Threat Intelligence 2022 Actionable?

Peter Partyka opens with a short history of threat intelligence, contrasting the feeds of about 2012, built mostly on IP addresses, domains and YARA rules, with what vendors offer now. He introduces a risk equation and a simplified intelligence cycle, then sets up a fictional 200-person company that issues credit cards and later adds SIM cards to its business.

The middle of the session is an audience exercise. Slides show different kinds of intelligence, and the room decides whether each one would be useful to that company. Simple indicators such as a YARA rule or a single IP address can go straight into security devices, but they gain value only when they carry context. Other items, including breach-derived card data, underground chatter about SIM swapping, a finished report on trending vulnerabilities, and lists of commonly used passwords, are not machine-consumable. They still drive decisions for fraud, identity and vulnerability teams.

The closing argument is that usefulness depends on who receives the information and whether they can act on it, not on the data type alone. Partyka argues that raw data becomes intelligence only after collection, processing and analysis, and that the category of intelligence itself needs rethinking for the digital world. He ends by encouraging organizations to share indicators with peers, since shared intelligence is one of the most effective defenses available.