Intelligence Tradecraft - Sharpen your analytic edge

What separates good intelligence from noise, and why do so many organizations struggle to act on it? In this episode, host Freddy Murre sits down with Ondra Rojčík, an IBM security consultant with over 15 years in Czech government intelligence, to discuss tradecraft, stakeholders, and how AI fits into the intelligence cycle.

Ondra explains why he stepped back from management to return to hands-on analysis, and reflects on what struck him about transitioning from a 250-person agency to a global tech giant. He also describes arriving at NATO and realizing how much basic tradecraft he lacked. That realization later inspired him to build a university course on intelligence analysis.

Freddy and Ondra debate where information ends and intelligence begins. For Ondra, good intelligence answers the "so what" for a specific organization. Most public threat reports fail because they lack this tailoring. He walks through how his team built its own process for priority intelligence requirements, while being candid about executives unready to act, the public sector's superior training budgets, and the difficulty of measuring impact.

They also weigh in on AI: LLMs excel at narrow tasks like summarization, but framework-mapping tests that looked promising on small samples fell apart at scale. Furthermore, stakeholders cannot simply rely on LLMs because they often do not know which questions to ask. Spotting unlisted threats remains the analyst's job. Meanwhile, adversaries use LLMs for speed and scale, raising the question: do more attempts mean more successful attacks?

Whether you are maturing a CTI function, trying to influence leadership, or integrating LLMs, Ondra's experience proves that good tradecraft is only half the job; the other half is reaching people ready to act.

RESOURCES

IBM Acquisition of Red Hat - https://www.ibm.com/investor/news/ibm-completes-acquisition-of-red-hat Czech National Cyber Security Agency - https://nukib.gov.cz/en/ Pherson SAT Book - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/ Intelligence training with Freddy - https://inteltradecraft.com/sat-certifications Pherson & Heuer SAT Book - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/ Ondra's Medium profile - https://medium.com/@orojcik FIRST CTI 2026 - https://www.first.org/conference/firstcti26/ Ondra PIRs at SANS - https://www.sans.org/blog/bridging-gaps-cti-practical-guide-threat-informed-security-pirs

CHAPTERS

00:00 Ondra's Path Into Intelligence

04:08 Leaving Government for Industry

06:32 Government vs Private Sector Culture

09:10 Learning Tradecraft the Hard Way

12:58 Teaching and Practicing Tradecraft

20:41 What Counts as Intelligence

25:28 Sharing Knowledge and Building PIRs

30:20 Intelligence Culture in Industry

33:46 Maturing a CTI Team

37:17 Training Budgets and Follow-Through

42:00 Measuring the Value of Intelligence

46:04 How Analysts Use AI Today

49:13 AI's Future in CTI

57:30 Adversaries, AI and Attack Success

1:04:25 People Who Opened Doors

What does it take to build and run a cyber threat intelligence function, and how can you tell whether the intelligence you’re producing is any good? In this episode, host Freddy Murre sits down with Sherman Chu, who at the time of the interview worked at BlackRock, for a conversation about lessons learned on the job, tradecraft and AI.

Sherman recounts his path from Army intelligence support through grad school and a vendor role at Flashpoint, then to end-user teams in financial services, building New York City’s CTI program from the ground up, and a stint at Deloitte. He explains what changes when you move from serving a broad customer base to serving specific stakeholders, and why end-user teams must also collect internally.

Freddy and Sherman cover team-building: finding buy-in, keeping collection minimal, justifying budgets, evaluating vendors, and why training so often fails to change how a team works. Sherman shares the courses and books he considers foundational, including The Diamond Model of Intrusion Analysis and Heuer’s Psychology of Intelligence Analysis.

A key question that comes up is what separates intelligence from data and information. Sherman offers his own definition, then breaks down what bad intelligence looks like, from marketing dressed up as analysis to context-free indicator sharing. He also explains how inconsistent terminology holds the field back.

Over the last couple of years, Sherman’s view of AI has shifted from early skepticism to cautious adoption. He shares how he pairs deterministic code with LLMs to extract adversary procedures from reports, where models still hallucinate, and why analysis remains the hardest step to automate.

Their advice for newcomers is to stay curious, build a pet project, and stay humble. If you lead a CTI team, want to join one, or are weighing where AI belongs in your workflow, this episode is well worth your time.

RESOURCES

Flashpoint - https://flashpoint.io/

Columbia University MA program - https://www.sipa.columbia.edu/sipa-education/masters-programs/concentrations/international-security-and-diplomacy

SANS FOR578 CTI -https://www.sans.org/cyber-security-courses/cyber-threat-intelligence

Sergio's course "Diamond Model of Intrusion Analysis" -https://school.threatintel.academy/courses/diamond/

Joe Slowik's Training - https://paralus.co/training/ Pherson's

Structured Analytic Techniques (SAT) - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/

Richards J. Heuer, Jr. The Psychology of Intelligence Analysis -https://www.ialeia.org/docs/Psychology_of_Intelligence_Analysis.pdf

Scott J. Roberts & Rebekah Brown's book "Intelligence-Driven Incident Response - https://www.amazon.com/Intelligence-Driven-Incident-Response-Outwitting-Adversary/dp/109812068X/

VISMA and APT Attribution discussion - https://therecord.media/norway-says-chinese-group-apt31-is-behind-catastrophic-2018-government-hack

CHAPTERS

00:00 Introduction and Career Overview

02:09 From Army Intelligence to Academia

06:05 Vendor Versus End User Intelligence

13:54 Building a Government CTI Program

17:17 Training, Certifications, and Key Books

25:14 Building a CTI Function

37:46 Budgets, Tools, and Training Value

47:28 What Counts as Intelligence

52:49 What Makes Intelligence Bad

01:00:06 Shared Language and Industry Maturity

01:07:38 AI Across the Intel Cycle

01:13:13 Hybrid LLM and Code Workflows

01:16:22 AI Limits, Risks, and Democratization

01:22:44 Traits for Aspiring Analysts

01:25:01 Neurodivergence and Staying Humble

Jan Henrik Schou Straumsheim, a partner in PwC's cyber advisory practice, sits down with host Freddy Murre to talk about the real work behind cyber threat intelligence. His interest in the field traces back to getting his hands on his father's old 386 computer and a book his mother gave him on the history of codes, and later took shape during years as a reserve infantry officer in Norway's armed forces, where he trained at the Defense Intelligence School and eventually became his unit's intelligence officer (S-2).

From there, his career moved through a summer internship at Accenture, a part-time job in the security operations center at mnemonic, a pivot into consulting, and almost a decade now at PwC.

The conversation explores what actually separates CTI from cybersecurity, and why so much of what gets sold as intelligence is really just unfiltered data dumps. Jan Henrik and Freddy debate how analysts should weigh sources, including the tricky question of trusting personas on dark web forums, then turn to how private-sector teams train and retain analytical skill, and why Nordic organizations still lag in treating CTI as more than a detection add-on. Jan Henrik shares a real client case, where a board commissioned a foresight report on AI risk, showing what it looks like when CTI actually reaches the boardroom.

The conversation then shifts to AI's role in intelligence work: how Jan Henrik uses large language models every day, why he still insists on a human checking every output before his name goes on it, and where the line sits between AI as a sparring partner and AI replacing analytical judgment altogether. They close on a reminder that opportunity often comes from someone else opening a door, and why passing that on matters.

This episode with Jan Henrik is a grounded, occasionally blunt conversation about what good intelligence work actually requires, well worth a listen for anyone trying to make CTI matter to the business it's meant to serve.

