CTI Sig Blog

All too often in 2026, analysts now rely upon tools, technology, and artificial intelligence (AI) to do the “thinking for us” instead of using our brains in the cyber threat intelligence (CTI) lifecycle. Analysts are “drowning in data” with a wealth of emails, tweets, texts, messages, feeds, and other information that all have to be read, processed, normalized, correlated, understood, and potentially weaponized into tools and technology for defensive posture. A reliance upon tools and artificial intelligence (AI) is quickly becoming the new standard, a threat to "human in the loop” and our most important asset, people!

The terms hypothesis and theory are widely recognized, yet their precise meanings are often misunderstood. As a result, they are frequently used interchangeably - most commonly with theory being misapplied in situations where hypothesis would be more accurate.

As a pioneer in the world of Cyber Threat Intelligence (CTI), I see many technologies, tools, and people attempting to perform “threat hunting”, without a proper understanding or guidance in how to do it effectively within the lifecycle of CTI. Today, many rely upon tools and technology for “good enough” intelligence, while others chase Indicators of Compromise (IoCs), thinking that is threat hunting - it is not. Join me on a journey to understanding what threat hunting is and is not, and the types of hunts one performs to actionably move the needle to lower cyber risk.