"That can help close that visibility gap," he said.
According to the Osterman report, this kind of painstaking manual investigation can take weeks -- and isn't worth the hassle for smaller incursions.
And that could be be a problem.
"We've all seen that the leading edge of a very serious breach might look like something that's not a big deal," said Chen.
"However, current-generation tools make the process of attack attribution much more cost effective," said the report.
Security researchers understand the value of threat intelligence, Helming said.
According to the survey, 82 percent said they would use it all the time if it was available to them.
Sign up for MIS Asia eNewsletters.