Hazard Analysis of Military AI Systems Using STPA-Sec: A Systems-Theoretic Approach to Secure and Assured Autonomy

The talk examines why cyber threat intelligence often fails to help defenders, drawing on several years of indicator data from commercial providers, government and consortium sources, and open-source publishers. The speaker describes how many commercial producers are closed to outside customers, how feed volume and indicator counts grew between 2023 and 2025, and how little overlap exists between providers. Overlap is typically in the low single digits, and for newly emerging threats it can be far lower.

The middle section covers ambiguity and timing. Roughly one in six cases showed conflicting context about the same threat, and providers tend to focus on different parts of the attack lifecycle, so a single source can leave gaps. Analysis of vulnerabilities published in 2023 and 2024 found that many indicators were already in circulation before public disclosure, with attacker infrastructure appearing to shift in the days just before and after it. Case studies on a ransomware-as-a-service family and several infostealers showed how quickly coverage built up after publication.

The closing argument is that discarding older indicators without context can open blind spots, and that defenders should evaluate coverage across sources rather than relying on one or two feeds. The speaker put the odds of threat intelligence stopping a given attack at around five percent, and answered audience questions on predictive signals such as scanning activity seen ahead of disclosure.