Advertise on podcast: Cyber Threat Intelligence Podcast

A single sentence from the right threat intel analyst can blow up weeks of planning and that’s exactly why we love it. Pedro Kertzman sits down with William Wright, CEO of Closed Door Security, to dig into cyber threat intelligence from the attacker’s end of the table: red teaming, threat-led penetration testing, and the real-world frictions between CTI, SOC teams, and offensive security. We get specific about what “actionable intelligence” actually means when you’re the person who has to run the TTPs. William breaks down how DORA and TIBER-EU style engagements push CTI reports toward clearer structure, and why some deliverables still miss the mark. If a report is just a dump of IOCs, file hashes, or a heat map that paints nearly everything red, it doesn’t guide testing or improve detection and response. The value shows up when intelligence connects threat actor behavior to runnable scenarios and helps defenders tune telemetry and playbooks. The best part: the human layer. We talk about why a short report plus a walkthrough call can beat a “perfect” document, and how those conversations uncover fresh leads, nuance, and the kind of context that never fits on a page. William shares a memorable example from a trading platform where internal CTI advice changed a phishing plan instantly by steering the team toward contractors instead of traders. If you want stronger CTI programs, better red team outcomes, and tighter feedback loops between CTI and security operations, hit subscribe, share this with your team, and leave a review. What’s the most useful thing you’ve ever gotten from threat intelligence? Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

Imposter syndrome shows up in Cyber Threat Intelligence like clockwork, but we do not let it run the room. Cat Self, Senior Director of Adversary Research at Tidal Cyber, joins me to get practical about what actually helps CTI analysts perform: turning open source intelligence and vendor reporting into actionable intelligence your org can use, even if you do not have a massive telemetry stack or a dedicated reverse engineering team. We dig into the real problem with OSINT: noise that looks like signal. When six write-ups trace back to the same original report, repetition can feel like validation, and marketing content can drown out what matters. Cat shares how she filters for credibility by tracking specific authors and expertise areas, building a short list of sources she trusts, and keeping accountability front and center when publishing anything under her name. If you rely on MITRE ATT&CK mappings, threat actor reporting, or rapid intel notes for detection engineering, this part will sharpen your sourcing instincts. We also tackle AI in CTI without the hype. AI can help reduce the haystack, but it is still “rearview” and cannot replace judgment. Cat walks through lessons from building an intelligence pipeline with “vibe coding,” why debugging AI can be chaotic, and how guardrails and human agency keep automation useful instead of risky. Then we shift into analyst mindset: small role-play exercises, making intelligence fun, and creating psychological safety so teams learn faster and burn out less. References: Batman Effect: https://academic.oup.com/chidev/article/88/5/1563/82578 Lego Study: https://cms.learningthroughplay.com/media/wmtlmbe0/learning-through-play_web.pdf Problem solve improvement: https://tu-dresden.de/mn/psychologie/ifap/allgpsy/ressourcen/dateien/lehre/lehreveranstaltungen/bolte_lehre/ala/Isen_1987.pdf?lang=en Subscribe for more cyber threat intelligence conversations, share this with a teammate who lives in OSINT, and leave a review so more analysts can find the show. Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

A lot of cybersecurity advice falls apart the moment the “asset” is a turbine, a boiler, a rail system, or a water plant. We sit down with Andrew Ginter, VP of Industrial Security at Waterfall Security Solutions and author of multiple OT cybersecurity books, to get practical about what actually matters in operational technology security: understanding how attacks work, where they enter, and what they can do in the physical world. We unpack why many OT programs struggle when they inherit IT-first language and assumptions. In critical infrastructure, the priorities are often safety, reliability, and efficiency not just protecting information. Andrew explains the shift from treating information as the asset to treating attack information as the threat, and why mapping “consequence boundaries” and information flows can reveal the most important attack vectors. We also talk about pivoting attacks, residual cyber risk, and how to think like an engineer when the worst credible consequence is simply unacceptable. For CTI teams and security leaders trying to brief executives, we explore a better way to communicate risk than likelihood times impact. High-end adversaries are not random, so Andrew advocates framing board conversations around credibility and reasonableness: what is reasonable to believe about intent, capability, and opportunity, and what defenses are reasonable given legal and business obligations. We close with a hard look at the next step change AI-driven zero-days and why cyber-informed engineering and resilience, including deterministic safeguards, will matter more than ever. Subscribe for more practical CTI and OT security conversations, share this with a teammate who briefs leadership, and leave a review to help others find the show. https://waterfall-security.com/ot-insights-center/ot-cybersecurity-insights-center/engineering-grade-ot-security-a-managers-guide/ Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

Most threat intel programs don’t fail because analysts can’t research. They fail because the intelligence isn’t built for a real audience. We sit down with Marcelle Lee, CEO and founder of Fractal Security Group, to get brutally practical about stakeholder-driven cyber threat intelligence and how to turn priority intelligence requirements (PIRs) into outputs people actually use. We talk through what stakeholder interviews look like in the private sector, why a simple questionnaire beats guessing, and how “they know cyber” still doesn’t mean they understand what CTI can deliver. Marcelle shares how to explain CTI deliverables clearly, how to handle vague requests, and why embedding into team cadence meetings builds trust faster than one-off check-ins. We also dig into MSSP realities: serving many clients, curating emerging threats for broad relevance, and keeping reporting digestible without losing the technical substance that security teams need. We close with how to tailor threat intelligence products for very different audiences, from SOC and detection engineering to executives and boards, where business impact matters more than indicators of compromise. You’ll also hear concrete examples of CTI supporting red team and purple team exercises, security awareness training, risk calculations, PR and marketing monitoring, and phishing-focused guidance for HR and finance. Subscribe, share the episode with a CTI teammate, and leave a review. Then join our LinkedIn group, Cyber Threat Intelligence Podcast, and tell us which stakeholder group you struggle to serve most. Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

Your CTI program can publish reports all day and still fail one basic test: does it change what anyone does next? That question drives our conversation with Liam, a cyber threat intelligence analyst supporting the Government of Alberta and the Cyber Alberta community, where “relevance” is not theoretical, it is local, proximate, and tied to real incidents across the province. We get specific about what it takes to build and mature a public sector cyber threat intelligence function from the early days: governance, executive support, a clear mandate, and intelligence requirements that stop CTI from becoming an overloaded side task. Liam shares the reality of serving both internal stakeholders and a community of more than a thousand organizations, including the hard part: creating two-way collaboration when most threat intelligence distribution methods are naturally one-way. We also dig into the maturity roadmap that makes progress repeatable: start with a strong foundation, earn targeted investment in tooling and training, then automate and improve iteratively. Along the way we talk hackathons as a way to protect deep work, KPIs that actually reflect value, and why “actionability” is the real definition of intelligence. Finally, we hit the OSINT tipping point and why intrusion analysis using your own telemetry often becomes the highest-relevance intelligence you can produce. Subscribe, share the episode with a CTI teammate, and leave a review so more analysts can find the show. Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

CVSS can scream “critical” while the real risk in your environment is quietly sitting somewhere else and threat actors know it. We sit down with Brandon, a former United States Marine Corps intelligence specialist and longtime cyber threat intelligence practitioner, to get brutally practical about what actually drives smart vulnerability prioritization in 2025.  We talk through why vulnerability management is so hard at scale, where EPSS and SSVC help (and where they can mislead), and why the CISA Known Exploited Vulnerabilities (KEV) catalog is a solid baseline but not the standard by itself. Brandon shares the products he screens for because attackers keep coming back to them: Citrix NetScaler, VMware ESXi and vCenter, Veeam Backup and Replication, Fortinet, Ivanti, file transfer tools, RMM software, and high-impact on-prem deployments. The throughline is adversary incentive: if taking out backups or gaining initial access raises the odds of a payout, expect fast “dogpiling” once research and proof of concept exploits hit the public.  Then we pivot into the phishing and social engineering wave: device code phishing kits that steal refresh tokens and access tokens, Microsoft Teams phishing that abuses trust, callback phishing that hides the danger in a phone number, and the growing use of burnable infrastructure like workers.dev and pages.dev. We also dig into the dark web economy behind phishing as a service and why some groups are literally hiring English-speaking social engineers.  Subscribe, share this with a teammate who owns patching or identity, and leave a review so more defenders can find the show. What’s the one vulnerability or phishing tactic you’re most worried about right now? Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