RESOURCES

simon singh the code book - https://www.amazon.com/dp/0385495323

Mnemonic Internships - https://www.mnemonic.io/no/careers/internships/

Hatlebrekke The Problem of Secret Intelligence - https://www.amazon.com/dp/0748691839

Freddy's SANS CTI Summit presentationFrom Gut to Gold Standard: The Admiralty System in CTI - https://youtu.be/y-CSDxMMXb0?t=5

Freddy's SANS posts on Admiralty Scale - https://www.sans.org/profiles/freddy-murstad#resources

SANS Cybercrime Investigations - https://www.sans.org/cyber-security-courses/cybercrime-investigations

Washington D.C. police gaming crime statistics - https://www.washingtonpost.com/dc-md-va/2026/05/08/dc-police-crime-statistics-internal-investigation-findings/

Research article Non-Determinism of “Deterministic” LLM System Settings in Hosted Environments - https://aclanthology.org/2025.eval4nlp-1.12/

Research article Cognitive offloading, critical thinking and attitudes towards artificial intelligence https://pubmed.ncbi.nlm.nih.gov/42377671/

Freddy's LinkedIn Profile -https://www.linkedin.com/in/fmurre/

CHAPTERS

0:00 Early path into cybersecurity

2:12 From mnemonic's SOC to PwC

8:27 Building PwC's global CTI arm

10:38 CTI versus cybersecurity defined

11:45 Military intelligence background

18:40 What actually counts as intelligence

20:05 Separating good intel from bad

26:19 Training and upskilling analysts

32:57 CTI maturity across the Nordics

41:20 Linking CTI to enterprise risk

50:28 Building a successful CTI function

56:30 Measuring CTI's real value

1:03:12 AI's rapid rise in CTI

1:14:51 AI risks and human oversight

1:26:01 Career-defining opportunities and mentorship

In this episode of Intelligence Tradecraft, host Freddy Murre sits down with Rebecca Ford, a cyber threat intelligence analyst who started out on the government side with Army Cyber and DISA, focused heavily on North Korea and the Asia-Pacific region. From there, she moved into the private sector, where she's spent the better part of a decade helping grow a CTI function from an early-stage team into something far more mature.

Rebecca traces her path into the field: an overheard conversation about true-crime shows that led an Army analyst to recruit her, on-the-job training in an era before cyber threat intelligence even had a name, and the 2014 Sony hack as the moment the discipline truly landed on the map.

She and Freddy explore what separates useful intelligence from what she calls being reduced to "news reporters with a microphone." The difference lies in handing stakeholders a raw threat feed versus giving them analysis that actually drives a decision. Rebecca shares her working definition of intelligence, built around an adversary's intent, opportunity, and capability. They also get into the two very different audiences an analyst serves, senior leadership and network defenders, and why treating report counts as a success metric misses the point entirely.

The conversation covers building real relationships with stakeholders, the argument for "fusion centers" that merge cyber, physical, travel, and financial-crime intelligence, and the considerable value of community and mentorship in a field where, as Rebecca puts it, your next opportunity usually comes from someone who already knows you.

A large part of the discussion is about AI: where it genuinely speeds up research and helps an analyst get started, why Rebecca still verifies everything by hand before it goes out, and why she believes human judgment should stay in charge of the final call.

Rebecca ends with a reminder that showing up and investing in the community, whether at conferences, in focus groups, or at vendor events, is part of the job for anyone hoping to build a career in the field.

RESOURCES

Sony Hack - https://www.bbc.com/news/world-asia-30573040

Gert Jan's Metrics - https://github.com/gertjanbruggink/metrics

SANS CTI Summit 2026 Visual Summary - https://www.sans.org/blog/visual-summary-sans-cti-summit-2026

Rebecca's LinkedIn - https://www.linkedin.com/in/rebeccaford/

Freddy's Intelligence Architecture Mind Map - https://github.com/Errum/IntelArchitectureMap

Reuters IKEA bets on remote interior design as AI changes sales strategy - https://www.reuters.com/technology/ikea-bets-remote-interior-design-ai-changes-sales-strategy-2023-06-13/

CHAPTERS

00:00 Welcome & Rebecca's Background

00:57 Breaking Into Cyber Threat Intel

02:58 Learning Cyber Intel From Scratch

04:30 The Sony Hack Turning Point

06:53 From Army Cyber to DISA

09:32 Adjusting to the Private Sector

12:29 Defining Intelligence and Stakeholders

15:16 Proving Value and Building Community

23:14 Good Intelligence vs. Bad Intelligence

26:20 Mentorship and Learning From Mistakes

34:01 Team Diversity and Fusion Centers

40:25 Misconceptions and Measuring Impact

47:00 Communicating With Stakeholders

55:07 Where AI Fits in Intel

1:13:15 Mentors, Advice & Closing Thoughts

In this episode of Intelligence Tradecraft, host Freddy Murre talks with Rebekah Brown, senior researcher at the University of Toronto's Citizen Lab, about what it actually takes to do intelligence work well, in government and in the private sector. Rebekah's background spans the field: she started as a Marine Corps cryptologic linguist and NSA analyst, later led threat intelligence at Nike, and worked the vendor side at Rapid7. Today, she co-authors the SANS FOR578 course and has co-written an incident response book with Scott Roberts.

The conversation traces how a clerical error sent her through Mandarin Chinese training instead of Korean, why private-sector CTI teams so often import government habits that don't fit the business they're protecting, and why translating between technical teams and leadership is often the real job description.

They spend real time on definitions: what separates intelligence from reporting, what makes intelligence good or bad, and why so much of what gets labeled cyber threat intelligence in the private sector is really just collected information without analysis behind it.

Rebekah and Freddy also trade stories about the growing pains of building a threat intelligence function inside a business that doesn't think in nation-state terms, and what it actually takes to make expensive training change how a team works day to day.

When it comes to AI, Rebekah explains where she believes LLMs can genuinely support brainstorming, coding, and research tasks, and where she draws a hard line at analysis itself. The two also debate how AI might reshape the size and shape of intelligence teams in the years ahead.

It's a grounded, experience-driven conversation for analysts, team leads, and anyone trying to prove the value of intelligence inside their organization.

RECOURCES

The Marine Corps Logo - https://www.war.gov/Multimedia/Photos/igphoto/2001789719/ Defense Language Institute

Foreign Language Center - https://www.dliflc.edu/

University of Toronto Citizen Lab - https://citizenlab.ca/

The Cuckoo's Egg - https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espionage/dp/1668048167/

Ghost Net Report - https://citizenlab.ca/research/tracking-ghostnet-investigating-a-cyber-espionage-network/

Intelligence-Driven Incident Response - https://www.amazon.com/Intelligence-Driven-Incident-Response-Outwitting-Adversary/dp/109812068X/

Scott Roberts LinkedIn - https://www.linkedin.com/in/scottroberts/

SANS FOR578 - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence

Rob M Lee LinkedIn - https://www.linkedin.com/in/robmichaellee/

CHAPTERS

00:00 Welcome and introductions

0:37 High school to the Marines

1:22 Becoming a Marine linguist

3:56 A lucky mix-up at NSA

5:45 Early training and mentors

9:44 What is intelligence?

