Unspoken Security Ep 49: The Future of Cyber Threat Intelligence

Step 1 is buy-in. I've been in places, luckily my whole career, honestly, where there's always been an acknowledgement of what threat intelligence can do, whether that's just purely on the security side, that's a starting point, but even from the business side of getting support in that realm, even if you're reporting to your CIO or whatever your organization has it, getting that buy-in is the most important thing you can do, and it is very difficult. Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I've spent, geez, I don't know, 19 years in the intelligence community, mostly at NSA. Where since then been a private sector now, but I've been building and maturing intelligence programs for about 10 years out here. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! And I continue to be deeply committed to servant leadership. This podcast brings all these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. This is not your typical polished podcast. My dogs make occasional appearances, People argue, debate, we even swear here. And that's all okay. At least I certainly swear. I want you to think of this podcast as a conversation you'd overhear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. Now today, I'm really excited because I'm joined by Charlotte Gynie, a cyber threat expert who has made career stops at State Street Bank, Federal Reserve Bank of San Francisco, and Splunk before taking on her current role as Cyber Threat Intelligence Manager for Toyota Financial Services. Where she's responsible for ensuring intelligence-driven security across the enterprise. Now, all that being said, I want to be clear and state that nothing Charlotte says today should be considered representative of the views or practices of any past, current, or future employers. Her words and opinions today are 100% her own. Charlotte, by the way, is also a graduate of Brandeis University, where she majored in International Global Studies while minoring in both East Asian Studies and Business. Anybody wondering about Brandeis, couple famous graduates: Jeffrey Lurie, he owns the Philadelphia Eagles, if you're an Eagles fan. If you're not, good for you. And Mitch Albom, who's an author of Tuesdays at Moo with Maury and The Five People You Meet in Heaven. I used to work for Detroit Free Press, I believe. Really cool guy. A great university, very interesting people. Nobody better than Charlotte. Charlotte, anything you wanna add to that bio before we jump into the conversation?

That was pretty great. Summed it up.

I try to be prepared if I can. It makes things a little bit quicker and easier for everybody. So listen, it's good cuz it means we can jump right into the conversation. I really wanna get to talk about CTI. Cyber threat intelligence, where it's been, where it's going, your path and your journey and what you're working on. CTI has really been growing. It's a growing part of the security organizations for, I think in the private sector now, I'd say for, I don't know, at least 10 years. That's about how long I've been out here and I've seen it grow quite a bit. But with that in mind, how do you see the industry and how do you see the maturity of the industry today?

It'll be interesting because for most of my career, and I'm back at it, I've worked in the financial sector and I got to see a more immature threat intelligence program. I've seen a very mature threat intelligence program, but I've also dabbled in the tech industry, and I'm glad I did because there are very different needs for both types of organizations. Each sector, each individual business has very different needs, and that equates to different maturities. I don't think that each organization is going to— there's not gonna be a single maturity that's gonna fit every organization. And I think that's something that you really only experience if you can go to different sectors. Being back in the financial industry, it has been great. I know that there is a lot of threat intelligence work that's being done, really great work. And a lot of the firms have very mature intelligence organizations. So to be able to be maturing an internal group is quite a privilege, I find, especially nowadays. As you said, been growing for the last 10 years, so. A lot of places have had 10 years to really mature their intelligence capabilities. I think that we're starting to see threat intelligence being used more for business needs, not just threat detect— excuse me, threat detection. So I think, yeah, I think there's a lot of room to grow, especially with new technologies and capabilities coming out. But it's an interesting question because it truly depends on the organization. I feel like that's the go-to threat intelligence answer. It depends.

It depends has always been a good answer in all of intelligence. That's right. Lots of caveats. But you make some interesting points we can dig in on. The fact that maturity is different across different enterprises, different industries. I think, I won't speak for you, but I'm sure you'll nod along on this one. I'm going to guess at least that most would say the financial sector is the most mature, right? They've been the most ahead pretty much from the very beginning. And I think that's because it is a cultural fit. As long as there have been banks, there have been people robbing banks. So there's always been somebody who's understood the threat. And that's how the financial system is built. Whereas in contrast, healthcare seems to have always had a harder time catching up because it's a different culture. People didn't used to to go into hospitals and steal patients. That's not a very common occurrence. I guess it happens occasionally, but not nearly as common as somebody coming into a bank with a gun and trying to rob them. So there's a cultural difference there, but I think it's an interesting point. You talk about different maturities and also does everybody need to have the same level of maturity? Does a mom-and-pop shoe store in Topeka, Kansas need to be as really up to date on all the best security practices as Citibank? I think the answer is probably no. But across industries, what do you think about what a baseline maturity might look like? I worry that there are industries that just completely underestimate these things or they're making business decisions. And that was the other piece you talked about was tying this back to business. This is not about just, hey, we need to stop things. There, there has to be a business justification to it. It seems how much money are we gonna spend and what's it gonna save us? If our threats are very low and limited and they won't cause a lot of harm when they happen, are we really gonna spend hundreds of thousands or millions of dollars on security and intelligence practices? I'd love to dig a little more into where you think that fits and if there's a discussion about maturity at different levels and how an organization should dig into what's our real risk and what should our maturity look like.

