Future of Threat Intelligence

By Team CymruBusiness

Future of Threat Intelligence episodes

September 25, 2025Safebooks AI’s Ahikam Kaufman on Why CFOs Need Company-Specific AI Models for Fraud Detection
Unlike CISOs who work with consistent vulnerabilities across cloud environments, CFOs face company-specific financial processes that change constantly, making automation historically complex to solve before the AI era. Ahikam Kaufman, CEO & CFO of Safebooks AI, explains why machine learning is the only viable solution to detect sophisticated embezzlement schemes that regulatory compliance demands every public company address — with no materiality threshold.
His background building fraud prevention systems at Intuit and Check has taught him how graph technology can link seemingly unrelated financial transactions to expose coordinated internal fraud attempts that would be impossible for humans to catch at scale. The challenge is compounded by the fact that most finance staff are accountants, not technologists, requiring AI tools that bridge data complexity without demanding high technical skill levels.
Topics discussed:
Sarbanes-Oxley requires fraud protection programs with no materiality thresholds, yet most organizations lack systematic detection across payroll, vendor, and expense systems.
Financial fraud detection requires unique AI models for each company using historical data, unlike consistent threats across organizations.
Advanced fraud schemes link multiple transaction types requiring graph technology to connect disparate activities that individual monitoring would miss.
Fraudsters use AI for parallel attacks, fake invoices, vendor manipulation, and executive impersonation, requiring automated defense systems for real-time processing.
Achieving 99.9% accuracy through structured enterprise data and rule-based controls where financial precision is non-negotiable.
Financial AI platforms integrate with existing systems without replacements or workflow changes, providing immediate automation value.
Key Takeaways:
Implement AI-powered fraud detection systems that monitor vendor account changes, payroll additions, and journal entry anomalies.
Build company-specific AI models using 1-2 years of historical financial data to learn unique business processes, data structures, and transaction patterns.
Deploy graph technology to link related financial transactions across different systems to identify coordinated fraud attempts.
Establish partnerships between CFOs and CISOs to combine external cybersecurity threat detection with internal financial fraud monitoring.
Focus on AI platforms that integrate with existing financial technology stacks without requiring system replacements.
Create rule-based governance frameworks for financial AI systems to eliminate hallucinations and maintain accuracy levels.
Monitor AI-amplified fraud techniques, such as sophisticated fake invoices, manipulated vendor banking information, and executive impersonation.
Develop automated systems that can demonstrate reasonable effort for fraud prevention to satisfy regulatory requirements and insurance protections.
Listen to more episodes:
Apple
Spotify
YouTube
Website
28 min
September 18, 2025Marsh's Sjaak Schouteren on the Golden Rule of Risk Assessment
Cyber insurance has transformed from a liability-focused niche product into a comprehensive business continuity tool, but widespread misconceptions continue to prevent organizations from maximizing its strategic value. Sjaak Schouteren, Cyber Growth Leader - Europe at Marsh, offers David how they combine risk quantification with business-focused communication strategies that give security leaders the tools to speak board language about cyber threats.
Rather than the complex audit processes, modern cyber insurance acquisition can be remarkably streamlined. Sjaak's experience managing real-world incident response highlights how proper coverage creates strategic advantages beyond simple risk transfer, including immediate access to specialized negotiation teams and forensics experts who can extend decision timeframes during crisis situations.
Topics discussed:
How the 2020-2022 ransomware surge taught insurers that mid-cap companies were primary targets requiring comprehensive coverage.
The three-pillar structure of modern cyber insurance covering first-party losses, third-party liability, and immediate incident response services without deductibles for initial crisis management.
Why risk quantification through scenario analysis and financial impact modeling provides CISOs with the business language needed to communicate effectively with boards and C-suite executives.
How risk engineers from security backgrounds have eliminated technical translation barriers between IT teams and underwriters.
The strategic advantage of immediate incident response coverage that provides access to specialized forensics, legal, and negotiation teams within 48-72 hours of an incident.
Why organizations with cyber insurance actually pay ransomware demands less frequently due to professional negotiation teams and comprehensive recovery support.
The evolution from narrow data breach coverage to comprehensive business protection across all organization sizes.
The distinction between risk mitigation through security controls and risk transfer through insurance as complementary rather than competing strategies.
Key Takeaways:
Conduct cross-functional scenario planning to identify business-critical cyber risks before evaluating insurance coverage options.
Map potential cyber incidents on a risk heat map measuring probability and impact to distinguish between minor inconveniences and threats that could damage business operations.
Quantify average and maximum financial losses for each business-critical scenario to make data-driven decisions about risk.
Leverage specialized risk engineers from security backgrounds during the underwriting process to eliminate technical translation barriers.
Engage professional ransomware negotiators rather than attempting internal negotiations.
Position cyber insurance as business enablement rather than just risk transfer by demonstrating how coverage strengthens overall cyber resilience.
Listen to more episodes:
Apple
Spotify
YouTube
Website
36 min
September 11, 2025SIG's Rob van der Veer on Why "Starting Small" with AI Security Might Fail
What happens when someone who's been building AI systems for 33 years confronts the security chaos of today's AI boom? Rob van der Veer, Chief AI Officer at Software Improvement Group (SIG), spotlights how organizations are making critical mistakes by starting small with AI security — exactly the opposite of what they should do.
From his early work with law enforcement AI systems to becoming a key architect of ISO 5338 and the OWASP AI Security project, Rob exposes the gap between how AI teams operate and what production systems actually need. His insights on trigger data poisoning attacks and why AI security incidents are harder to detect than traditional breaches offer a sobering reality check for any organization rushing into AI adoption.
The counterintuitive solution? Building comprehensive AI threat assessment frameworks that map the full attack surface before focused implementation. While most organizations instinctively try to minimize complexity by starting small, Rob argues this approach creates dangerous blind spots that leave critical vulnerabilities unaddressed until it's too late.
Topics discussed:
Building comprehensive AI threat assessment frameworks that map the full attack surface before focused implementation, avoiding the dangerous "start small" security approach.
Implementing trigger data poisoning attack detection systems that identify backdoor behaviors embedded in training data.
Addressing the AI team engineering gap through software development lifecycle integration, requiring architecture documentation and automated testing before production deployment.
Adopting ISO 5338 AI lifecycle framework as an extension of existing software processes rather than creating isolated AI development workflows.
Establishing supply chain security controls for third-party AI models and datasets, including provenance verification and integrity validation of external components.
Configuring cloud AI service hardening through security-first provider evaluation, proper licensing selection, and rate limiting implementation for attack prevention.
Creating AI governance structures that enable innovation through clear boundaries rather than restrictive bureaucracy.
Developing organizational AI literacy programs tailored to specific business contexts, regulatory requirements, and risk profiles for comprehensive readiness assessment.
Managing AI development environment security with production-grade controls due to real training data exposure, unlike traditional synthetic development data.
Building "I don't know" culture in AI expertise to combat dangerous false confidence and encourage systematic knowledge-seeking over fabricated answers.

Key Takeaways:
Don't start small with AI security scope — map the full threat landscape for your specific context, then focus implementation efforts strategically.
Use systematic threat modeling to identify AI-specific attack vectors like input manipulation, model theft, and training data reconstruction.
Create processes to verify provenance and integrity of third-party models and datasets.
Require architecture documentation, automated testing, and code review processes before AI systems move from research to production environments.
Treat AI development environments as critical assets since they contain real training data.
Review provider terms carefully, implement proper hardening configurations, and use appropriate licensing to mitigate data exposure risks.
Create clear boundaries and guardrails that actually increase team freedom to experiment rather than creating restrictive bureaucracy.
Implement ongoing validation that goes beyond standard test sets to detect potential backdoor behaviors embedded in training data.
Listen to more episodes:
Apple
Spotify
YouTube
Website
35 min
September 04, 2025Vigilocity's Karim Hijazi on Supply Chain Threat Intelligence
Karim Hijazi’s approach to threat hunting challenges conventional wisdom about endpoint security by proving that some of the most critical intelligence exists outside organizational networks. As Founder & CEO of Vigilocity, his 30-year journey from the legendary Mariposa botnet investigation to building external monitoring capabilities demonstrates why DNS analysis remains foundational to modern threat detection, even as AI transforms both offensive and defensive capabilities.
In his chat with David, Karim explores how threat actors continue to rely on command and control infrastructure as their operational lifeline. His insights into supply chain threats, "low and slow" reconnaissance campaigns, and the evolution of domain generation algorithms provide security leaders with a unique perspective on proactive defense strategies that complement traditional security controls.
Topics discussed:
External DNS monitoring approaches that identify threat actor infrastructure before weaponization.
How AI has fundamentally disrupted domain generation algorithm prediction, creating new blind spots for traditional threat intelligence.
Supply chain threat intelligence methodologies that identify compromised partners and assess contagion risks.
The evolution of command and control infrastructure from cleartext to encrypted communications and back.
"Low and slow" reconnaissance patterns that precede ransomware attacks, operating with months-long dormancy periods.
Strategies for communicating threat intelligence value to business stakeholders without creating defensive reactions from security teams.
The limitations of current AI applications in security, particularly around nuanced threat analysis requiring human experience and pattern recognition.
Board-level cybersecurity education requirements for organizations to survive sophisticated attacks in the next 5 years.
Innovation challenges in cybersecurity where rebranding existing solutions prevents breakthrough defensive capabilities.
Non-invasive threat hunting philosophies that deliver forensic-level detail without deploying endpoint agents.
Key Takeaways:
Monitor external DNS communications to identify command and control infrastructure before threat actors weaponize domains against your organization.
Assess supply chain partners through external threat intelligence lenses to identify compromised third parties that represent contagion risks.
Develop detection capabilities for "low and slow" reconnaissance campaigns that operate with extended dormancy periods between communications.
Implement AI as a noise reduction tool rather than a primary decision maker, maintaining human oversight for nuanced threat analysis.
Establish board-level cybersecurity expertise to ensure adequate understanding and support for advanced threat hunting investments.
Focus security innovation efforts on breakthrough capabilities rather than rebranding existing solutions with new acronyms.
Correlate external threat intelligence with internal security data to validate threats and reduce false positive rates.
Build threat hunting capabilities that can operate at machine speeds to handle increasing volumes of AI-generated attacks.
Create communication strategies that present external threat intelligence as validation tools rather than indictments of existing security programs.
Maintain expertise in DNS analysis and network fundamentals as core competencies, regardless of technological advances.
Listen to more episodes:
Apple
Spotify
YouTube
Website
32 min
August 28, 2025CyberHoot's Craig Taylor on Why Fear-Based Phishing Training Fails
Psychology beats punishment when building human firewalls. Craig Taylor, CEO & Co-founder of CyberHoot, brings 30 years of cybersecurity experience and a psychology background to challenge the industry's fear-based training approach. His methodology replaces "gotcha" phishing simulations with positive reinforcement systems that teach users to identify threats through skill-building rather than intimidation.
Craig also touches on how cybersecurity is only 25 years old compared to other fields, like medicine's centuries of development, leading to significant industry mistakes. NIST's 2003 password requirements, for example, were completely wrong and took 14 years to officially retract. Craig's multidisciplinary approach combines psychology with security practice, recognizing that the industry's single-focus mindset contributed to these fundamental errors that organizations are still correcting today.
Topics discussed:
Replacing fear-based phishing training with positive reinforcement systems that teach threat identification through skill-building.
Implementing seven-point email evaluation frameworks covering sender domain verification, emotional manipulation detection, and alternative communication verification protocols.
Developing 3- to 5-minute gamified training modules that reward correct threat identification across specific categories.
Correcting cybersecurity industry misconceptions through multidisciplinary approaches.
Evaluating emerging security technologies like passkeys through industry backing analysis.
Building human firewall capabilities through psychological understanding of manipulation tactics.
Implementing pause-and-verify protocols to confirm unusual requests that pass technical email verification checks.
Key Takeaways:
Replace punishment-based phishing simulations with positive reinforcement training that rewards users for correctly identifying threat indicators.
Implement gamified security training modules instead of lengthy video sessions to maintain user engagement.
Establish pause-and-verify protocols requiring alternative communication channels to confirm unusual requests that pass technical email verification checks.
Evaluate emerging security technologies by examining industry backing and major sponsor adoption before incorporating them into training programs.
Calibrate reward systems to provide minimal incentives (like monthly lunch gift cards) that drive engagement without creating external dependency.
Train users to identify the seven key phishing indicators: sender domain accuracy, suspicious subject lines, inappropriate greetings, poor grammar, external links, questionable attachments, and emotional urgency tactics.
Build internal locus of control in security training by focusing on skill mastery rather than fear-based compliance, ensuring users understand why security practices protect them personally.
Deploy fully automated security training systems that eliminate administrative overhead while maintaining month-to-month flexibility and offering discounts to educational and nonprofit organizations.
Listen to more episodes:
Apple
Spotify
YouTube
Website
33 min
August 21, 2025EP 27 — RMR Group's John Forester on Common Area Energy Waste Savings
When you mix a mechanical engineering background with sustainability leadership, you add a unique precision to your energy and environmental strategies. John Forester, VP of Energy & Sustainability at The RMR Group, brings just to his oversight across tens of billions in alternative real estate assets. His technical background allows him to identify performance inefficiencies that pure sustainability professionals often miss, creating measurable business value alongside environmental benefits.