14:17 Good intelligence versus bad

16:32 Leading and teaching Marines

20:37 Injury ends a military career

25:12 Standing up Nike's threat intel

31:28 Rapid7 and the CTI boom

38:19 Bridging techies and leadership

45:01 Writing the book and course

58:15 Measuring intelligence's real value

1:02:27 Where AI fits in intel

Staff Threat Intelligence Advisor Josh Darby MacLellan at Feedly kicks off season three by unpacking his path into CTI, what separates intelligence that gets used from intelligence that gets ignored, and why core skills like stakeholder communication may outlast technical specialties as AI reshapes the field. Josh started his career with childhood dreams of becoming a criminal lawyer, shifted through academic study of international relations and security, and unfolded into more than a decade of private-sector threat intelligence work across Canada, the US, and multiple specialties within CTI. Josh is blunt about where the field falls short. Good intelligence is connected to a decision and a decision-maker, versus reports written for other analysts that never get read. Josh and Freddy discuss team structure, and why CTI teams that skew small and heavily technical tend to miss the core skills of stakeholder conversation that keep a function relevant when budgets tighten. Josh argues communication is a trainable skill, the same way he trained himself to become a clearer public speaker despite two speech impediments and years of mumbling through bombed public talks.As for AI, Josh draws a clear line between what he'll delegate and what he won't. He uses LLMs for collection support, editing, and even as a stand-in second analyst to catch his own blind spots, but he won't hand over the analysis stage. Trusting an unreviewed AI process, he argues, is a bit like citing a source you've never actually read. Freddy pushes back with his own testing of LLMs on structured analytic techniques, and the two get into what's actually lost when a black box quietly decides what information matters.

RESOURCES

NATO Intelligence Cycle - https://ac.nato.int/resources/uploads/2284/picture2-intel-8Wgsa2.png

Freddy's Intelligence Architecture Mind Map - https://github.com/Errum/IntelArchitectureMap/files/14615837/240315.-.Intelligence.Architecture.v0.7.42.pdf

Gert Jan's Measuring value of CTI - https://github.com/gertjanbruggink/metrics

Feedly - https://feedly.com/

Intel471's CU-GIRH - https://github.com/intel471/CU-GIR

Sherman Chu's Tyranny of Current Intelligence - https://www.youtube.com/watch?v=IETRHdMejaw

Sherman's slides - https://www.sans.org/presentations/were-in-now-now-the-tyranny-of-current-intelligence-and-how-to-manage-it

Intel Tradecraft Courses and Trainings - https://inteltradecraft.com/sat-certifications

IRM Workshop - https://www.intel471.com/lp/building-an-intel-workshop

SANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence

Josh Darby's SANS presentation "Can We Forecast Our Own Fate" - https://www.youtube.com/watch?v=B9TkeUbD1Mk

Josh's slide deck - https://www.sans.org/presentations/can-we-forecast-our-own-fate-mapping-the-future-of-the-cti-industry-with-sats

Feedly CTI Essentials - https://feedly.com/ti-essentials

Webinar: What CTI practitioners recommend you focus on in 2026 - https://feedly.com/ti-essentials/posts/what-cti-practitioners-recommend-you-focus-on-in-2026

Freddy and Josh Think smarter, not harder: Making SATs work in CTI - https://feedly.com/ti-essentials/posts/think-smarter-not-harder-making-sats-work-in-cti

Feedly AI - https://feedly.com/ai

MLitt in Terrorism Studies - https://www.st-andrews.ac.uk/subjects/international-relations/terrorism-mlitt/

CHAPTERS

0:00 Intro and Welcome

1:01 Josh's Path Into CTI

4:04 CTI Maturity Across Countries

8:08 Pivot to Protective Intelligence

12:12 Defining Intelligence and CTI

13:13 Good vs Bad Intelligence

16:16 The Intelligence Cycle

23:23 Engaging Stakeholders Directly

26:26 Core Skills and Job Security

33:33 Training and Certifications

40:40 Building Well-Rounded Teams

43:43 Mentoring and Giving Back

49:49 AI's Role in the Cycle

58:58 How Josh Uses AI

1:05:05 People Who Shaped His Career

If you've ever read a text or sat in a briefing and quietly wondered what actually separates this "intelligence" from someone's hot take on LinkedIn, a journalist with a deadline, an analyst with a search bar, or an AI, this episode is for you.

The host, Freddy Murre, sits down with Arno Reuser, the man who founded the Dutch Defence Intelligence Service's open-source intelligence (OSINT) capability in the early 1990s, before most of Europe had a word for it. What follows is less an interview than a working argument about how OSINT should actually be done, and where the field has gone soft.

Arno doesn't mince words. He'll tell you the "information explosion" everyone complains about is just proof you skipped your stakeholder and requirement analysis. That most of what gets sold as OSINT is the word "OSINT" stapled to “everything”, such as tools. That he has, by deliberate choice, never written an analytical judgment in his life, and why that line between collection and analysis matters more than people think. For anyone who's argued about what counts as OSINT versus PAI (Publicly Available Information), or where collection ends and all-source begins, this is the debate you want to engage with.

Along the way: the librarian's discipline, he says, underpins all good intelligence work, the collection plan he calls "worth gold," the classroom trick thousands of students have failed, and a run of war stories from his teachings, such as a prison break by email to a deepfake that fooled cyber experts who personally know him.

The back half takes on two problems every practitioner is living with right now. How do you put a value on intelligence when the same report is priceless to one decision-maker and useless to the next? And what is AI actually good for? Arno uses LLMs daily and is genuinely amazed by them, but only for things he can verify. He and Freddy get specific on hallucinations, sycophancy, model collapse, and the difference between a real summary and a machine that just shortens the text and deletes the one sentence that mattered.

RESOURCES

Maersk Website - https://investor.maersk.com/news-releases/news-release-details/cyber-attack-update

Dutch Police Data Breach - https://www.politie.nl/nieuws/2024/oktober/2/update-over-datalek-politie.html

When does something go from a Google answer to Intelligence - https://www.linkedin.com/posts/fmurre_in-your-opinion-when-does-something-go-from-activity-7181221399561203712-mV-m/

LexisNexis Library - https://www.lexisnexis.com/en-us/products/digital-library.page

Vague questions in OSINT - https://opensourceintelligence.biz/vague-osint-questions/

Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications

Pherson Structured Analytic Techniques for Intelligence Analysis - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/

Routledge Handbook of Terrorism Research - https://www.routledge.com/The-Routledge-Handbook-of-Terrorism-Research/Schmid/p/book/9780415520997

AI Model Collapse - https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=AI+model+collapse&btnG=

CHAPTERS

00:00 From literature searcher to founding military OSINT

04:00 Becoming a librarian: the Kampen archive moment

08:00 Where OSINT stops and intelligence begins

11:00 Why "cyber" keeps getting OSINT wrong

15:00 What actually makes something "intelligence"?

24:00 The information explosion myth

32:00 The classroom trick: think before you type

36:00 The collection plan that's "worth gold"

42:00 The human factor cyber keeps ignoring

45:00 War stories: validation and getting fooled

51:00 Learning the craft: sources, sources, sources

55:00 Customers ask for what they think you can do

01:08:00 Can you measure the value of intelligence?

01:11:00 AI and LLMs: amazed but skeptical

01:32:00 Deepfakes, the NATO photo & "how likely is it?"

SUMMARY

Former military intelligence analyst turned consultancy director Martijn Docters van Leeuwen joins Freddy Murre to unpack what cyber threat intelligence really is, and why so many teams "talk the talk" without "walking the walk", i.e. doing the work.

Martijn Docters van Leeuwen has done the whole journey, infantry, military intelligence, stopping ATM skimming and gas attacks in the Netherlands, to building a bank's first CTI team, and now being a cybersecurity consultant.

So when he talks about CTI being a tradecraft and not a report that magically lands in your inbox, he's not theorizing. He's been the only analyst in the room wearing all seven hats, the guy getting asked "why does this cost so much?", the one trying to prove value in the six quiet months when nothing's on fire.

We get into the stuff analysts actually argue about: why most teams are great at talking the talk and bad at doing it, the trap of living in your own little football field while the business has no idea what you do, how people game their own metrics to manufacture a crisis, and where AI genuinely helps versus where it's just a confident liar with no fingers. Threat vs. risk, mirror imaging, incident-driven vs. intel-driven, and the brutal truth that training does nothing if you walk out the door and never apply it.