100%. And I feel like especially bringing up mom-and-pop types of businesses, they're not, I mean, they may, but most likely they won't have the funds to, for a mature intelligence organization. That does require tools, that requires expertise, and that is very expensive. So I would never expect or even think maybe even a business decision to invest in that for a small organization. But I think at the very base of it, at the littlest first step, is to be reactive. And that is either hiring externally a service that monitors for mention of your brand and being able to respond to that. That's just that step one. Make sure that even if you're boutique in a small town and your clientele is maybe 50 customers who work there, those people, their information, their credit cards are safe. And you can guarantee that through that service. And I think we're seeing a lot of that with COVID I hate bringing up COVID. All the online shopping, all of the online services and everything that happened now, that's almost expected, I feel, at least when I talk with my peers. But then as organizations grow and you're dealing with more types of data and just more data in general. You're able to provide more services because you're bringing in more money. Then you can go a little bit deeper into the reaction. And that, for me, is a full step 1 in a large enterprise threat intelligence maturity model is reactive. But in order to do that, you need to understand the business because you can't react to everything. That's not realistic. That's not good use of money. So you really need to understand what your business prioritizes and be able to react, whether it's create detections, or eventually get into like purple teaming or some proactive work, it all starts with understanding those priorities. So I, at the basis of all fair intelligence for me are those priority intelligence requirements, PIRs, and you gotta live and breathe them.

Yeah, that's an excellent point, right? I, as I mentioned, I've been in the private sector now, I don't know, somewhere around 10 years and I've built programs or help people build programs. And I find sometimes I feel like I'm boring people, at least those who know me, because I'll say a lot of the same things I said 10 years ago. The intelligence cycle starts with planning and direction. Know your stakeholders, build your intelligence requirements. Requirements. Now, people who know me are like, yeah, I've been hearing that for 10 years, man. Do you have a new story? And I'm like, no, I don't have a new story because it's still the truth. And 80% of the world doesn't seem to know this yet. I also still talk about 2FA and MFA because people keep using terrible passwords with no two-factor authentication. Creativity isn't necessarily the most valuable thing out there. Sometimes it's just continuity and trying to do things the right way. It's good that you mentioned intel requirements. Even if you're a small organization, maybe it's just to determine what you don't need to worry about, right? Again, the mom-and-pop store probably doesn't have major concerns, but they still have a point of sale. And as you pointed out, everything's online, everything's connected at some point now, it appears. And if that's the case, is if you connect to anything online, then you, there's threat, right? There's a risk. There's somebody interested in something you have, even if you don't think it's anything. I sell shoes or coffee in, in, in this tiny little town. Yeah, but you got a point of sale, right? So there's credit card information coming in. There's tens or hundreds or thousands of credit cards coming through there. That's interesting to somebody. That's something that could be useful to them. So there's still some requirement to do some protection, even if it's minimal. So I think that's interesting. Now I want to shift to what you're— I don't want to say what you're currently working on, because again, you're not speaking, you're not speaking for Toyota, and I'm not looking to get any inside information, but in your experience, whether now or elsewhere, let's talk about some of the biggest challenges when you're trying to build a new intelligence program from the ground up. You come in, you're brought in, the organization has no intel. They say, okay, we need an intel team. We need an intel. Function tied to everything we're going to do, business risk, et cetera. What do you see as some of the big challenges and how to get this going?

Step one is buy-in. I've been in places, luckily my whole career, honestly, where there's always been an acknowledgement of what threat intelligence can do, whether that's just purely on the security side, that's a starting point, but even from the business side of getting support in that realm, even if you're reporting to your CIO or whatever your organization has it, getting that buy-in is the most important thing you can do, and it is very difficult. I think the first step in doing that is understanding your security needs. So in threat intelligence, everyone internally, you're an internal team, but everyone is your customer. So the security operations center, the incident response analysts, the vulnerability analysts, they are all customers of threat intelligence. So you need to first understand what they care about. So even before you consider the business, you're gonna have some idea, right? And they will have some ideas, but they'll each have a little bit of a difference in what they care about. And that's that, that first point where you need to start there, because if you're not able to produce results within fairly quickly timeframe, even just for the security organization, you're not gonna get more funding. And that's the sad reality. But from there, you can start working more towards, okay, what does the business care about? Where these actually are crown jewels. How do we prioritize even more? How do we create more products for our customers? How can we make all of their lives better? How can we expand to risk or business teams? But that first step beyond just that reaction is understanding the priorities of your security organization and being a security team member first. I think that, in my experience, is the best way to start building a program because you're able to say, hey, okay, I did this. I came in, there was nothing, and within 3 months, we're able to create security detections. That's huge.

Yeah, I think you make an excellent point, and one that I'll be transparent in saying I learned the hard way. If you— a lot of people, I'll use myself, you come in and you've got experience in intelligence, you've been doing it a long time, and you come in and there's this ingrained belief everybody understands intelligence, everybody understands the importance of it, right? I came out of the intelligence community. You get a couple decades there, You get used to the idea that everybody understands a whole bunch of things, and then you realize everybody doesn't, just everybody you've always been around does. And you get in the private sector and nobody understands most of it. And so I learned, as I said, the hard way. You come in, I came in, and it's like, all right, we're going to do these things and we're going to do all that. And you start really moving a lot of blocks around and you have ideas and great ideas, but you haven't really sold it to anybody yet necessarily. Just because they said, hey, we're going to build an intel team, or just because they hired you, doesn't mean they believe in it. That doesn't mean they, they understand what they've said they're gonna do. Maybe they were told they had to do it. Maybe it's a check the box. Maybe it's something coming from leadership, whatever. And as you pointed out astutely, you don't have a lot of time to win over some people, right? You're not gonna win everybody over, but it's really important to get some early wins on the board. So people go, oh, hey, there's value in this. And build some, some advocates, right? Maybe it's just one team or one organization or whatever, but find some advocates to say, no, no, there's value in this and we can use more of this thing. Whether it's to get more budget or just get more time to build your maturity, et cetera. I think that's a really good point. And I found you have to be a bit of a politician almost, especially in a big enterprise. And also I'm curious, this may seem out of the blue, but so going back to your background, so you graduated from Brandeis. You, I know part of that time you studied overseas, right? You've got Asian studies. I know you studied overseas. And, and the reason I bring that up is because I feel like a lot of times when you're trying to build these relationships, these enterprises, it's almost cross-cultural, right? It's— people speak different languages, right? The tech language isn't the same as the business language or the risk language or the legal office or executives. And the cultures can be very different. And I'm wondering if there's some advantage to having done cross-cultural studies in school and learned how to talk to a whole bunch of different people who think differently and whose backgrounds are differently— are different from one another. You know, does that help at all? Have you made that connection before? Is it something that's valuable? And do you see the same challenges? When you are trying to connect across all these different enterprise organizations that think differently and speak differently?

To a certain degree, I would say yes. It depends on the size of the organization you're dealing with and if you even have an international footprint. But going deeper than that, and I think maybe it was a skill that takes practice and being in physically in the other countries forces you to practice those cross-cultural communication skills. I actually, before I even got into cyber, was a business analyst for agile software. Granted, I participated, that's how I was introduced to security, was I was a business analyst for the deployment of a security tool. So, I was like, oh, okay, this is cybersecurity. But I got into that business analysis, I think, because, being that I had a business minor, I had that ability to translate technical ideas and terms for the business and vice versa. And I think that's something that carries a lot of weight in threat intelligence. And so, I can see, okay, yeah, culturally, just having that experience of having to think of how people think of things differently and bridge that gap, I think is a very valuable skill. I don't necessarily think it has to be against cross-cultural. Again, just tech to business terms.

Yeah, yeah. And that's what I meant too. I wasn't necessarily thinking cross-cultural and in the traditional terms we talk about as different continents or nations or anything like that, but the culture within the subcultures within the enterprise itself. The tech has this different culture from legal, which might have a different culture from sales or business or some of those. And you mentioned your business background. I think it's very interesting. And you've talked about tying things to business. And that's, I think, another area that, again, I learned this one the hard way. I think people coming out of the intelligence community, people with traditional intelligence backgrounds, I'm a big advocate for those people running intel programs in the private sector. But at the same time, there are things to learn that you might not realize. And that business risk is a big piece, I think, that I learned the hard way. In the government space, when you're doing intel, we don't have a lot of time spent wasted on debating, is this valuable necessarily? There's some, but nobody's doing it in a business risk sense. A lot of the intel is about bombs on targets or keeping people safe or alive or counterterrorism, things like that. There aren't a lot of people who sit down and go, counterterrorism, what's the business risk? How much is it going to cost us if we don't research this terrorist group and try to prevent bad things from happening? That doesn't really come up in a conversation. The government just prints the money and you go do the things because you want to protect people's lives and There's probably some business aspect to it, but it doesn't really come up much. And in the private sector, that was a challenge for me at least coming over because some things I was just like, of course we have to do this. This is a requirement. This is a risk. And then you get, give me a business justification. I remember rolling my eyes going, are you fucking kidding me? I don't have time for this. I need to get this work done. We're going to get hacked. We're going to get compromised. There's bad things happening. I've just done and become an economist and I didn't have the business background in college necessarily. I had some business experience, but not the education to go with it that I probably could have used. I wonder how often that comes into play for you, how often you've been in positions where you've been able to go, all right, I get it. I get what they're trying to accomplish. And thank goodness I have some business background in college and I can make an astute justification rapidly because I realize why they need this, right? Everything costs money and it's all about how do we make this either lower our risk or improve our bottom line or whatever it is. How often do you find yourself tapping back into that knowledge, that education, and saying, man, I'm really glad I learned this?

Quite a lot, actually. We talked about priority intelligence requirements. Those are just, business needs. That's the business. You have to fully understand the business in order to protect what's most important to the business. How can you protect something you don't know anything about? So at the core of it, and going back to that business analysis training that I had on the job, I approach the business again as customers. I approach them as a business analyst would approach a business customer or people working on the technical side, a developer. And I say, this is what I think you need to care about. And then I'm able to have that conversation because I have that business acumen. I'm able to have that conversation in their language.

Mm-hmm.

And I don't say like their language, obviously we're all speaking the same language. I'm able to get those technical terms across and translate back and forth, including those business risks, because at the end of the day, money speaks. And that's what the business is gonna care about.

Absolutely. And it definitely is a different language. So, it makes me wonder, as you're looking at building out an intel team or building, building intel teams in the past, you have good intel teams. What are the kind of skills that go along? I think people quickly jump into, hey, I want people who have intel backgrounds. Again, that's my bias, right? Or I want people with research backgrounds. Oh, hi. Who's joined us? Who's joined us?

This is Elle. Oh, no, she did not like seeing herself on camera.

She said, I don't want to be on camera today. Listen, she hasn't signed the waiver either, so I can't have her on because I don't have permission to have her. So Elle, you won't be on, but thanks for joining. She can come back anytime. So as I was saying though, we talk about building out the team, right? It's easy to bias, as I've done, to, okay, I want people with intel background, I want people with those skills. Or I've heard people talk about, I want professional researchers, or I want people who've got academic background, I want people with journalist backgrounds. But there's a lot more needed, it would appear, to this. So when you talk about building on a team, what kind of skills are you looking for? Business, communication, obviously research, some of these things. And I'm sure you're not looking for a homogenous team where you're just going to build the same person over and over again. As you envision building a team, and I realize size can be different depending on the size of the enterprise and all that, but What kind of skills do you look for that you think would be valuable in, in, in these early stages, especially this building buy-in and business risk that people might not be thinking about if they're looking to add somebody to their team or they're looking for, looking through resumes?

Yeah, I think especially in the early stages, or if you're an organization that, you know, doesn't have a need for a mature intelligence capability, having that more business knowledge side, having the ability to communicate Being comfortable writing reports for executives. Those are types of skills that I am looking for because that's what you're going to need right away to show value.

Yeah, that's a good point. Intelligence is, I tell people often, intelligence isn't a product, it's a service, right? It's, this is a people business and it's a lot about communication, whether you're written communication, whether it's interpersonal skills, be able to meet up with people and listen and be able to translate. I think translation comes up a lot. They translate their technical jargon into intelligence needs, translate their frustrations into results, things like that. So I think there's a lot more interpersonal skills than people realize. Now, that being said, I know some great introverts in this field. So when I say interpersonal skills, people go, oh, he's just going extrovert. I know some great introverts in this field, but I've always felt, and I want your opinion on this, that it's good to have a mix. I know some people who, who are very extroverted and I know some people who are very introverted. And I always felt you need a team that does a little bit of both. You can't have all extroverts because they'll never get anything done. Frankly, they'll just sit and chatter all day long and have all sorts of ideas and nothing will end up on paper. And if you have all sorts of introverts, then nobody ever communicates with your stakeholders and you're not, you're not able to make these compelling arguments. What are your thoughts on building that mix of those kinds of personality traits?

That is something that I do actually look for. I like to consider myself now an extroverted introvert. I guess like an omnivert or something.

Be creative with new words. Yeah.

Yeah. And that was developed through my career in practice and going abroad, but at the end of the day, I'm fully an introvert and I recognize the need to have someone who is inherently an extrovert cuz they're gonna go out and fight a battle you didn't even know needed to be fought because they're out talking to different people.

Mm-hmm. Yeah, very true. People mistakenly think that I'm this massive extrovert. I also would consider myself probably an extroverted introvert. It also changes as you get older, by the way, or as time goes by. For those who don't know, I was once a massive extrovert, but now I'm more than happy to spend time by myself. But, and that is an interesting point, as you said, having those different skill sets on the team because, you know, extroverted people more comfortable being extroverted, whether it's their natural state or whether they've learned to push themselves there and they're that extroverted introvert to get through, they're going to find out there are problems that need to be solved or have conversations that, that somebody who's diligently killing themselves at their desk, just doing great work is never going to know about because it's not going to show up. It's not going to be in an email. It's not, you have to be in that conversation. You have to be in that room. Which, speaking of beginning the conversation in the room, backtracking a bit, we talked about intel requirements. I want to dig into that for a second. When you're coming into an organization and say, okay, we, we gotta start with stakeholders and their intel requirements. I think most people agree on that. Do you have a process for that? What do you do right now? Not necessarily right now, right now, again, I'm not trying to call it any specific companies, but what have you seen successful in terms of a process for talking to stakeholders, for identifying stakeholders, engaging them, and being able to develop some shared understanding on intel requirements.

Yeah, I think that I, at this point in my career, I've developed a kind of baseline for what I think any intelligence program needs to include in their PIRs. And that's purely based off of an initial OSINT on the company, right? It doesn't matter what company you work for or whatever organization. And okay, this is a baseline, pure, like bare minimum. This is what I think we need to care about. And I have said before, I think you need to start building threat intelligence with the security organization in mind. That's the start. You need to be reactive before you can be proactive. But in doing so, you can take that baseline, those baseline PIRs, and bring them to the security operations center and be like, hey, do you agree with these? Would you like to add anything? Would you like to pick anything out? And that's something that I did team by team with the I first get in anywhere, and even if you're not leading this organization, even to better understand your organization, on any security team, quite honestly, going team by team and understanding what they do and what they care about is incredibly helpful. And you're able to, with threat intelligence, build that into a living document because that's still going to change and you need to be able to keep having those conversations.

Yeah, and it's a good point. As you said, as you're new to an organization, going team by team, I found most people like to talk about themselves. They like to talk about their work. Not everybody. Again, there's some people who really don't, but many do. And if you come in and ask, hey, what are you up to? As long as they don't think you're some efficiency expert, next thing I know they're gonna have their head on the chopping block. But I think a lot of organizations, a lot of people in organizations are happy to say, yeah, this is what we do all day. This is how we do this, this is how we do that. And that sharing not only helps us understand their day-to-day life and what their needs are gonna be, but it does build that rapport and that relationship. It's, you can't do that through email. You're just not going to. But when you've spent time with somebody or broken bread with them, even better if possible, then you're in a position where they'll help you and they'll give you leeway and some grace if you send something out and it's not quite what they needed it to be or whatever. Whereas if you just try to make relationships through nothing but emails, I emailed everybody, I've talked to everybody through several emails, you haven't really made a connection with them. I apologize for anybody who thinks otherwise. The minute you do something they're unimpressed by, you're just words on a digital screen. Like they don't have any loyalties to you or any concerns for your well-being. You're just the person who screwed up their day. And at Intel, you can screw up a lot of people's day. So I think you make a great point that it's good to get out and meet people and learn a little bit about them directly if you can. I'm gonna sidebar for a second. This wasn't one of the questions we prepped for at all. Haha. But I'm curious, in your past, I noticed, you know, your resume, and I'm pretty sure, if I'm not mistaken, that you have a mentor. You and I have a friend in common.

Yes.

