CTI SIG Blog

The new FIRST CTI SIG white paper defines Cyber Threat Intelligence as a structured process that transforms raw data into decision-supporting intelligence, clarifies CTI disciplines and functional roles, and examines the boundaries between automation and analytical judgment; the paper download link can be found at the bottom of the page.

All too often in 2026, analysts now rely upon tools, technology, and artificial intelligence (AI) to do the “thinking for us” instead of using our brains in the cyber threat intelligence (CTI) lifecycle. Analysts are “drowning in data” with a wealth of emails, tweets, texts, messages, feeds, and other information that all have to be read, processed, normalized, correlated, understood, and potentially weaponized into tools and technology for defensive posture. A reliance upon tools and artificial intelligence (AI) is quickly becoming the new standard, a threat to "human in the loop” and our most important asset, people!

The terms hypothesis and theory are widely recognized, yet their precise meanings are often misunderstood. As a result, they are frequently used interchangeably - most commonly with theory being misapplied in situations where hypothesis would be more accurate.

As a pioneer in the world of Cyber Threat Intelligence (CTI), I see many technologies, tools, and people attempting to perform “threat hunting”, without a proper understanding or guidance in how to do it effectively within the lifecycle of CTI. Today, many rely upon tools and technology for “good enough” intelligence, while others chase Indicators of Compromise (IoCs), thinking that is threat hunting - it is not. Join me on a journey to understanding what threat hunting is and is not, and the types of hunts one performs to actionably move the needle to lower cyber risk.