If you do this work, or you're trying to convince someone it's worth doing, pour a coffee and settle in.

RESOURCES

Structured Analytic Techniques (SAT) Certification Training by Intel Tradecraft and Pherson - https://inteltradecraft.com/sat-certifications

Intelligence Mind Map - https://github.com/Errum/IntelArchitectureMap

When does something go from a Google answer to Intelligence - https://www.linkedin.com/posts/fmurre_in-your-opinion-when-does-something-go-from-activity-7181221399561203712-mV-m/

Mitre Att@ck - https://attack.mitre.org/resources/attack-data-and-tools/

Mark Arena - CTI: Comparing the incident-centric and actor-centric approaches - https://medium.com/@markarenaau/cyber-threat-intelligence-comparing-the-incident-centric-and-actor-centric-approaches-f20cfba2dea2

ASML The world's supplier to the semiconductor industry - https://www.asml.com/en

SANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence

TIBER European Central Bank - https://www.ecb.europa.eu/paym/cyber-resilience/tiber-eu/html/index.en.html

Freddy's resources on SANS - https://www.sans.org/profiles/freddy-murstad#resources

The intelligence cycle - https://github.com/Errum/IntelArchitectureMap

Basic cyber-hygiene guidance from CISA - https://www.cisa.gov/topics/cybersecurity-best-practices

NSM ICT Security Principles - https://nsm.no/advice-and-guidance/publications/nsm-ict-security-principles

SANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence

Obsidian (note-linking/mind-mapping for research) - https://obsidian.md/

CTI-CMM - https://cti-cmm.org/

CREST - https://www.crest-approved.org/

Google Notebook LM - https://notebooklm.google/

Intelligence minor, Leiden University - https://www.universiteitleiden.nl/en/education/minors/minor/fgga-minor-intelligence-studies

Heuer & Pherson Structured Analytic Techniques for Intelligence Analysis - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/

CHAPTERS

00:00 Introduction & from military intel to CTI

08:30 Building a bank's first CTI team

15:00 What is intelligence — and what is CTI?

26:00 Talking the talk vs. doing the work

35:00 Incident-driven vs. intelligence-driven CTI

46:00 Tradecraft, methodology & pricing CTI work

53:00 Collection, analysis & tailoring reports

01:04:00 Mirror imaging & understanding threat actors

01:08:00 Measuring the value of a CTI program

01:19:00 Threat vs. risk: capability, intent & opportunity

01:24:00 Training intel skills & making it stick

01:36:00 Can AI help us do intelligence better?

In this episode of Intelligence Tradecraft, host Freddy Murre sits down with Joe Slowik, a threat intelligence veteran whose career spans the US Navy, Los Alamos National Laboratory, MITRE, and the vendor world (Dragos, DomainTools, Gigamon, Huntress, and now DataMinr).

In the conversation, Joe makes the case that intelligence is fundamentally about decision support, not raw data feeds or research written for other analysts. He and Freddy dig into what separates good reporting from bad, why stakeholder alignment and rigor (ICD 203, clear separation of fact vs. assessment) matter, and when a "flash report" beats a polished deep-dive.

They also tackle the attribution debate — how-centric vs. who-centric attribution, the mess of overlapping naming schemas (APT10 vs. APT31, the Visma case), and why "trust us, we're Microsoft" isn't tradecraft. Joe explains the thinking behind his Applied Threat Intelligence training and the gap it was built to fill.

The back half turns to AI: where LLMs genuinely help (research, scripting), where they're dangerous (cognitive offloading, model decay, drying up the junior-to-senior pipeline), who's accountable for AI-generated output, and how threat actors are using these tools, from better phishing to voice cloning.

Joe's bottom line for newcomers: critical thinking, communication, and curiosity come before any prompt-engineering skill.

Resources

Joe Slowik's LinkedIn - https://www.linkedin.com/in/joe-slowik/

Joe Slowik's Blog and Courses - https://paralus.co/

Freddy' Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications

Los Alamos National Laboratory - https://www.lanl.gov/

NIST Cyber Threat Intelligence definition - https://csrc.nist.gov/glossary/term/cyber_threat_intelligence

CTI used in books (Google Search) - https://books.google.com

APT 1 Report - https://services.google.com/fh/files/misc/mandiant-apt1-report.pdf

Moonligh Maze on Wikipedia - https://en.wikipedia.org/wiki/Moonlight_Maze

SANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence

ICD 203 - https://www.dni.gov/files/documents/ICD/ICD-203.pdf

MLitt in Terrorism and Political Violence - https://cstpv.wp.st-andrews.ac.uk/masters-in-terrorism-and-political-violence/

Routledge Handbook of Terrorism Research - https://www.routledge.com/The-Routledge-Handbook-of-Terrorism-Research/Schmid/p/book/9780415520997

APT Groups and Operations Rosetta Stone (not mine) - https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/edit?pli=1&gid=1864660085#gid=1864660085

Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications

Tradecraft Primer: SATs - https://www.cia.gov/resources/csi/static/Tradecraft-Primer-apr09.pdf

An Illustrated Book of Bad Arguments - https://bookofbadarguments.com/

Weston's Rulebook for Arguments - https://hackettpublishing.com/philosophy/logic-mathematics/critical-thinking/a-rulebook-for-arguments-group

Joe's Critique of Practical Threat Intelligence - https://pylos.co/2026/05/03/a-brief-critique-of-practical-threat-intelligence/

Cognitive Offloading - https://sistemasi.ftik.unisi.ac.id/index.php/stmsi/article/view/6180

OpenAI Research - https://openai.com/research/index/

Chapters

00:00 Intro and Joe's career path

06:11 The Evolution of Cyber Threat Intelligence and intelligence

15:05 Rigor, reporting, & attribution

29:50 The Relevance of Intelligence in Incident Response and CTI

47:09 Building & measuring a CTI function

01:00:13 Training teams (and why it doesn't stick)

01:07:37 Integrating LLMs in Intelligence Work

01:19:50 Skills for the Future of CTI

In this interview, Jeremy Levin shares his journey into US Army intelligence and subsequent move into private sector intelligence. Jeremy has extensive experience in intelligence analysis, training, and management, emphasizing the importance of adaptable skills, continuous learning, and effective team utilization in the field.

Jeremy Levin accidentally entered military intelligence in the mid-90s by joining the U.S. Army intelligence. He served nearly 30 years in various government intelligence roles and as a contractor. After moving into the private sector he founded Questimation (“Better decisions discovered”) to teach thinking, analytic methods, and explore more objective calibration of qualitative probabilities.

This in-depth interview explores the challenges and opportunities in intelligence analysis, focusing on metrics, training, AI integration, and the mindset needed for future success. Discover how to measure impact, foster analyst development, and adapt to technological advances.

Resources and references mentioned

Questimation - https://www.questimation.com/

Julia Galef - The Scout Mindset - https://www.amazon.com/Scout-Mindset-Perils-Defensive-Thinking/dp/0735217556

IARPA Reason Project for AI in Analysis - https://www.iarpa.gov/research-programs/reason

US Intelligence Standards ICD 203 - https://www.dni.gov/files/documents/ICD/ICD-203.pdf

UK Intelligence Standards - https://www.gov.uk/government/publications/phia-common-analytical-standards/phia-common-analytical-standards

New Zealand Code of Ethics - https://nziip.org.nz/code-of-ethics/

Chapters

00:00 Meet Jeremy Levin

07:52 Contractor Life and 9/11

22:43 Going Independent and forming Questimation

30:30 What Counts as Intelligence

35:22 Analyst Tasks and Management

41:53 Value of Warning and Training

57:51 Metrics Drive Output

01:02:20 Measuring Intelligence Value

01:12:00 Defining Success Metrics

01:22:18 Analytic Standards Matter

01:25:48 AI and Tradecraft Future

01:48:10 Mentors and Closing

This conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview happened on July 2nd, 2025 in London, UK.

