A method and system for implementing threat intelligence as a service in a cloud computing environment. Specifically, the disclosed method and system entail leveraging existing disaster recovery (DR) solutions to perform threat intelligence tests and identify known cyber security threats and/or anomalous activity instigated by unknown cyber security threats, if any, on system images backed up on the existing DR solution. In leveraging existing DR solutions, a threat intelligence service is integrated into the existing DR solution as an additional feature.