Threat intelligence helps defenders disrupt malicious infrastructure, but opaque collection, analysis, and dissemination
processes obscure its operational limitations. This dissertation develops active external measurements to reveal gaps in
accuracy, coverage, context, and timeliness. Executable probes and instrumented servers trace artifact extraction,
propagation, and defensive action across 30 security vendors, exposing incomplete analysis and dissemination. Controlled experiments and large-scale crawling reveal retrieval and execution failures on shared hosting platforms and
missing associations between recovered binaries and their originating URLs. To address these gaps, targeted collection
and multimodal analysis identify malicious GitHub repositories and software packages. A 45-day evaluation spanning
approximately 13.5 million repositories uncovers 4,261 previously unreported malicious repositories, contributing to over
4,000 takedowns. Finally, experiments with GitHub and DNS detection systems demonstrate how low-cost adversarial
manipulation undermines classification and artifact validation. Together, these studies establish methods for auditing
threat intelligence systems and inform improvements to collection, provenance, dissemination, and detection robustness.