#intelligenceagencies #intelligenceanalysis

Summary

Will Woodall shares his 14-year journey through intelligence roles in the UK government and transitioning to private sector intelligence. He explains motivations for leaving government (slow recruitment and limited recognition), contrasts public vs private sector work, and emphasizes core intelligence methodology: the yardstick/estimated probability language, source evaluation and confidence, structured analytical techniques, and clear writing and delivery tailored to customers. In the interview. Will and Freddy debate what distinguishes information from intelligence, how to measure intelligence program value through customer action and feedback, challenges like expert bias and stakeholder alignment, and how AI/LLMs can help with volume and practical tasks but require validation and human questioning. He advises aspiring analysts to pursue analytical subjects, develop domain expertise, and learn core intelligence components.

Resources

Extrac AI - https://www.extrac.ai/index.html

SANS Admiralty Scale blog post 1 - https://www.sans.org/blog/enhance-your-cyber-threat-intelligence-with-the-admiralty-system

SANS Admiralty Scale blog post 2 - https://www.sans.org/blog/admiralty-code-part-2-ticketmaster-data-breach-claims

LinkedIn Post on what makes something intelligence - https://www.linkedin.com/posts/fmurre_in-your-opinion-when-does-something-go-from-activity-7181221399561203712-mV-m

King's College London, the Intelligence Studies Program - https://www.kcl.ac.uk/study/postgraduate-taught/courses/intelligence-and-international-security-ma/teaching

Structured Analytic Techniques (SATs) Training - https://inteltradecraft.com/sat-certifications

Analytic standards ICD203 - https://www.dni.gov/files/documents/ICD/ICD-203.pdf

PHIA UK Analytic Standards - https://www.gov.uk/government/publications/phia-common-analytical-standards/phia-common-analytical-standards

LinkedIn Freddy M - https://www.linkedin.com/in/fmurre/

LLMs getting worse - https://royalsocietypublishing.org/rsos/article/12/4/241776/235656/Generalization-bias-in-large-language-model

Chapters

00:00 Introduction to Intelligence and Personal Journey

07:15 Transitioning from Government to Private Sector

11:53 Understanding Intelligence Methodology and Standards

18:59 Defining Intelligence vs. Information

23:27 The Role of AI in Intelligence

31:02 Training and Methodologies in Intelligence

47:06 Challenges in Implementing Intelligence in the Private Sector

54:16 Measuring Success of Intelligence Programs

58:13 Challenges in Applying Intelligence in Organizations

01:02:06 Advice for Aspiring Intelligence Professionals

01:15:50 Influential People and Career Moments

01:17:28 Closing Remarks and Future Outlook

This conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview happened on July 2nd, 2025 in London, UK.

Summary

In cybersecurity, understanding the intricacies of intelligence tradecraft can make all the difference. In this insightful interview, cybersecurity expert Aaron Roberts shares his journey from military intelligence to founding Perspective Intelligence. He discusses the evolution of cyber threat intelligence, practical training approaches, the impact of AI, and how to build a successful intelligence function.

Aaron’s path into intelligence started with a fascination for intelligence and a local awareness of GCHQ, the UK’s Government Communications Headquarters. He candidly shares, "I always tell people this story and I don't think anyone believes me, but I used to watch a lot of 24." He recalls, "I was always interested in military history and intelligence services, which guided my career path." This foundational knowledge helped him navigate the complexities of cyber intelligence later on.

After working at GCHQ, Aaron faced a significant decision: stay in public service or explore opportunities in the private sector. He explains, "I thought I was always going to be there for life," but personal circumstances and the evolving cybersecurity landscape prompted him to make a change.

Aaron’s experiences provide valuable insights into cyber threat intelligence (CTI). He emphasizes the importance of adapting to new threats and technologies. "Cybersecurity is an ever-changing landscape, and staying ahead requires constant learning and adaptation," he advises.

One key area Aaron focuses on is Open Source Intelligence (OSINT). He finds it fascinating how the internet can be utilized for intelligence investigations. "Using the internet for intelligence work is incredibly powerful," he states. This approach allows organizations to gather insights that are often overlooked in traditional intelligence methodologies.

In 2021, Aaron published his book on cyber threat intelligence, a project that began during the early days of the COVID-19 lockdown. He shares, "I decided to write a book because there wasn’t much available for non-analysts looking to understand threat intelligence better." The process was both challenging and rewarding, providing him with a platform to share his knowledge and experiences.

Resource

Perspective Intelligence - https://perspectiveintelligence.co.uk/

WannaCry - https://en.wikipedia.org/wiki/WannaCry_ransomware_attack

KASE Scenarios OSINT Training Platform - https://kasescenarios.com/

KASE Scenarios PRoject SandShark - https://kasescenarios.com/project-sandshark

Diamond Model - https://www.threatintel.academy/wp-content/uploads/2020/07/diamond_summary.pdf

Intel architecture mindmap - https://github.com/Errum/IntelArchitectureMap

The cyber threat intelligence book - https://www.amazon.com/Cyber-Threat-Intelligence-No-Nonsense-Security/dp/1484272196

TCM Security SOC 101 - https://academy.tcm-sec.com/p/security-operations-soc-101

Michael Koczwara's Hunting Adversary Infrastructure Training Course - https://academy.intel-ops.io/courses/hunting-adversary-infra

Intel471 Cyber underground Handbook - https://www.intel471.com/cyber-underground-handbook

Admiralty Scale blog post - https://www.sans.org/blog/enhance-your-cyber-threat-intelligence-with-the-admiralty-system/

Chapters

00:00 Introduction to Intelligence Careers

04:21 Transitioning from Government to Private Sector

12:23 Becoming a Published Author

20:37 The Importance of Context in Cyber Intelligence

28:08 Challenges in Open Source Intelligence

36:53 Defining Intelligence: What It Is and Isn't

44:47 Critical Thinking in Intelligence Analysis

51:52 Training and Certifications in Intelligence

59:14 Success Criteria for Intelligence Functions

01:05:07 The Future of Cyber Threat Intelligence

01:11:03 The Role of AI in Intelligence

01:18:18 Advice for Aspiring Intelligence Professionals

PS! This conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview happened on July 1st, 2025 in London, UK.

Summary

Listen to Nadia Tuominen's path from crime science student to intelligence analyst in London’s Metropolitan Police, where she learned mostly on the job in a changing organization. She explains how austerity and lack of development pushed her to leave for sports integrity in tennis, then into the financial sector to work on economic crime. A later shift into academia and training lets her “close the circle” by teaching police officers and practitioners, creating qualifications she wishes had existed earlier. Across her journey, she emphasizes intelligence as a reasoning process, the importance of frameworks, elevating analysts from “support staff” to specialists, and helping people think better rather than just learn tools. Nadia emphasizes the need for analysts to be proactive, build relationships, and continuously develop their skills to adapt to the changing landscape of intelligence work.

Key takeaways

• Intelligence is a reasoning process for decision-making, not magic or perfect prediction.
• Definitions of intelligence should fit each organization’s mission and context, rather than chasing one universal formula.
• Frameworks like the UK National Intelligence Model, though imperfect, become clearly valuable once you work in less-structured private-sector environments.
• Analysts should be treated as specialists, not generic “support staff,” to improve respect, pay, and decision quality.
• Training should focus on how analysts think (cognition, self-awareness, bias) as much as on tools and structured techniques.
• Biases are unavoidable and not inherently bad; the aim is to understand and manage them, not pretend they can be removed.
• Many law enforcement analysts lack formal, portable qualifications, so building accessible, practice-based education helps careers and professionalizes the field.

