How NOT to be Your Adversary's Best Friend - Doing What Matters...
summary
Argues that tactical “actionable” CTI is a crutch and instead pushes teams to measure business outcomes in dollars, not IOC counts, citing 50–100k IOCs processed and community-driven results that produced 1000x force-multiplying effects during the Emotet takedown. Recommends rapid, sector-wide sharing (Signal/Threema), lowering needless TLP, tracking a new revenue per attack metric, and prioritizing disruptions that force adversaries to retool, cycle infrastructure, or lose customers — practical steps that demonstrably change attacker economics.
AI-written summary · about
chapters (14)
- 0:00Adversary focus problem
- 1:10Action trap in CTI
- 3:20Redefining impact metrics
- 7:35Disrupting adversary economics
- 10:43Over-classification aids adversaries
- 13:34Legal barriers to rapid sharing
- 16:22Fast-sharing communities
- 17:23Killing vanity metrics
- 18:24Outdated industry buzzwords
- 20:11Success by adversary disruption
- 20:55Q&A: Exclusive community groups
- 23:21Q&A: Openness vs operational security
- 24:25Q&A: Cross-sector sharing challenges
- 25:27Closing remarks
related talks
35mThese Aren't the Threats You're Looking For: How Our APT Focus Ruins CTI
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
55mDefender Perspectives: Getting ROI from Cyber Threat Intelligence Vendors
51mNot Go Quietly Adaptive Strategies and Unlikely Teammates
01mQuick Look: These Aren't the Threats You're Looking For: How Our APT Focus Ruins CTI
40mAdversary Simulation: Close the Gaps in Your Security Posture
30mCTI Bake-Off: A Recipe for Measuring, Integrating, and Prioritizing a CTI Program
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful