Intel is a Fallacy But I May Be Biased

Andy Piazza, head of threat intelligence at IBM X-Force, argues that intelligence in the infosec industry is often misused. He starts with the word "targeted." Much of the activity organizations see is opportunistic, such as broad phishing or internet-wide scanning for a known vulnerability. Derivative reports and rolled-up actor profiles can turn that activity into apparent targeting of specific sectors. He points to a government ransomware advisory that makes targeting claims without showing the evidence behind them.

The second theme is capabilities. Playbooks built from past campaigns can make teams believe they have full coverage, even though attackers change tools and techniques. He warns that analysts sometimes chase the techniques listed in a report instead of the evidence in front of them. He recommends structured analytic techniques such as key assumptions checks, which means regularly asking what you know, why you know it, and whether it still holds during an investigation. He also suggests reading original reports rather than summaries.

In the question period, he tells consumers to push internal intel teams and vendors for better output. He says intel should serve the security operations center more than executives. He also argues that threat hunting is largely reactive, and that true hunting searches your own data rather than outside sources. The takeaway is to show your work, keep facts, gaps and opinions separate, and treat intelligence as an input to an investigation rather than a substitute for it.