Resources and references mentioned

• NIM https://library.college.police.uk/docs/npia/NIM-Code-of-Practice.pdf
• ICD 203 https://www.dni.gov/files/documents/ICD/ICD-203.pdf
• Intelligence Architecture Mind Map - https://github.com/Errum/IntelArchitectureMap
• Psychology of intelligence Analysis - https://www.cia.gov/resources/csi/static/Pyschology-of-Intelligence-Analysis.pdf
• Analyst & Decision-Maker Conference - https://i2group.com/events/analyst-decision-maker-conference-2026

Chapters

02:59 Journey into Intelligence and Law Enforcement

05:56 Training and Development in Intelligence Analysis

09:12 Transitioning from Law Enforcement to Sports Integrity

12:07 Understanding Intelligence Frameworks

14:51 Exploring Financial Crime and Economic Crime

17:49 The Role of Academia in Intelligence Analysis

20:51 Training and Cognitive Function in Intelligence

23:59 Defining Intelligence: Perspectives and Processes

27:10 The Importance of Forward-Looking Intelligence

29:57 Analysts as Specialists, Not Support Staff

37:13 The Role of Analysts in Decision Making

38:25 Understanding AI and Its Implications

40:30 Critical Thinking in AI Usage

42:35 Explainability and Trust in AI

44:22 Evaluating AI vs Human Intelligence

46:24 The Importance of Input in AI

48:28Training and Experience in Intelligence Analysis

55:33 Measuring the Value of Intelligence

01:01:05 The Dialogue of Intelligence

01:04:17 The Future of AI in Intelligence

01:12:10 Preparing for a Career in Intelligence

Summary

Here, Teresa Walsh, a former NCIS analyst and current Chief Intelligence Officer (CINO), shares how intelligence tradecraft, critical thinking, and stakeholder-focused analysis must underpin cyber threat intelligence in an AI-saturated world, especially in heavily regulated sectors like finance.

She discusses the importance of understanding the audience in intelligence work, the challenges of transitioning from government to private sector, and the evolving role of AI in the field.

Teresa emphasizes the need for critical thinking, continuous training, and the significance of stakeholder engagement in delivering valuable intelligence. The conversation also touches on the future of intelligence, the impact of AI, and the importance of measuring success and value in intelligence work.

Key takeaways

• Intelligence is a profession, not a personality trait
• Raw data is not intelligence
• Audience and purpose drive value
• Private-sector CTI lacks role and training standards
• Finance is mature because it’s regulated, not smarter
• Effective CTI blends technical and strategic skills
• AI and LLMs are tools, not replacements
• Beware “AI solves everything” thinking
• Metrics must go beyond counts
• Curiosity, humility, and feedback fuel growth

Resources and references mentioned

• Structured Analytic Techniques (SAT) book - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X
• Feedly - https://feedly.com/
• IAP Training - https://inteltradecraft.com/sat-certifications
• SANS Talk: The Way to a Stakeholder’s Heart is by Providing Value: Measuring Success of Your CTI Program - https://www.youtube.com/watch?v=5agsRg6-L4o
• Metrics by Gert-Jan - https://github.com/gertjanbruggink/metrics
• Psychology of Intelligence book - https://www.cia.gov/resources/csi/static/Pyschology-of-Intelligence-Analysis.pdf

Summary

In this podcast episode, Elizabeth Dos Santos shares her journey from a 25-year career in the FBI, focusing on intelligence analysis and counter-terrorism, to the private sector, teaching intelligence.

She discusses the challenges she faced, the importance of communication skills, and her transition to the private sector. Elizabeth emphasizes the role of AI in intelligence, the need for critical thinking, and the significance of structured analytic techniques in training.

She also provides valuable advice for aspiring intelligence analysts, highlighting the importance of writing and presentation skills.

Takeaways

• Elizabeth Dos Santos has a rich background in intelligence, having worked for the FBI for nearly 25 years.
• Her journey into intelligence began through a suggestion from her father.
• She emphasizes the importance of communication skills in intelligence analysis.
• Elizabeth shares her transition from government to private sector work and the cultural differences.
• She highlights the importance of structured analytic techniques in training and analysis is emphasized.
• Elizabeth advises aspiring analysts to focus on writing and presentation skills.
• The conversation touches on the need for transparency in AI and the importance of critical thinking.
• AI presents both opportunities and challenges in the field of intelligence.

Resources and references mentioned

• The Psychology of Intelligence Book - https://www.cia.gov/resources/csi/books-monographs/psychology-of-intelligence-analysis-2/
• The Six Thinking Hats Book - https://www.amazon.com/Six-Thinking-Hats-Edward-Bono/dp/0241257530
• Pherson Associates - https://pherson.org/
• ICD 203 - https://www.dni.gov/files/documents/ICD/ICD-203.pdf
• SANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence
• Is all Intelligence Forward Looking blog post - https://inteltradecraft.com/is-all-intelligence-forward-looking
• The Thinking, Fast & Slow Book - https://www.amazon.com/Thinking-Fast-Slow-Daniel-Kahneman/dp/0374275637
• Training with Intelligence Tradecraft - https://inteltradecraft.com/sat-certifications
• IAFIE - https://www.iafie.org/
• The Structured Analytic Techniques (SAT) Book - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X
• The SAT Handbook book - https://www.amazon.com/Handbook-Analytic-Tools-Techniques-5th/dp/0979888093/
• Admiralty Scale SANS Blog - https://www.sans.org/blog/enhance-your-cyber-threat-intelligence-with-the-admiralty-system/
• SANS FOR589 Cybercrime course - https://www.sans.org/cyber-security-courses/cybercrime-intelligence/

Chapters

00:00 Introduction to Elizabeth Dos Santos

01:51 Journey into Intelligence

08:44 Career Development in the FBI

12:40 Challenges and Growth in Intelligence

19:39 Transitioning to the Private Sector

27:52 The Role of AI in Intelligence

53:23 Advice for Aspiring Intelligence Analysts

01:07:29 The Importance of Communication in Intelligence

01:14:19 Structured Analytic Techniques and IAP

01:18:19 Conclusion and Reflections on Intelligence

This conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview happened on May 13th, 2025 in Copenhagen, Denmark.

Summary

In this conversation, Terry shares his journey from government intelligence to the private sector, discussing the evolution of training and methodologies in intelligence analysis. He emphasizes the importance of structured analytical techniques and the challenges faced in adapting these methods in the private sector. The discussion also touches on the impact of geopolitics on cyber threats and the role of AI in intelligence work, highlighting the need for critical thinking and planning in the analysis process. Terry reflects on the differences between open source intelligence and open source information, and the importance of understanding biases in AI tools.

Takeaways

• Terry is a senior director for customer success at Atreides.
• He has a mixed career in both government and private sectors.
• Training in intelligence has evolved significantly over the years.
• Open source intelligence became more prominent after 2008.
• Structured analytical techniques are crucial for effective analysis.
• Planning is essential before diving into information collection.
• The maturity of intelligence practices varies between sectors.
• Geopolitical events significantly influence cyber threats.
• AI tools can assist but come with their own challenges.
• Understanding biases in AI is critical for effective intelligence.