Telegram isn’t just where fraud gets discussed, it’s where entire criminal markets operate in the open. I sit down with Eric Huber, who leads adversary intelligence and disruption work at TD Bank Group, to map how cyber-enabled financial crime really works today: the blend of fraud, payments, cybersecurity, cryptocurrency, and now AI. If you’ve ever wondered why CTI in banking feels different than “classic” threat intel, this conversation makes the overlap tangible and practical. We get into what Eric is seeing in Southeast Asia focused fraud ecosystems, including why the scale on Telegram can be overwhelming and how to find signal without drowning in noise. We talk about the reality of doing OSINT in a regulated financial services environment, where legal, privacy, vendor reviews, and governance controls are not red tape but part of doing investigations safely. Along the way, Eric shares a simple approach that works: start with a few sources, iterate, validate with peers, and keep your assumptions testable. From there, we connect the dots between telecom and banking with SIM swap attacks, insider risk, and why phone number takeover is still a fast path to account takeover and crypto theft. We also explore cryptocurrency fraud and blockchain analysis, including how public ledger data can help you evaluate criminal tooling and payment flows. Finally, we dig into AI in cybersecurity: where it accelerates analysis, where hallucinations can mislead teams, and why human QA and strong data handling matter more than ever. Subscribe, share this with a teammate, and leave a review if it helps. What part of the fraud and cyber threat landscape do you want us to unpack next? Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

The fastest way to fall behind in cybersecurity is to stay reactive while attackers iterate in real time. We sit down with Will Thomas, known across the CTI community as “BushidoToken” to get practical about what actually helps defenders: threat actor profiling that is repeatable, actionable, and built for change. We start with how Will builds community-ready resources like the ransomware tool matrix and his threat actor profiling guide, then zoom into the Conti leaks and what hundreds of thousands of internal ransomware messages can teach us. From “salary day” breakdowns to operator behavior during major incidents, we talk about why these datasets are a gold mine and how to avoid getting lost in the volume. Will shares a concrete workflow for large-scale analysis using JSON exports, regex searches, CyberChef, and Elasticsearch so you can extract IOCs, wallets, infrastructure clues, and the higher-level “so what” that drives detections and threat hunting. From there, we shift into emerging threats and modern intrusion tradecraft: hacktivism that ranges from empty noise to destructive campaigns, EDR bypass techniques like bring-your-own vulnerable drivers and “EDR-on-EDR” tactics, and the steady rise of legitimate tools abused for access. We also dig into identity-led attacks where stolen credentials, social engineering, and SSO platforms like Okta can make endpoint controls less decisive. Finally, we unpack threat intelligence exchange beyond IOC feeds, including why STIX/TAXII still matters, how data quality and freshness drive results, and why a bidirectional TIP and SIEM relationship enables better correlation and “sightings.” Subscribe, share the episode with your team, and leave a review, then tell us: what part of your threat intelligence program needs the biggest upgrade right now? Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

Most organizations say they “do CTI,” but what they really have is a pile of threat feeds, glossy reports, and alerts nobody trusts. We sit down with Joshua Copeland, cybersecurity executive, board advisor, and creator of the Unpopular Opinion series, to get brutally practical about what cyber threat intelligence should be: decision support that changes behavior inside a real security program. We talk through what it looks like to operationalize threat intelligence in security operations and threat hunting, including a trap that catches even mature teams: tuning everything around a baseline that might include attacker behavior. If a threat actor moves low and slow, “normal” network traffic can quietly become the attack. Joshua shares how strong CTI teams use frameworks like MITRE ATT&CK to turn a single piece of intel into targeted hunts, better detections, and smarter prioritization instead of endless IOC matching that breaks the moment infrastructure changes. The conversation also goes upstream into hiring and leadership. We dig into why certifications and degrees can’t substitute for critical thinking, how to interview with open ended scenarios that reveal real judgment, and how state level fusion centers can help public sector teams share actionable guidance. We also unpack why ransomware hits schools and why student data can be the real prize, then shift to the business case: translating CTI into risk reduction, downtime avoidance, insurance impact, and clear ROI. We close with a grounded take on AI in cybersecurity: it can add speed, but only with tight guardrails, source checking, and humans staying accountable. If you found this valuable, subscribe, share the episode with your team, and leave a review so more practitioners can find it. Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

