CTI Is Dead, Long Live CTI!

The talk starts from a debate over whether cyber threat intelligence still has a place alongside incident response teams. The speaker, a senior threat analyst at a Swiss managed security provider, frames the purpose of intelligence as preparing for attacks that have not yet happened. Incident response teams see successful intrusions and high-severity alerts first hand, which makes their findings valuable to intelligence work, while intelligence teams need actionable findings shared quickly.

The middle of the talk uses firefighting as an analogy. Responders move through a fast cycle of assessing the situation, containing damage and regaining control of the network, and they are most focused and least responsive during that sprint. The speaker maps the work of an intelligence team against this rhythm, describing it as steadier and broader, covering threat landscape tracking and sector trends. Useful windows for contribution appear at the start of a case, during hunting and scoping, and in the case summary afterwards. Suggested contributions include concise written landscape notes early on, indicators or detection ideas during the hunt, and a second opinion once responders have time to reflect.

The closing section covers points of friction. Analysts make errors that responders cannot afford under pressure, and repeated requests for customer approvals add load. Open communication channels, succinct written input tailored to the case, and discussing hypotheses once pressure drops are offered as practical approaches. The speaker concludes that intelligence teams add lasting value to incident response teams when they pay attention to pacing and context.