Evaluating Threat Intelligence Through Velocity
summary
Claim: cyber threat intelligence is decision support and its operational value collapses if it arrives too late, so measure CTI by delivery velocity. Argues an unavoidable tradeoff between rapid, terse indicators and slow, deep analysis, showing SOC/IR timelines run in hours or minutes not days. Proposes either dual-track CTI (fast tactical vs slow strategic) or pipeline upgrades using AI-assisted enrichment (e.g., Gemini/LLMs) to add context quickly while keeping humans in the loop. CTI as decision support
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:49Cyber threat intelligence purpose
- 5:00Tactical vs strategic CTI
- 6:50CTI speed vs quality
- 10:22Measuring CTI by speed
- 13:13CTI velocity use cases
- 18:06Adversary vs defender timelines
- 18:48Speed vs accuracy in CTI
- 21:15Rapid vs detailed CTI tracks
- 22:17AI in CTI acceleration
- 24:05Future of AI-assisted CTI
- 25:09Closing
related talks
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
32mTen Years of Cyber Threat Intelligence: Retrospectives
55mDefender Perspectives: Getting ROI from Cyber Threat Intelligence Vendors
01mQuick Look: These Aren't the Threats You're Looking For: How Our APT Focus Ruins CTI
51mUsing Critical Threat Intelligence Strategically
28mCyber Threat Intelligence Analysts and You
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
21mAdvanced Cyber Threat Intelligence Chapter - How to Read the Mind of your Attackers