Ever wonder why your TI platform ingests thousands of new indicators a day and still finds almost nothing useful? We dig into the gap between volume and relevance with Sergio Albea of SWITCH, who built a simple, powerful framework to make IOCs matter for real users in real environments. The idea is direct: score every indicator by system, language, location, and sector so your detections match the way attackers actually operate. We walk through practical examples that flip the match rate from near-zero to meaningful hits. A URL mentioning Zurich or SBB scores higher for Swiss campuses. German or French lures outrank Spanish in that context. Mac fleets discount Windows-themed bait. Subject lines about research grants and student loans rise to the top. With that context, Sergio operationalizes Match4 using Azure Logic Apps to run KQL collectors, aggregates indicators in MISP, and pushes high-confidence URLs into Microsoft Defender TI Indicators to stop access at the endpoint—vital for students traveling worldwide. The impact grows as signals are shared. When one university sees a malicious domain, neighbors with similar language and services often see it next, revealing how threat actors campaign by sector. By centralizing across European NRENs, the team builds a living, education-focused threat feed you can’t buy off the shelf. Bonus: the data now surfaces cross-org targeting patterns, extends IOC lifetimes for “golden tickets,” and preserves history for threat hunting long after default telemetry ages out. If you’re tired of bloated, generic feeds and want precise detections that block real attacks, this conversation lays out the roadmap: prioritize relevance, automate collection, enforce at endpoints, and collaborate across your sector. Grab Sergio’s open-source templates on GitHub, start with a few collectors, and score for your environment—education, healthcare, finance, or beyond. Subscribe for more CTI strategies, share this with your team, and leave a review to help others find the show. Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

Attribution is getting weird. The same ransomware ecosystem that used to leave clear fingerprints is now full of affiliate “job hopping,” shared tooling, rapid rebrands, and deep web noise that can trick even experienced cyber threat intelligence teams. Pedro Kurtzman sits down with Katya Kandratovich to map what’s changing and what’s stubbornly staying the same. We talk about why ransomware remains a dominant cyber threat, how law enforcement takedowns disrupt infrastructure without ending the business, and why ransomware-as-a-service programs keep professionalizing. Katya explains how affiliates move between groups for better payouts and support, and why that movement blurs profiling, negotiation patterns, and incident expectations. We also get practical about defense. Katya shares how she treats attribution as a decision-support tool, not a badge you follow blindly, and how to separate credible reporting from rumor when doing deep web monitoring. Then we dig into the intrusion basics that still work at scale: phishing and vishing boosted by AI, stealer logs that include portal context, and zero-days and internet-facing app exposure that won’t go away. We explore “living off the land” tradecraft where attackers abuse legitimate admin and device management tools, plus pressure tactics that target employees directly through calls and emails, sometimes even via personal addresses. Finally, we zoom out to supply chain attacks, MSP risk, third-party integrations, and developer package threats, and we confront a troubling trend: some groups now openly allow healthcare targeting. Subscribe for more cyber threat intelligence conversations, share this with your security team, and leave a review so more defenders can find the show. Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

Think your Mac is the safe corner of the network? Olivia Gallucci joins Pedro Kertzman to dismantle the myth of “secure by default” and show how modern attackers slip past comfort-zone defenses. We dig into the real blind spots on macOS, why unified logging and strict entitlements complicate endpoint visibility, and how Apple’s Endpoint Security API helps—while still leaving gaps clever adversaries can exploit. Olivia walks us through the rise of living-off-the-land tactics on Mac, often called LOLBins, where trusted tools like osascript, curl, launchctl, bash, and dscl become covert malware helpers. Instead of fixating on blocklists, we explore behavior-based detections that catch suspicious parent-child process chains, stealthy downloads, and persistence via launch agents. We also trace the expanding attack surface created by enterprise adoption of Macs among developers, admins, and executives—users with access, keys, and data worth chasing. On the supply chain front, we unpack how developers get targeted through poisoned dependencies and compromised package ecosystems, with examples tied to CocoaPods issues and malicious packages pulling command-and-control frameworks. For end users, trojanized apps, shady installers, and macro-laced documents still work, and notarization alone isn’t a silver bullet. Olivia shares pragmatic safeguards: dependency pinning, signed builds, stricter MDM policies, and layered monitoring that blends Apple-native frameworks with network telemetry. To help users help themselves, she highlights Objective-See’s open source tools that flag camera, microphone, and persistence changes in plain language. If you care about macOS security beyond the brochure, this conversation maps the terrain—what’s visible, what isn’t, and how to build defenses that hold up when trust fails. Subscribe, share with a teammate who uses a Mac at work, and leave a review with the one Mac detection you wish you had today. Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