Resources and references mentioned

• SATs training - https://inteltradecraft.com/sat-certifications
• SANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence
• Structured Analytic Techniques (SAT) training - https://inteltradecraft.com/sat-certifications
• Arno exemplifies "spending time to save time" - https://opensourceintelligence.biz/vague-osint-questions/
• ICD 203 - https://www.dni.gov/files/documents/ICD/ICD-203.pdf
• Intelligence agencies are starting to crowdsource information and recruits! For example, the MI6 platform, Silent Courier: https://www.gov.uk/government/news/new-dark-web-portal-launched-to-recruit-spies-to-support-uk-security

Chapters

00:00 Introduction to Terry's Journey

02:54 Training and Development in Intelligence

05:52 Transitioning from Government to Private Sector

08:58 Challenges in Intelligence Analysis

11:50 The Role of Planning in Intelligence Work

14:51 The Maturity of Intelligence in the Private Sector

17:53 The Impact of Geopolitics on Cyber Intelligence

20:56 The Future of AI in Intelligence

23:43 Open Source Intelligence vs. Open Source Information

26:47 Advice and Reflections on Intelligence Work

This conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview happened on May 3rd, 2025 in London, England.

In this conversation, Freddy and Will delve into the world of Cyber Threat Intelligence (CTI) and sharing communities, exploring of Will T, the journey of a cybersecurity professional, the importance of training and community, the challenges faced in threat reporting, and the impact of AI on the field.

They discuss the evolution of CTI, the necessity for critical thinking, and the ethical considerations surrounding the use of AI in intelligence work. The conversation emphasizes the need for collaboration and knowledge sharing within the cybersecurity community to enhance overall effectiveness against cyber threats.

Takeaways

• The importance of foundational knowledge in cybersecurity.
• Real-world experience is crucial for developing analytical skills.
• Training can significantly enhance an analyst's capabilities.
• Community support is vital for sharing knowledge and resources.
• AI can assist in summarizing and analyzing data but has limitations.
• Ethical considerations are paramount when using AI in intelligence.
• Critical thinking is essential in evaluating threat reports.
• Transparency in threat reporting builds trust with stakeholders.
• Continuous learning and adaptation are necessary in cybersecurity.
• Collaboration within the community can lead to better threat mitigation.

Resources & References Mentioned

• Rob M. Lee - https://www.dragos.com/team/robert-m-lee/
• SANS FOR578: https://www.sans.org/cyber-security-courses/cyber-threat-intelligence/
• SANS FOR589: https://www.sans.org/cyber-security-courses/cybercrime-investigations/
• Chainalysis Blockchain Intelligence: https://www.chainalysis.com/blockchain-intelligence/
• SANS blog post on Admiralty Scale https://www.sans.org/blog/enhance-your-cyber-threat-intelligence-with-the-admiralty-system/
• Oracle incident - https://www.csoonline.com/article/3953644/oracle-quietly-admits-data-breach-days-after-lawsuit-accused-it-of-cover-up.html
• Flavio Queiroz's LinkedIn post - https://www.linkedin.com/posts/flavioqueiroz_threathunting-threatdetection-threatanalysis-activity-7310254153732141056-b-Ba/
• Council of Experts: https://blog.bushidotoken.net/2024/04/strengthening-proactive-cti-through.html
• Will's Projects: https://github.com/BushidoUK#-my-projects
• Ransomware Tool Matrix: https://github.com/BushidoUK/Ransomware-Tool-Matrix
• Curated Intelligence: https://www.curatedintel.org/
• MITRE ATT&CK: https://attack.mitre.org/
• Diamond Model of Intrusion Analysis: https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf?adlt=strict
• Mapping TTPs: https://github.com/BushidoUK/MITRE-Mappings
• Curated Intel website - https://www.curatedintel.org/
• Microsoft Security Copilot: https://www.microsoft.com/en-us/security/business/ai-machine-learning/microsoft-security-copilot

Chapters

00:00 Introduction to Cyber Threat Intelligence

02:48 Career Journey in Cybersecurity

06:08 Understanding Cyber Threat Intelligence

09:06 The Role of Training in Cyber Intelligence

11:57 Teaching and Sharing Knowledge in Cybersecurity

15:08 The Importance of Community in Cyber Intelligence

17:54 Challenges in Cyber Threat Reporting

20:56 The Impact of AI on Cyber Threat Intelligence

24:08 Future of AI in Cybersecurity

26:47 Ethics and Challenges of AI in Intelligence

29:57 Conclusion and Final Thoughts

This conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview happened on May 2nd, 2025 in Bournemouth, England.

Step inside the real world of intelligence with Kathy Pherson, a pioneering CIA analyst whose career arc spans from a curious Kansas City upbringing to the highest levels of global intelligence.

In this episode, Kathy reveals how she navigated the challenges of intelligence writing, honed her craft in security and Latin American analysis, and ultimately transformed the field with innovative structured analytic techniques.Kathy has candid reflections on balancing data and practical countermeasures, adapting to the evolving demands of intelligence, and the crucial role of critical thinking in a world increasingly shaped by AI.

Learn how Kathy’s work at the White House, her leadership of Pherson Associates, and her presidency at the International Association for Intelligence Education are shaping future intelligence professionals.

With stories of teamwork, adaptation, and even a personal mission to fight rare diseases, this conversation promises to intrigue, inspire, and challenge your ideas about intelligence analysis, education, and the intersection with advanced technologies.

Takeaways

• Kathy Pherson's journey began with a love for language and led her to a career in intelligence.
• She learned the importance of writing clearly for policymakers. Writing skills are crucial in intelligence analysis, especially for conveying complex information succinctly.
• Understanding the audience and decision-making is key to effective communication in intelligence.
• Kathy emphasizes the need for adaptability in intelligence work because the evolution of intelligence practices requires ongoing learning.

Resources and References Mentioned

• Vassar College - https://www.vassar.edu/
• Critical Thinking book - https://www.amazon.com/Critical-Thinking-Strategic-Intelligence-Katherine/dp/1544374267
• IAP training - https://inteltradecraft.com/sat-certifications
• SANS blog post on sources and admiralty scale - https://www.sans.org/blog/enhance-your-cyber-threat-intelligence-with-the-admiralty-system/
• The Five Habits of the Master Thinker paper - https://digitalcommons.usf.edu/jss/vol6/iss3/5/
• SAT book - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X
• The Art of the Long View book - https://www.amazon.com/Art-Long-View-Planning-Uncertain/dp/0385267320
• Maria Robson Morrow's research - https://www.tandfonline.com/doi/full/10.1080/02684527.2022.2029099
• Gary Klein's book - https://www.amazon.com/Sources-Power-People-Decisions-Press/dp/0262534290
• The Intel Architecture mind map on GitHub - https://github.com/Errum/IntelArchitectureMap
• ICD 203 - https://www.dni.gov/files/documents/ICD/ICD-203.pdf
• IAFIE - https://www.iafie.org/
• IAFIE European Conference - https://iafieeurope.org/events/annual-conference/

Chapters

• 00:00 Kathy's Journey: From Kansas City to CIA
• 03:09 Navigating the Intelligence Landscape
• 05:58 The Art of Writing in Intelligence
• 08:55 Understanding the Decision Maker
• 12:13 The Importance of Communication in Intelligence
• 15:04 Framing and Analyzing Risks
• 17:56 The Evolution of Security Analysis
• 20:57 Lessons Learned from Intelligence Work
• 24:13 The Future of Intelligence and Decision Making
• 34:37 Operationalizing Cyber Intelligence
• 35:52 The Role of AI in Intelligence Analysis
• 37:17 Transitioning from Intelligence to Private Sector
• 40:30 The Evolution of Structured Analytic Techniques
• 44:39 Publishing Intelligence Methodologies
• 46:44 Teaching Critical Thinking in Cyber Intelligence
• 50:51 The Importance of Perspective in Analysis
• 54:56 Defining Success in Intelligence
• 01:00:33 The Balance of Data and Creativity
• 01:09:47 Simple Steps for Intelligence Analysis
• 01:12:28 The Role of AI in Intelligence
• 01:18:39 AI's Impact on Nonprofit Initiatives
• 01:21:10 Challenges of AI in Decision Making
• 01:27:33 The Future of Human Intelligence in an AI World
• 01:33:03 IAFIE: Bridging Academia and Practice

This interview was recorded on May 2nd, 2025 in London, England.

