Future of Threat Intelligence

Tidal Cyber's Director of Cyber Threat Intelligence Scott Small reveals how his knowledge base now tracks almost 25,000 procedure-level instances across nearly 800 MITRE ATT&CK techniques and sub-techniques, capturing the command-level detail that exposes the false promise of "100% coverage" when working at technique abstraction alone. He argues that the pre-attack reconnaissance phase remains the most essential yet most ignored portion of the framework, including the recently formalized technique for purchasing and selling victim data on stealer marketplaces. 

Scott's AI workflow treats LLMs strictly as structured data processors that reference MITRE's written technique examples to parse unstructured threat reports, refusing to use them as intelligence sources themselves. He's seeing threat intelligence and detection engineering roles merge as individuals develop hybrid skill sets. His methodology for mapping TTPs to vulnerabilities gives security teams a data-driven rationale to deprioritize patches when strong post-exploitation defenses already cover the attack vector.

Topics discussed:

• Tracking almost 25,000 procedure-level instances across 800 MITRE ATT&CK techniques to expose the false promise of technique-level coverage alone

• Defending pre-attack reconnaissance phases including the technique for purchasing victim data on stealer marketplaces

• Classifying scanning activity by threat type to prioritize C2 infrastructure linked to APTs over fraud-related domains

• Blending threat intelligence and detection engineering roles as analysts gain EDR skills 

• Using AI as structured data processors that reference MITRE's written technique examples to parse unstructured threat reports without generating intelligence

• Mapping TTPs to vulnerabilities to create data-driven rationale for deprioritizing patches when post-exploitation defenses cover the vector

• Visualizing attack narratives through the MITRE ATT&CK matrix to tell leadership about defense gaps and justify resource allocation decisions

Key Takeaways: 

• Track adversary procedures at the command and protocol level to identify real defense gaps.

• Monitor stealer marketplace activity and automated dealer platforms for credential exposures tied to your domain, then reset credentials.

• Prioritize threat intel alerts by focusing first on APT-linked activity over fraud campaigns.

• Develop hybrid skill sets where CTI analysts understand EDR logging capabilities and threat hunters consistently consult adversary behavior reporting for hunt hypotheses.

• Implement AI workflows that use LLMs to extract structured technique data from unstructured threat reports, not as intelligence output itself.

• Map TTPs to specific vulnerabilities to build data-driven cases for deprioritizing patches when post-exploit defenses provide coverage.

• Create visual attack narratives using the MITRE ATT&CK matrix to communicate defense gaps and resource needs.

When Casey Beaumont's entire CTI team departed just before new analysts started, she found herself running threat intelligence solo for months while directing incident response, threat hunting, and red team operations. That trial by fire taught her exactly what separates tactical intelligence from strategic value, and why the best analysts invest significant personal time building trust networks that enterprise tools cannot replicate.

Casey's teams at Marsh McLennan, where she’s the Director of Advanced Cyber Practices, received warnings about Scattered Spider infrastructure 20 minutes after domains registered, before threat actors sent a single SMS phishing message to employee cell phones. That early intelligence enabled blocking domains internally and preparing communications before the first report came in. These private intel networks, built through years of trust and after-hours engagement, consistently deliver the warnings that matter most for large enterprises facing sophisticated, targeted attacks.

Beyond tactical response, Casey explains how her CTI program produces strategic intelligence that drives architectural decisions. She also shares her framework for vendor breach assessments that cuts through legal wordplay, why attribution matters far less than response speed during active incidents, and how to scope CTI mission appropriately to prevent analyst burnout in organizations with massive attack surfaces.

Topics discussed:

Key Takeaways: 

Listen to more episodes: 

Apple 

Spotify 

YouTube

Website

Michael Moore, CISO for the Secretary of State of Arizona's office, explains how he acts as a virtual CISO for all 15 counties by conducting physical security assessments at election facilities and providing real-time guidance during critical events. His approach treats surprise attacks as learning opportunities that should only work once, immediately sharing adversary infrastructure and TTPs across the entire election community to burn their capabilities. Michael emphasizes that misinformation, disinformation, and malinformation represent converging threat vectors that manifest as both cyber attacks and physical violence, requiring defenders to think beyond traditional security boundaries.

Ryan Murray, CISO for the State of Arizona, shares his Cybersecurity Trinity for AI framework: defend from AI-enabled attacks, defend with AI-augmented tools, and defend the AI systems organizations deploy. He explains how Arizona replicated MS-ISAC functionality through AZ ISAC, enabling 1,000+ government personnel across 200+ entities to share intelligence in real time without requiring mature security programs. Ryan stresses that organizations already generate valuable threat intelligence internally through phishing reports and security alerts, and the real challenge is communication and relationship-building rather than expensive commercial feeds.

Topics discussed:

Key Takeaways: 

Listen to more episodes: 

Apple 

Spotify 

YouTube

Website

SolarKal's $5 billion bid database reveals a 100% spread between highest and lowest proposals for identical projects, signaling reactive procurement without market intelligence. This could cost portfolio owners double. Yaniv Kalish, Founder & CEO, has a procurement framework that starts with portfolio-wide regulatory mapping and interconnection queue analysis before vendor engagement, preventing the months-long chase of properties that fail during permitting due to roof load limits or utility barriers. Roof lease structures reposition unutilized square footage into seven-figure annual NOI additions.

