Cyber threat intelligence's real value comes from informal networks: a direct message from someone you trust, not from tools or platforms. A just-in-time warning through a personal connection often stops attacks, yet security teams rarely credit this when building their programs.
But my hypothesis going in was that while this quote unquote networking, CTI networking phrase was extremely valuable, it was underrepresented, underacknowledged in the space. So people put a lot of emphasis on what tools you have and, you know, potentially what you've implemented, what your program looks like. A lot of the value that was driven was somebody who's giving you a just-in-time warning because you met them at an event or you connected with them through an ISAC, a sharing group, being able to get you ahead of a threat or just in time for a threat. but that was never really attributed to. So I went in and I said, as I'm observing this field as a little bit of an outsider, how much of this is taking place in these one-to-one DMs or in these trust groups? Let's demystify that for everyone else who says they're interested in CTI, trying to build up a CTI program. Maybe they're a security manager who doesn't really understand or acknowledge that at all, to have awareness that this is happening and it can be a leverage strength and skill versus a liability.