If I'm not mistaken. And so Lisa Ackerman is a good friend. She's been on the show as well and an expert. So I'm curious, the reason I bring Lisa up Aside from just a shameless plug so that Lisa will watch the show, is I'm curious about your thoughts as you're in the industry, as you were transitioning, your thoughts on mentorship and learning from, from others. You weren't from the intelligence community. You didn't join the private sector with the idea you were gonna run CTI programs someday, and yet here you are. So can you talk a little bit about the importance of mentorship, both what it did for you, but also for those out there who might not be thinking about how much they can impact other people and finding talent in places you may not otherwise have expected to, just because you're out there looking for it and you're willing to be open to it.

Yeah, I'll be quite honest that as soon as I started in cyber intelligence or cybersecurity field in general, I, through established organizations or just internally with my teams, had access to mentors. So I think my very first one was through the EWF program. And that was very, like a very formal, here's your mentor, you gotta meet a certain number of times a year type of thing that was happening. And it was the first time that while I was overwhelmed being the, okay, this is cybersecurity, everything's going on. Like, it's absolutely crazy when you first get into it. It's very overwhelming. I had this woman who was a CISO at the time, which was crazy, 2015, a female CISO. And she was talking to me about, you know, all the things that she did. Like, she didn't study cybersecurity in college and like how she just moved around and there was a whole world of cybersecurity out there outside of threat intelligence and that you become a more well-rounded security professional as you get to experience all the different sides of cybersecurity. And that was something that at my first role where I eventually got to meet Lisa, I really took to heart. And I was in an interesting position because before I met Lisa, threat intelligence was a red team function, which I've never seen since. But it was interesting.

That's a bad place to put it. It's an odd place to put it, I would say.

It is, but it was interesting in that I got an introduction to what threat intelligence can be for more offensive capabilities. So it's a different way of looking at threat intelligence, and that actually helped me provide better services to the SOC. And then when Lisa became in more as a manager, that was something that, as a capability, we often discuss growing. How do we grow this? How do we take threat intelligence to that next level. And honestly, throughout all of my roles in the various organizations, being able to talk to those people at the very beginning and throughout as I've grown, I consider all of my previous managers to some— in some regard, our mentors. And we've talked about communication and how that's so important in threat intelligence, but truly, I think if I needed to, I could call any one of those previous managers or directors even, and we would be able to talk about something security or professionally related. And I think that's key, not just in threat intelligence, but also for career growth.

Yeah, 100%. I agree. And it's good to hear that you've been in a position where you've had quality mentors. And frankly, you're at a point now where I'm sure you're going to be mentoring others if you aren't already.

Uh, yeah.

I was gonna say, it's funny how fast that transition happens too. We go from, I don't know anything and everybody's teaching me stuff to suddenly somebody's asking me questions and I have no idea why, because I still don't know anything, but okay, I'll, Try and answer my, answer your questions. I don't know exactly when that happens, but it seems to creep up. So if you're, for anybody listening or watching right now, if you're not currently mentoring somebody, if people aren't asking you for advice or questions, they will, they will. It'll happen one day. You won't expect it and suddenly you'll look around and realize, oh, I'm the person who knows things now. And if it doesn't happen to you at some point, then you're probably in the wrong place because that's just how it works. And it's good to see you in that position now. And it's good to know that there were people that were, you know, having those conversations and were being communicative because we all have to take care of each other. This is. Ultimately a team game. Intel's just one piece of it. Red team, I will say, I've never seen Intel under red team. They do make a really good customer for Intel. So it's an interesting structure to have it set up that way. They are, I think they're one of the better customers for Intel because then you're, you're giving the blue team the right challenges, right? There's no point in having the red team out there doing things that have never been done in the wild before. Hey, we're emulating an adversary, but we're doing things they've never done before. Well, they're not emulating the adversary. So they're a great customer. I've just never seen Intel under them. So that's very interesting. But speaking of that, speaking of where Intel is, where it belongs, where it goes, what do you see if we start looking ahead now? We've talked a lot about your past and your journey and where you are right now and what you're building, but what do you see? Pull out your crystal ball and tell us. And that's how Intel works for anybody who doesn't know. We all have crystal balls and we just predict the future. Once you reach a certain level, they just issue you one. In the government, they gave it to us early on. In the private sector, once you lead a team, they issue you your crystal ball. So get out your crystal ball. Don't show anybody though. It's a secret. Shh. And then talk to us about what you think the future of intelligence is over the next 5 or 10 years. Where do you think we're going in the private sector in terms of intel?

I think we've discussed a lot about different organizations having different needs and small organizations not needing a mature intelligence capability. But I think we're going to see very differing levels of maturity and that being accepted at various organizations. For the financial sector, we— there are regulations that demand certain capabilities, and so that'll always be needed, and for similar sectors where there are similar regulations, at least within the US, that's also going to be needed. But I could, in 5 years, I could see that mom-and-pop shop that has just maybe 3 point-of-sales and 1 computer where they store their Excel spreadsheets. Maybe their point-of-sale vendor provides an AI agent that says, this is what the agent cares, thinks you need to care about, and it'll feed you anything of a high priority that you might need to alert your customers about. I could see that being a— everything's a subscription service nowadays.

Of course.