Yaniv's financing comparison also highlights solar's critical advantage over traditional real estate: construction loans replaced by permanent financing at energization versus extended hold periods. His staged deployment approach prioritizes speed while emphasizing upfront expert guidance to avoid equipment selection mistakes and contract terms that surface as change orders months later. 

Topics discussed:

Richard Zdunkewicz, CEO at Distributed Energy Clearinghouse, has watched distributed energy resources evolve from expensive sustainability projects into revenue-generating financial assets that command premium rents. He helps multi-site property owners navigate the complex value stack across regulated and competitive markets, turning building data into actionable business cases. He provides Sean unique insight into how the shift from fixed pricing to locational hourly value fundamentally changes every commercial real estate energy investment decision.

Richard talks about the biggest misconception about DERs is viewing them as add-ons rather than financial assets that generate contracted revenue streams similar to lease agreements. His analytics platform addresses the reality that while most buildings collect massive amounts of energy data, they fail to translate it into the financial results that drive capital planning decisions. Virtual power plants allow commercial properties to participate in power markets as small power plants, earning revenue for flexibility and grid responsiveness. Richard also touches on the emergence of energy-as-a-service models that enable property owners to conserve cash while accessing sophisticated energy infrastructure, and why private equity increasingly views DERs as standalone assets with predictable cash flows.

Topics discussed:

Luke Lanciano, Director of Sustainability at The Tower Companies, shows his expertise in his systematic approach to energy optimization: using 15-minute interval data to identify startup and shutdown inefficiencies, then connecting those energy peaks to the exact moments building engineers remember sweating through equipment failures on hot days. His method makes control system investments immediately tangible: when staff see how automated sequencing prevents the simultaneous startup spikes that create their worst workdays, they become advocates rather than obstacles.

Luke's multifamily strategy flips conventional wisdom by prioritizing comfort over efficiency targets, addressing the loudest 5% of complainers individually while implementing high-efficiency equipment for the other 95% during natural turnover periods. This approach has turned 1960s buildings into Energy Star performers in the mid-to-high 80s. His air quality framework cuts through measurement complexity: master temperature and humidity through proper airflow first, and everything else follows.

Topics discussed:

Data centers now consume unprecedented amounts of electricity, but the industry hasn't abandoned sustainability. It's adapting at scale. Raul Saavedra, Vice Chair, Head of Data Center Advisory, Americas at Colliers, highlights how data center lease structures have shifted from full-service turnkey operations to core-and-shell triple net arrangements, driven by the massive scale of modern facilities and tenant preferences for control. This structural change redistributes sustainability responsibilities but doesn't diminish them, since hyperscale tenants maintain strong environmental commitments regardless of lease type.

The conversation also turns to practical optimization strategies, including how data centers achieve better PUE, the key metric operators monitor to measure system efficiency and sustainability performance. Simple innovations like using outside air for natural cooling through louvers can dramatically reduce energy consumption. Looking ahead, Raul predicts a shift toward smaller, more manageable power distributions in metropolitan areas rather than today's massive centralized facilities. He also addresses common misconceptions, particularly around water usage, explaining how many data centers employ closed-loop recycling systems rather than consuming fresh water continuously.

Topics discussed:

Grant Waldron, Director of Sustainability Strategy at Gaia Development, asserts that sustainable building practices generate immediate financial returns as well as long-term environmental benefits. His work at Gaia spans more than 100 million square feet, including the first LEED speculative building ever constructed. Grant tells Sean how regulatory requirements like California's new life cycle assessment mandates for buildings over 100,000 square feet create competitive advantages for developers who understand the financial optimization opportunities hidden within sustainability compliance. 

Grant’s team consistently delivers commissioning studies that recoup their costs within the first year through identified inefficiencies, and his approach to materials optimization has saved clients hundreds of thousands in concrete costs by reducing slab thickness without compromising structural integrity. He warns that the window for electrification planning is closing rapidly, as major corporate tenants with 2030 net zero commitments will abandon facilities with gas systems during the 2029 lease renewal cycle.

Topics discussed:

Property owners who run their own catastrophe modeling scenarios are gaining unprecedented negotiating power in today's brutal insurance marketplace. At Bridge Investment Group, this proactive approach is reshaping how commercial real estate tackles climate risk and secures coverage where others can't.

Isela Rosales, Managing Director, Global Head of Sustainability & Responsibility, tells Sean how forward-thinking property owners are using third-party software to run hurricane, wildfire, and flooding scenarios across their portfolios. By calculating maximum loss exposure and presenting mitigation strategies to insurers, they're securing coverage in markets like California where it's becoming nearly impossible to obtain.

Topics discussed:

What happens when a Fortune 200 company tracks carbon reduction as closely as P&L performance? At JLL, it created a shift from viewing sustainability as a cost center to treating it as a core business driver across 30,000 megawatt hours of annual consumption.

David Kollmorgen, Global Head of Real Estate, outlines how their sustainability program evolved from basic invoice reporting to enterprise-level value creation. By implementing P&G's "power of and" framework — sustainability measures must deliver same or lower costs while meeting corporate priorities — they've broken the false choice between profitability and environmental impact.

But that's just the foundation, he tells Sean. From deploying nuclear baseload strategies over traditional renewables to implementing digital twins that predict occupancy levels, David's team is creating systematic approaches to corporate real estate that prioritize measurable outcomes over operational excellence while building toward net zero by 2030.

Topics discussed: