Disparate Data, Distorted Decisions: Vendor Data Bias in CTI
summary
Empirical comparison of annual IR/TI reports shows structural bias: Unit 42, Mandiant, CrowdStrike and Verizon disagree on top initial access — some list exploitation of edge APIs and software, others list credential abuse or phishing — because pipelines, retainers, insurance panels, NDAs and telemetry shape visibility. Analysis aggregates reports (2023 data shows 1-in-8 incidents labeled “other,” researchers found 23 definitions of “cybercrime”), uses ChatGPT to parse DBIR history and deploys AI honeypots that expose LLM scanners, so the practical fix is triangulate vendors, match vendor profile to your org, and push shared taxonomies.
AI-written summary · about
chapters (10)
- 0:00Vendor data bias in CTI
- 1:05Speaker background
- 2:05Sourcing CTI data
- 4:312024 report disagreements
- 7:42Structural reporting issues
- 14:03Threat intelligence taxonomy
- 17:38Vendor disagreements on vectors
- 20:49Solutions and frameworks
- 22:35Interpreting reports
- 23:38Demanding better standards
related talks
55mDefender Perspectives: Getting ROI from Cyber Threat Intelligence Vendors
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
35mThese Aren't the Threats You're Looking For: How Our APT Focus Ruins CTI
52mData-Driven Cyber Policy: From Dream to Reality
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
32mTen Years of Cyber Threat Intelligence: Retrospectives
37mWhat a Year! - Insights and Forecasts from the 2021 DBIR
55mCyber Security vs. Statistics