Cyber intelligence is both science and art: gathering scattered data, connecting the dots, and uncovering attacker behaviour before the next strike. Grace Chng speaks with Teo Xiang Zheng from Ensign InfoSecurity, who explains how the game has shifted from chasing fleeting threat indicators to profiling threat actors’ enduring patterns, a move from reactive to pre-emptive defence.

They unpack how today’s underground cyber economy operates like a business network, where initial access brokers, ransomware-as-a-service groups, and hacktivists collaborate for profit and power. As hacktivists evolve into organised crime groups, defenders are learning that understanding attacker behaviour, not just their tools, is the key to staying ahead.