Why AI Will Not Take Our CTI Analyst Jobs (But We Should Befriend the Machines, Anyway)
summary
Argument: current LLMs help but don’t replace CTI roles because hallucinations and lack of provenance make outputs unreliable for high‑stakes attribution and strategic surprise. Demonstrations show ChatGPT produces coherent, junior‑analyst‑level writeups but misses nuance; a working product (Elemendar’s Breed plus a multigo plugin) extracts IOCs, maps to MITRE ATT&CK and outputs CSVs and node graphs to fuel threat hunting. It speeds processing and lets teams structure unstructured data to move at the speed of the threat, but scaling and integration cost real money.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:46CTI industry and AI tools
- 3:48AI’s rapid encroachment
- 6:12AI hallucinations in CTI
- 8:41AI challenges in intelligence
- 10:25AI limitations and unknowns
- 13:14Evaluating AI CTI reports
- 16:24Race to the bottom in CTI
- 17:25AI in CTI production
- 20:13AI demo and use cases
- 23:43Threat speed with AI
- 25:52Why AI won’t replace analysts
- 27:42Key takeaways
- 29:47Q&A
related talks
33mAI is coming for your job
31mSkynet the CTI Intern: Building Effective Machine Augmented...
59mIt AI n't What You Think!
40mWhat Does an LLM-Powered Threat Intelligence Program Look Like?
32m🧐 A Look at Possibilities of Using AI in #SoftwareTesting
44mAI Foundations: Mitigate Risks and Boost SOC Efficiency
01h 04mWhat are we thinking in the age of AI?
07mAI's impact on programming jobs and developer skills