Agree that posture alone isn't enough. Knowing the enemy also means knowing their infrastructure. Attackers reuse registrant details, nameservers and mail servers across campaigns, and that reuse is something defenders can track. Threat feeds built on those shared-infrastructure pivots (e.g. https://whoisfreaks.com/products/threat-intelligence-feed) turn "know your enemy" into a daily blocklist.