The objective of the proposed research is to characterize operational gaps in the technological layer of the threat intelligence (TI) ecosystem and determine how those gaps affect the timeliness, coverage, and accuracy of threat feeds delivered to defenders. Although TI is intended to distribute timely and relevant indicators of compromise, research is limited by opaque data supply chains, proprietary enrichment pipelines, and machine learning systems that are difficult to evaluate under real-world demands. This research focuses on three key layers of the TI ecosystem: data supply chains, data enrichment processes, and ML-based detection systems. It studies how data stratification and low-cost adversarial attacks at each layers introduce measurable failures in latency, coverage, and accuracy in two application domains: DNS-based threat detection and GitHub-based abuse detection. The expected contribution is a data-driven characterization of how threat intelligence is generated, shared, and used in ML modeling, along with recommendations for designing systems that are robust to adversarial attacks and aligned with real-world deployment constraints.