The single-person (and several dozen AI agent) CTI team

Corporate cyber threat intelligence (CTI) teams require the full intelligence cycle of capabilities to deliver quality intelligence to decision makers. However, CTI teams are often a single person with a range of responsibilities who struggle to keep up with the demands of monitoring the threat landscape. It means that critical intelligence activities such as requirement setting, collection management, eliciting feedback, and managing stakeholders are routinely neglected due to the relentless need to monitor feeds and produce intelligence.

The single-person CTI team will remain the reality for many cyber security functions with competing priorities. Growing headcount is difficult in any corporate environment, and there is a genuine shortage of experienced analysts who have the skills to perform the full range of intelligence activities. However, through the focussed use of artificial intelligence, CTI functions can use their existing resources to produce better intelligence. The cost of using artificial intelligence continues to drop rapidly, and AI agents can perform most task significantly faster than human analysts, which reduces the time between events occurring and decision makers being informed. By using artificial intelligence to support the analyst, the main role of the CTI analyst in corporate cyber security functions becomes the contextualiser of intelligence: focussing intelligence on the organisation’s requirements and bringing the outputs of their analysis to the right parts of the business.

This presentation will demonstrate practical applications of artificial intelligence across intelligence activities such as requirement setting, collection management, target discovery, automated processing of intelligence collection, and intelligence production. It will focus on the importance of understanding intelligence as a system of interacting activities, and the areas where artificial intelligence is well suited to lend a hand. It will also highlight the elements of intelligence where human analysts will remain critical, such as relationship building and understanding the needs of the business.

Using interacting AI agent workflows, analysts are already streamlining existing manual workflows and performing tasks which have been neglected due to resource constraints. Like their AI counterparts, intelligence analysts operate in the information space, with skills in discovering, processing, evaluating, and analysing information so that it can support decision making. This makes it an ideal domain to explore the possibilities of artificial intelligence.