But I could see business model-wise, I could see that happening. But for a larger organization that either has the need internally or through regulations, I could see their intelligence being more of a fusion function. Something that I really believe in is, again, we talk about business needs and fully providing products and services to the security organization. But I see threat intelligence working with proactive threat hunting. If you're able to have a standalone threat hunting team, that would be amazing. A lot of organizations don't have the money to create that. That's a way to start threat hunting, just using that threat intelligence in a proactive way so that you're not responding to incidents or events. I think the SOC can do that perfectly fine. Another way is being able to do purple teams, and that's coordination with the red team. That's one way you have a red team as a customer. And being able to fully suss out those PIRs, using those purple teams to prove, hey, this is what's going on out in the wild. We've created an emulation plan. We have gaps, maybe you don't, and here's the business risk of what that looks like. And this is real. And going from there, being able to then extend that relationship to the business directly. Here, you're speaking to a business team, maybe they're marketing and they're, coming up with something and they're able to ask you a question, you could say, hey, yeah, this is like a risk, a cyber risk that you maybe haven't thought of. And I think that's the end goal, but it's going to take a while to get there. And not every organization is going to need it, quite honestly. And, you know, AI is such a buzzword, and I could see it filling a need for organizations who don't have the means to create a threat intelligence team.

And you bring up a couple interesting points in there, right? So, the possibility that people will more widely accept that maturity doesn't have to be the same across the board, and then, So, we have some maturity models and some more that are being worked right now. CTI CMM's a, a new model out there that's, I think, has a lot of promise, for instance. But perhaps we're gonna have to apply that and say it's different for different industries. Everybody shouldn't try to get to a specific level, right? And so maybe we're gonna have to map that and say, if your company is in this industry at this size, this is the target of maturity you should have. Everybody shouldn't try to be a level 5 maturity. That's actually probably nobody should. There's probably too much expense in that, but not everybody has to be mature to the level of an international bank. But then the question is, what is the right level? And I don't know that anybody knows that yet. So it'll be interesting to see where that goes. But you also talked a bit about regulation a couple of times in there. And so I'm going to ask a couple more challenging questions on this subject. I think I have some concerns in here. AI and regulation are two pieces that come to mind for me. So we're seeing this big push in AI right now. So I've seen, we've had massive layoffs over the last couple of years across tech in a lot of different areas. And I've certainly seen my share of people saying, you know, We're not going to even tell people anymore. AI is going to do it all. We're going to have AI do the research and the analysis and the reporting, and then it's going to be automation. We'll tie it to, to tips and SIMS and we're just going to get rid of all these people, right? And so my hope has been that people wouldn't do that. My hope is not necessarily coming true. And so I wonder what your thoughts are there on the risks of organizations who do not fully understand what intel is, what we do, what the processes are, what the difference is between an AI-generated product that looks and smells like Intel and an actual Intel product that has gone through all the processes that AI will pretend it doesn't mimic, but won't actually do. What are your thoughts on the risks and the threats and the fear, uh, that a lot of people have, myself included, that AI companies are gonna just turn to AI because it looks and smells like Intel and it's a whole hell of a lot cheaper and faster than hiring all these damn people that are such an inconvenience. Do you worry about the threat? Of organizations going in on AI and trusting that AI can be the solution and getting rid of the people?

I do worry about that. I think there is going to be a massive learning curve when it comes to AI. I look at AI and LLMs in general as a tool for threat intelligence. I fully expect— we're not quite there yet, but I do expect that anything that we could automate in threat intelligence today, an AI could do. And I'm okay with that because I'm going to automate it anyway. And a lot of that is that reaction piece. You know what? Yeah, if I am able to plug in my PIRs to an AI and they can scrape the internet for me, I'm okay with that. At the end of the day, reaction is reaction, but it's just the step one in maturity. So, as your needs grow as an organization, you're going to need people to bridge that gap with the business. An AI agent is not going to really be able to do that because so much of it is understanding your customer. And it's that people-to-people because even in the same organization, you'll have a leader And you know, maybe you'll have 3 leaders in marketing and they'll all have different priorities.

Mm-hmm.

An AI agent's not really gonna be able to deliver a product for all 3 at the same time. So I see, yeah, there's going to be some adjustment. There's gonna be a learning curve, and we've seen it before. Companies will invest in automation and it's not gonna— they'll use it for a while and they'll say, okay, it's not doing exactly what we want it to do, so we need to hire some people to supplement it. We— that's at least in my career what I've experienced. But I do see AI being used for that reactive piece. I'm okay. Not quite yet. I don't think we're quite there yet. Just as a threat intelligence analyst, I'm like born to distrust anything new, but I could see using AI for reactive threat intelligence because that's something I'm okay with automating anyway.

Yeah. And as you said, there are things we automate now and there's nothing wrong with that. You can set up automated collection as long as you give it the right parameters. AI is just a smarter, in this particular format, AI is just a smarter Google that's going and doing it on your behalf, for lack of a better way of putting it. I don't have a problem with that either. I think there are certainly places where AI is, is going to make us better, right? Turning humans into superhumans, making us more efficient, et cetera. But the higher level pieces, I, I have a great fear of. Now, the second thing I wanted to talk about, I mentioned regulation. So here's another concern I have, and I'm curious to bounce off of you, right? Something I've seen as a trend. I've seen over the last several years that's got me concerned. I'm wondering what you, if you've seen the same thing and had the same thoughts, is organizations seem to be, because intel is tied to business risk, right? Intel is, the more we tie it to business needs, I fear we're seeing organizations doing some math and saying, all right, how much is it going to cost us to run an intel team? X number of dollars per year. Okay. What's our risk? What's the likelihood? I'll use one example, ransomware. What's the likelihood we'll get hit by ransomware in the next 10 years? And somebody does the calculation, says, I don't know, 1 in, 1 in 4, 1 in 3, whatever it might be. And what's the average cost of a ransomware attack? And it's X number of dollars. And then they're comparing that to, all right, so if we're gonna hit every 10 years with a ransomware, that's the estimate, and the average cost is $40 million, does it cost us more than $4 million a year to run an intel team right now? Because if it does, that's not a good cost analysis. And so I originally, when I got in the private sector, we didn't worry about it because I worked at a bank and we were told The whole reason we do what we do is so people trust us. If we get hacked, if we get compromised, people won't trust us. They'll move their money. They won't be customers. So there wasn't really a debate on the motive, but it's not turning out that way. Every company gets hacked. Every bank's been hit. Every airline's been hit. Every hotel chain's been hit. Every retailer's been hit. I'm pretty confident that everybody I know still shops at Amazon and Target and still flies the same airlines they've flown and still uses the same banks, right? So if customers aren't going to move their business then companies are gonna do this calculation based solely on their bottom line, not on what's best for community or society or customers or whatever. And so I'm wondering, I'm getting to a question, if this is gonna require regulation to be the solution, cuz companies aren't going to act in the best interest of anybody but the company, of, of their stockholders. And that's their job. That's not even trying to vilify for-profit businesses when I say that, that's their job. That's their fiduciary responsibility. In fact, they don't have to worry about society. They have to worry about their stockholders and their, so, What are your thoughts there on companies having this kind of calculation? And if so, where regulation might have to, have to fit in there to force some companies to care more about the global picture and their customers as opposed to just the bottom line?

