Most orgs don’t have an intelligence shortage—they have a translation problem. This panel focuses on the operating model behind threat-informed defense: defining intelligence requirements, choosing the right frameworks (e.g., adversary TTPs, kill chain thinking, MITRE ATT&CK mapping), and producing outputs different stakeholders can actually use. Panelists will share how to move beyond “IOC dumps” to insights that influence priorities, budgets, and control design—without turning the intel team into a reporting factory.

Most threat intel leaders eventually face the same question in a budget meeting: what did Cyber Threat Intelligence do for us this year? Answering with feed volumes and report counts is likely to leave your stakeholders wondering what the value of CTI is. This session demonstrates a repeatable AI workflow that measures the impact of CTI by quantifying the risks it reduces.  

Starting from an open source threat report surfaced in Feedly, we run an AI workflow built on the OWASP Risk Rating Methodology to score the threat, translate that score into an estimated loss exposure range, and generate specific mitigation recommendations. Once those recommendations are acted on, we re-score to produce a projected residual risk, creating a before and after picture of the value of actioned intelligence, paired with impact-focused metrics.  You will leave with the complete prompt and skill, free to use, plus step-by-step instructions to run this against a threat relevant to your organization today.

Intelligence becomes valuable when it changes defensive behavior: new detections, smarter hunts, faster triage, and better readiness for the adversaries most likely to target you. This panel shows how to operationalize intel into security operations—turning adversary behaviors into detection logic, producing hunt hypotheses, designing purple-team exercises, and validating coverage gaps. Panelists will discuss practical workflows, how to avoid “IOC whack-a-mole,” and how to keep intel-driven security improvements continuous.

AI can accelerate collection, clustering, summarization, and correlation—but it can also amplify errors, overconfident attribution, and misinformation at scale. This panel explores how analysts can use AI responsibly: automating triage, extracting entities and relationships, mapping to TTPs, and generating tailored outputs for different audiences—while maintaining analytic rigor. Panelists will cover validation techniques, sourcing discipline, handling deception, and building human-in-the-loop workflows so AI strengthens intel instead of weakening trust.