A security analyst at a regional hospital wants threat intelligence that is specific to healthcare, contributed by peer organizations that have faced the same attackers, and exchanged under agreed handling rules. Which intelligence source BEST fits these requirements?

Information-sharing communities, such as sector-based information sharing and analysis centers, bring together organizations in the same industry to exchange indicators, tactics, and incident lessons. Members contribute what they observe, so the intelligence reflects attackers actually targeting that sector, and sharing occurs under agreed handling rules, such as traffic-light designations that control redistribution. Peer validation and sector relevance make this source well suited to the analyst's three requirements. Open-source intelligence gathered from public news and social media is broad, but it is not limited to healthcare, is not contributed by vetted peers, and carries no handling agreement; its reliability must be established through corroboration. A proprietary vendor feed can be high quality and timely, yet it is produced by the vendor from its own telemetry and sold across all sectors, so it is neither peer-contributed nor specific to the hospital's industry. Dark web monitoring can reveal leaked credentials or planned attacks, but its sources are anonymous and often unreliable, and it is not a community of peers. Exam caveat: reliability differs by source type, so analysts weigh corroboration, timeliness, and the provider's track record before acting on any indicator. Operational check: confirm membership terms and handling rules before sharing, tag ingested indicators by source and confidence, and track how many community-sourced alerts proved accurate.