There are many Cyber Threat Intelligence (CTI) products and services on the market today. While the type of content is similar, the service models being applied are vastly different. From an operational standpoint, the value provided by the different service models varies significantly and is directly associated with the consumer and their intended usage of the CTI. Organizations considering participation in a CTI sharing community or subscribing to CTI feeds need to understand the service model being used by the provider. Different service models provide different types of value, and an organization needs to define the operational use cases for the CTI to determine the operational value of the proposed investment.