In this conversation, Scott Small, Director of Cyber Threat Intelligence at Tidal Cyber, shares his journey into the field of CTI, discussing his background, current responsibilities, and the importance of curiosity and empathy in intelligence analysis.

He emphasizes the role of AI and open-source intelligence in enhancing threat detection and response, while also addressing the challenges of implementing threat-informed defense strategies. The discussion highlights stakeholder engagement, the value of writing in intelligence, and the need for continuous learning and networking within the cybersecurity community.

Takeaways

• Curiosity is essential for success in intelligence analysis.
• Writing helps clarify thoughts and improve analytical skills.
• AI is transforming the landscape of cybersecurity and threat intelligence.
• Stakeholder engagement is crucial for effective intelligence sharing.
• Open-source intelligence provides valuable insights for threat analysis.
• Empathy allows analysts to understand diverse perspectives in intelligence.
• Structured analytic techniques enhance the quality of intelligence analysis.
• Networking within the cybersecurity community fosters collaboration and learning.
• Trustworthy sources are vital for accurate intelligence gathering.
• Incident-driven intelligence can lead to proactive security measures.

Resources references mentioned

• Tidal Cyber web site - https://www.tidalcyber.com/
• What are TTPs - https://csrc.nist.gov/glossary/term/tactics_techniques_and_procedures
• Cyber Kill Chain - https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
• Unified Kill chain - https://www.unifiedkillchain.com/
• my LinkedIn - https://www.linkedin.com/in/fmurre/
• my GitHub - https://github.com/Errum/IntelArchitectureMap
• Katie Nickels - CTI study plan 1 - https://medium.com/katies-five-cents/a-cyber-threat-intelligence-self-study-plan-part-1-968b5a8daf9a
• Katie Nickels - CTI study plan 2 - https://medium.com/katies-five-cents/a-cyber-threat-intelligence-self-study-plan-part-2-d04b7a529d36
• Curated Intel CTI fundamentals - https://github.com/curated-intel/CTI-fundamentals
• Intelligence Tradecraft Structured Analytic Techniques (SAT) training - https://inteltradecraft.com/sat-certifications
• Workshop I teach at FIRST CTI - https://www.first.org/conference/firstcti25/program#pIntelligence-Collection-Planning-Workshop-How-to-Create-A-Plan-that-Synchronizes-Collection-with-Your-Stakeholders-Needs
• NFCERT CTL - https://communication.nfcert.org/hubfs/CTL_Reports/2025%20TLP_CLEAR%20NFCERT%20Cyber%20Threat%20Landscape%20(CTL)%20Report%20v1.0.pdf

Chapters

00:00 Introduction to Cyber Threat Intelligence

02:47 Scott Small's Background and Career Path

06:10 Understanding Threat Informed Defense

08:59 The Role of TTPs in Cybersecurity

11:51 The Importance of Storytelling in Cyber Intelligence

15:05 Challenges in Implementing Threat Informed Defense

17:52 The Role of AI and Machine Learning in Cyber Intelligence

21:01 Evaluating Open Source Intelligence (OSINT)

23:56 Identifying Trustworthy Sources in Cyber Intelligence

26:59 Lessons Learned from Mistakes in Cyber Intelligence

29:44 Case Study: Analyzing the Akira Ransomware Group

33:10 Future of Cyber Threat Intelligence

38:06 Navigating the Landscape of Cyber Threat Intelligence

43:37 The Path to Becoming a Cyber Intelligence Analyst

46:08 The Importance of Writing in Cyber Intelligence

49:31 Essential Skills for a Successful Analyst

51:14 Structured Analytical Techniques in Cyber Intelligence

54:30 Implementing Intelligence Tradecraft in Organizations

58:02 Proactive vs. Reactive Intelligence

01:01:33 The Role of AI in Cyber Threat Intelligence

01:09:53 The Future of Automated Threats and Defenses

01:15:15 The Value of Networking and Community in Cyber Intelligence

This conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview was recorded in April 23rd, 2025 during the FIRST CTI Conference in Berlin.

In this conversation, Freddy and Gert-Jan delve into the complexities of cybersecurity and cyber threat intelligence (CTI), exploring the importance of decision-making informed by intelligence, the challenges of training and development in the field, and the significance of metrics in demonstrating value.

They discuss the evolving role of AI in cybersecurity, the necessity of critical thinking, and the importance of mentorship and community support for aspiring professionals.

Takeaways

• The journey into cybersecurity often starts with hands-on experience rather than formal education.
• Understanding the implicit decision-making processes in CTI is crucial for effective intelligence work.
• Training and continuous learning are essential in cybersecurity.
• Metrics should focus on impact rather than just activities to demonstrate value to stakeholders.
• AI is transforming the landscape of intelligence, but critical thinking remains vital.
• Source assessment and information evaluation are key components of effective intelligence generation.
• The importance of storytelling in conveying intelligence to different stakeholders cannot be overstated.
• Building a community and supporting others in their journey is a fundamental aspect of professional growth.
• Recognizing influential figures in one's career can provide valuable insights and direction.
• The future of CTI will require adaptability and a focus on explicit decision-making processes.

Resources and references mentioned

• The APT 1 report - https://services.google.com/fh/files/misc/mandiant-apt1-report.pdf
• Venation - https://venation.digital/
• Gert-Jan speaking at the FIRST conference - https://youtu.be/2pSjbSx8J1Q?t=5202
• CTI-CMM web site - https://cti-cmm.org/
• SANS FOR578 - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence
• Intelligence ans Structured Analytic Techniques (SATs) training - https://inteltradecraft.com/sat-certifications
• Arno's LI profile - https://www.linkedin.com/in/reuser/
• Admiralty Scale SANS Blog post - https://www.sans.org/blog/enhance-your-cyber-threat-intelligence-with-the-admiralty-system/
• MISP Admiralty Scale - https://www.misp-project.org/taxonomies.html#_admiralty_scale
• SANS talk on metrics - https://www.youtube.com/watch?v=-d38C3992aQ
• Gert Jan's Metric GitHub - https://github.com/gertjanbruggink/metrics
• My SANS talk on measuring success of CTI programs - https://www.youtube.com/watch?v=5agsRg6-L4o

Chapters

00:00 Introduction to Gert-Jan and the CTI Conference

02:50 Gert-Jan's Journey in Cybersecurity

05:51 The Role of Intelligence in Decision Making

08:50 Training and Development in Cyber Threat Intelligence

12:06 Consultancy and the Importance of Storytelling

14:46 Generating and Consuming Intelligence

17:37 The Distinction Between OSINT and OSINF

20:49 Prioritization and Decision Making in Intelligence

23:54 The Art of Failure and Learning

26:55 Navigating the Intelligence Cycle

29:53 Responding to Incidents and Public Perception

35:38 Critical Thinking in Source Assessment

39:48 Understanding Source Reliability

43:04 The Role of AI in Intelligence

51:31 Metrics and Measuring Impact

01:06:02 Advice for Aspiring CTI Professionals

01:11:49 Reflecting on Influential Figures

This conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview was recorded in April 21st, 2025 during the FIRST CTI Conference in Berlin.