Yeah, I think that is one way that, you know, if everything was all perfect in the world, regulation would be, you wouldn't need regulation, but regulation would be the way to do it. I think it made me immediately think of the differences with this, the different states and data privacy and how when GDPR was created in the EU, that regulatory push towards private firms to have to provide that level of security for customers. But at the end of the day, it comes from the customers. That's, I don't, you don't want to get into politics, you know how politics works, representation. But at the end of the day, there's going to have to be a need for it. Customers are going to have to demand that of their— the businesses that they are giving money to. And I think it's— it depends. Right. But it's a hard thing to say because it's individually charged and everyone's going to have a different answer to it. Regulations I could see being used to help mitigate that, but whether or not that can actually happen will depend entirely on what people are willing to accept for themselves.

Yeah, you make a really good point, right?

It's—

this is free market economics, right? So ultimately, consumers— as I said, when I was at the bank, it was understood, or believed at least, that if we didn't do the things we had to do, we'd be compromised and people would move their business. It turned out not to be true. There's been plenty of data, and I've done some of my own research on the subject, that shows companies get compromised and they're their quarterly profits go up the next quarter, their revenues keep going up. We're reaching a point where we just have all gotten numb to the idea and there's nowhere to move. What would be the point? Oh, I'm moving out from this bank. Okay, which bank can you go to that hasn't been compromised? I can't find one. I'm going to change to a different retailer. Where are you going to buy your stuff? It's— so there's that feeling. And there's also a generational shift. We have upcoming generations that care less about security and privacy. Again, I don't mean to vilify when I say that. There's stats that show this is generations coming up that just live a more public less secure life. And so these stories don't resonate the same way. And if that's the case, then maybe the answer is none of this is going to matter. And if it's not going to matter to companies and there's no business value to it, but we're, it's all just going to be data is everywhere and risk is risk and nobody really cares. And we won't have intel programs and nobody will try to stop anything. So let's hope it doesn't go that far. But I was curious what your thoughts were on that and where you've seen it so far.

Yeah, I think there's some level of depending on your industry sector, there's a level of systematic failure and actual economic impact that could occur. Like when we, when the beginning of my cyber career with the Bangladeshi hack and the hack on SWIFT, that was systemic. That was like, oh, one could go down and we could all go down type of thing. Sector dependent, but there's also a level of people, at least here in the US, people are empowered. And probably in the EU as well, not quite as familiar, when your data gets exposed, are you able to take legal action? And that does translate to a monetary impact on the business. So, you know, you might be able to see things grow through that way. That's something that I've talked about. Okay. Yeah. Like maybe we have a massive data breach, but there could be a class action lawsuit because of that.

Yeah. Yeah. And maybe that ends up being the answer. It's a good point. I think it's important to, for all of us to remember that businesses aren't built in the public interest, right? And that, again, that isn't a negative when I say that. There's nothing wrong with that. That is what for-profit businesses are not built for. They're not for the public interest. They are for profit. So they're not responsible for doing what's best for all of us just because we think they should. They're going to do what's best for the business. And that means that, yeah, maybe there have to be other levers, whether, like you said, it's a class action lawsuit or there has to be something that motivates the company to still care. I'm sure there's some, by the way, don't get me wrong. I'm sure there's some companies out there that absolutely care about everybody and they're just very much in tune to the people and they do it because they think it's the right thing to do and it's, they're never going to be forced to do it. But most companies, that's just not how it works. It's about profit. So it's interesting to see that. And I love getting your point of view. Now listen, we're running a little low on time. So I do want to transition and it's going to be a hell of a transition for anybody who's paying attention right now. Buckle in because we're talking about these heavy things about Intel and building programs and and that we've kind of talked about, the risk of AI taking everybody's jobs and companies not caring. But now we're gonna switch to the personal, right? So, the name of the show is Unspoken Security, and every guest before, you don't get to duck the question, and so, the, the question that goes with the show is, tell me something you've never told anyone before, something unspoken.

Yeah. So, this is something that very few people know about me, and there's only VHS-level evidence. Of it ever having occurred as I am a two-time graduate of clown camp.

Whoa, whoa, slow down. Hold on. Let's take that one in for a minute. You are a two-time graduate of clown camp, which anybody who listened from the beginning to now knows I did not have that part of your resume. That's not from Brandeis. That is— so talk about this. You are a two-time graduate of clown camp. Where, when, how does this all work?

So it was my hometown during one of those spring breaks, winter breaks, something like that. We had local clowns who were— there's like a whole organization, like legitimate clowns. There's certifications and I don't know if it's a union. I don't— it was a long time ago.

I, I wanna see a clown union meeting, by the way. Yeah. I'm very interested to know what the union delegates are talking about at the clown union. And they probably are too. I'd be very interested to see that.

Legit, legit clowns, like in parades and whatnot. And they would provide a camp for kids whose parents work. And yeah, the first time I went, it was by myself. And I was, we talked about being introverts. I was fairly introverted and what you had, the core components of being a clown were, I think, balloon animals, your makeup and like your clown persona. 'Cause your makeup does play into your clown persona. And then you had improv, which was horrifying to me. Oh yeah. And then there were some beyond improv, there were like joke writing and acting. And pie throwing.

Pie throwing.

Pie throwing.

What about pie receiving? Is that like an advanced course?

Yeah, that's part like stage combat, like how to take a hit. Yes. How to take the pie to the face.

All right. So what was your persona? What is your clown persona?

I feel like I had, cause I did this twice. One time I did it the first time. I have a younger brother and he was very upset cuz he wasn't old enough to go that first time. And so he demanded to go the second time. And my parents were like, you're gonna have to go with him.

Perfect. You're gonna hit him in the face with a pie. Perfect. A lot of combat.

I honestly don't remember. I would have to watch the VHS. I'd have to pull up the VHS.

Oh, I think we all should watch the VHS. I would very much like to see this. I think this would be worthy of something that should be on stage someplace. We always talk about this at a conference, perhaps.

I loved— oh, I did forget one core component was juggling. I loved juggling and I loved balloon animal making.

So can you still juggle?

Stars?

Okay.

That's like the beginning.

Stars are more than I can do. I know, cuz they go slower, whatever. That's more than I can do. Can you do balloon animals too?

Yes.

No kidding. That must be a treat for all sorts of people. That's— what's your coolest balloon animal?

I feel like I made like a, an octopus at one point. Not like a very complex one. You can just, you have to use a couple of different balloons and you just have to like make the beginning and then the legs are easy. You just leave 'em out. Or you can make it. Point up if you want to, just add another twist at the end of them. That was a cool one. But it's always easy to do like a giraffe or a dog.

I can make a snake. It's just a long balloon.

Yes, you can.

So I said, hey guys, you wanna make a snake, an inchworm, a wiener dog without legs? It's all the same for anybody who's trying to visualize this at home. So clown camp, 2-year graduate of clown camp. What's, is there anything you took from clown camp that is, you look back and go, I actually, this really, I still use this in life in some fashion. This did something for me. This was an experience that actually still benefits me aside from perhaps juggling and balloon animals?

I think part of it was being forced to do improv and perform it. That was something that was tough for me. And I think that's something that I've always appreciated being able to know that I can do if I have to. But another part of it, and I actually never really thought about it until you just asked me, is life at the end of the day isn't that serious and it's okay to have some fun with it.

True story. True story. How many clowns fit in a car?

An infinite amount.

That's, that's probably true. Depends on the size of the clowns and the size of the car. Right. So that's true. Listen, I, fascinating. Obviously a huge departure from the rest of the conversation. I, for those who don't know, I do now give guests a heads up. This question's coming. I mean, everybody's seen the show at this point, so they know. I try not to peek at what the answer is in advance. So I just saw Charlotte's before we came on today and, and I was like, oh wow, I, this is gonna be very exciting. You never know what you're gonna get for that answer. But clown camp is at first. And yeah, I, if you happen to have any still photos or videos of that, I would love to, to be able to add that. Absolutely not. Yeah. No, nothing out there you're gonna put out there. How old—

This is all of me adjusting. I'm gonna say this.

How old were you roughly when you went to clown camp?

I think the first time I was 7, so the next time I would've been 8.

Oh, you were very small. You were just little. This was like a little— Yeah. You didn't do this as like a senior in high school or anything like that, so.

No, no.

That's, I think it's hilarious. Listen, thank you for sharing that, by the way. I'm sure that was you know, it was something you hadn't told a lot of people. So I appreciate that. I think it's, I think it's awesome. I think it's an interesting piece to talk about a learning experience. Like you said, being pushed in, into doing something outside your comfort zone will probably help out. And yeah, life's not that serious, right? It is some days, and I'm not trying to diminish it for those who are struggling in all sorts of ways right now, but we also remember, yeah, there's a chance to take a moment to laugh at somebody spraying water on somebody and hitting 'em with a pie and squeaking their nose. All right, listen, I gotta wrap up the show. Before I do, is there anything, any last thoughts you have? Anything, last words you wanna say? Anything you wanna plug? Anything you wanna talk about before we, we close this one out? Let people go back to their lives.

At the end of the day, threat intelligence is a useful tool for an organization. It's useful for the business. You got to be able to prove that it's useful for the business. We talked a lot about that. And yeah, life can be tough and takes, you got to make sure you make some time to laugh. All right.

That's good advice. And I appreciate it. So listen, for anybody who's been listening or watching, I appreciate you. Thank you for taking the time. We know there's other things you can do. If you haven't already, please do subscribe, leave comments, all those good things. If you have positive things to say, I'd love to see that. If you have negative things to say, I'd prefer you told me privately, but if you feel like telling people publicly, that's fine too. If you have ideas on how to improve the show, please let me know. If you have ideas for guests, if you think you should be a guest, let me know. You might be wrong. We'll find out, but we're always looking for more exciting people as we go into next year. But again, thanks everybody for taking the time to be here, to watch, to listen. You are the reason the show exists. And so I hope to be able to continue this for many years to come. With that said, I'm gonna close it out for today. So thanks again. This has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security.

If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time. Legends are made.