The moment a “hacktivist” group starts speaking with a state’s voice, the puzzle of attribution changes. We explore how Russian-speaking cybercrime transformed after 2022, why so many crews began to move in sync with national narratives, and what language, targeting, and coordination can reveal about influence without leaning on weak assumptions. Our guest, analyst Anastasia Sentsova, brings deep regional fluency and years of fieldwork to explain how militarization, culture, and policy shape a pipeline that normalizes digital action and pulls volunteers toward more aggressive operations. We walk through the rise of coordinated Telegram ecosystems, including bot-driven “cyber squads” that gamify propaganda with ranks, points, and real-world rewards. That may sound harmless, but it builds habits, grows networks, and legitimizes escalation. From there, it’s a short step to DDoS—and increasingly—intrusions that touch critical infrastructure. We also examine the ransomware world’s political boundaries: no-go lists that evolved from domestic targets to BRICS countries, selective law enforcement pressure following diplomatic milestones, and the unspoken bargain that keeps operators productive so long as they toe the line. Rather than force-fit labels like sponsored or tolerated, we talk about influence as a measurable spectrum. Indicators include state rhetoric in native-language posts, synchronized activity with kinetic events, target selection aligned with policy goals, and public signaling when named individuals “celebrate” sanctions without consequence. For practitioners, we offer concrete ways to avoid Western bias, validate translations, and build multi-source cases with explicit confidence levels. And we look ahead: the proxy model travels, youth pipelines deepen skills, and hybrid operations blur the boundary between hacktivists and APTs. If this kind of clear-eyed CTI resonates, follow the show, share it with your team, and leave a review so others can find it. Join our LinkedIn group, Cyber Threat Intelligence Podcast, to keep the conversation going and tell us what signals you’re tracking next. Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

🎙 Season 2 Starts March 3rd Season 1 was about building foundations. Season 2 is about raising the bar. We’re diving deeper into the Cyber, Threats, and Intelligence, with practitioners who live it every day. FULL Video: https://youtu.be/oa2t9GQl6EU 📅 Premiere: March 3rd 🔔 Subscribe now so you don’t miss it. The threat landscape evolves. So should we. Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

Want fewer fire drills and smarter security moves? This season finale brings together the strongest lessons from our guests on how cyber threat intelligence turns uncertainty into clarity—and clarity into action. We share what actually works when the data is partial, the stakes are high, and leadership wants proof that CTI moves the needle on risk and cost. We start with the core: prioritization under uncertainty. You’ll hear how teams use intelligence to decide what to patch first, where controls matter most, and how to focus limited resources without missing the threats that can take a business offline or put customer data at risk. We dig into the language of value—money saved, revenue protected, efficiency gained—and why BLUF, clear implications, and stakeholder interviews beat jargon every time. If you’ve wrestled with KPIs, KRIs, or ROI, we unpack practical metrics that reflect real outcomes, not vanity numbers. From there, we look ahead. Forecasting adversary capabilities, mapping susceptibility, and choosing proactive mitigations can shift a security program from reactive to resilient. You’ll get candid perspectives on building CTI the right way—starting tactically and growing into operational and strategic impact, or choosing a build-vs-buy path aligned to budget and goals. We also talk careers and team shape: why diverse backgrounds thrive in CTI, how small teams can deliver outsized results, and the discipline of deciding what you will not do so you can excel at what matters. If you want CTI to influence decisions at every level—SOC, IR, red and purple teams, and the board—this wrap-up offers the playbook: stakeholder-first communication, focused scope, useful metrics, and a relentless push toward proactive defense. Follow, share, and leave a review to help more practitioners find these insights—and tell us: what CTI metric best proves your impact? Send us Fan Mail Support the show Thanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!