legacy VPNs to encryptedtunnels for sensitive data flows
Threat activity around supply-chain partners	Segment partner traffic behind network encryption solutiongateways
Detection of nation-state cyber operations	Activate quantum-safe encryption profiles

The network security solution’s role is to ensure that critical data paths remain secure even during active cyber intrusion scenarios, which threat intel helps identify.

3. Combine SOC, PAM and network security for Adaptive Cyber Defense

Leonardo S.p.A - a global key player in aerospace, defence, and security - and SSH Communications Security announced their strategic partnershiplast year and are building stronger cybersecurity together. Leonardo’s Global Security Operation Centre (GSOC) protects institutions, private enterprisesand strategic infrastructure in 130 countries all over the world against cyber threats. A live threat intelligence feed from a GSOC can trigger:

Adaptive access control for SSH’s PrivX Just-in-Time PAM

Adaptive network hardening and dynamic network segmentation for SSH’s NQX network encryption solution

This positive feedback loop works as follows:

When a threat is detected, GSOC analyses it and sends instructions to adjust access or network controls accordingly. PrivX PAM and NQX network encryption enforce policy to shrink the attack surface from multiple fronts, while the GSOC confirms the containment of the threat.

This reduces the window of opportunity for attackers by using cybersecurity that can take preventive or emergency actions within changing contexts and brings SOC-driven intelligence and enforcement mechanisms together.

The outcome is a responsive, living security posture instead of static rules.

Learn more about Leonardo’s Global Security Operation Centre (GSOC) >>>

Learn more about SSH's PrivX >>>

Learn more about SSH's NQX >>>

View full post