Managing sustainability across office, medical, life science, industrial, and residential properties has taught John that successful programs require different stakeholder education at each project phase, not just template solutions. His approach prioritizes demonstrable business cases over environmental messaging, recognizing that cost-conscious property owners need clear financial justification before considering secondary societal benefits.

Topics discussed:
The myth that sustainability programs become self-sustaining after initial success, when each new project actually requires fresh stakeholder education.
How financial performance remains the primary driver of sustainability adoption, while secondary community and societal benefits are gaining recognition among forward-thinking organizations.
The importance of longer-term investment horizons in high-capital-cost environments, shifting from 3-5-year outlooks to 10-20-year planning cycles for maximum sustainability impact.
Data-driven approaches to multifamily common area optimization, using actual resident usage patterns rather than following standard amenity templates.
Location-dependent EV charging deployment strategies in multifamily properties, driven by visible demand from residents and prospective tenants seeking premium amenities.
Building automation system optimization through AI and machine learning applications that the established industry hasn't fully adopted, despite significant potential for performance improvements.
Geographic variations in ESG reporting requirements, with TCFD providing universal asset protection frameworks for current and future buyers.
The correlation between Energy Star scores, energy consumption per square foot, water usage metrics, and both occupancy rates and disposition values across nationwide portfolios.
Building performance standards as regulatory risk exposure, requiring proactive capital planning decisions during equipment replacement cycles rather than reactive compliance measures.
Technical inefficiencies in common area operations, particularly pool and fountain pumps running continuously for seasonally-used amenities, and HVAC systems operating in spaces with open doors.
The evolution toward common sustainability language integration across all business divisions within commercial real estate organizations, moving beyond siloed environmental departments.
21 min
August 21, 2025The Futurum Group's Fernando Montenegro on the OODA Loop Approach to Security Strategy
What happens when you apply economic principles like opportunity cost and comparative advantage to cybersecurity decision-making? Fernando Montenegro, VP & Practice Lead of Cybersecurity at The Futurum Group, demonstrates how viewing security through an economics lens reveals critical blind spots most practitioners miss. His approach transforms how organizations evaluate cloud migrations, measure program success, and allocate security resources.
Fernando also explains why cybersecurity has evolved from a technical discipline into a socioeconomic challenge affecting society at large. His three-part framework for AI implementation — understanding the technology, mapping business needs, and assessing threat environments — offers security leaders a structured approach to cutting through hype and making strategic decisions.
Topics discussed:
How security economics and opportunity cost analysis reshape cloud migration decisions and resource allocation strategies
The National Academies' 2025 "Cyber Hard Problems" report and its implications for cybersecurity's expanding societal impact
A three-part framework for AI implementation: technology comprehension, business alignment, and threat environment assessment
Why understanding organizational business operations eliminates the biggest blind spot in threat intelligence programs
Multi-layered professional networking strategies for separating signal from noise in threat intelligence analysis
How cloud environments fundamentally change threat intelligence workflows from IP-based to identity and architecture-focused approaches
Key Takeaways:
Apply economic opportunity cost analysis to security decisions by evaluating what you give up versus what you gain from each security investment.
Map your organization's business operations across marketing, sales, and product development to provide crucial context for technical threat intelligence.
Assess AI implementations through a three-part framework: technology limitations, business use cases, and specific threat considerations.
Measure security program success by evaluating alignment with organizational goals and influence on non-security business decisions.
Run intentional OODA loops on your security program to maintain strategic direction and continuous improvement.
Listen to more episodes:
Apple
Spotify
YouTube
Website
30 min
August 14, 2025EP 26 — Greystar's Chris Laughman on Why Education Alone Fails at Changing Resident Behavior
What happens when you discover that 100% of energy engineers agree on the single most impactful action residents can take, yet most properties still can't get people to use it? At Greystar, managing over one million units globally, it sparked a complete rethink of how multifamily operators approach resident behavior and energy performance.

Christopher Laughman, Senior Director of Energy & Sustainability, walks Sean through how community-based social marketing is replacing the industry's default education-first approach. Instead of assuming residents need more information, his team identifies and removes friction points that prevent sustainable behaviors from becoming default choices.

The breakthrough came from understanding that residents who want to use programmable thermostats aren't motivated by energy savings — they want comfort. This insight, combined with Greystar's Green Star benchmarking system that processes 2.5 million meter readings monthly, is reshaping how the company targets its performance improvement efforts across 3,200 properties.

Topics discussed:
Applying community-based social marketing (CBSM) to multifamily properties by identifying friction points rather than assuming education gaps drive poor resident engagement.
Creating Green Star benchmarking systems that compare individual property performance against peers in identical climate zones and building types to identify efficiency opportunities.
Processing 2.5 million monthly meter readings through proactive data quality control that scrubs for gaps, duplicates, and missing dates before pushing to asset managers.
Implementing the 25/25 performance rule by focusing improvement resources on bottom quartile performers rather than optimizing already efficient properties.
Building resident listening sessions that uncover actual motivations behind thermostat usage, like comfort control rather than energy savings assumptions.
Managing toilet flush valve retrofits that achieved 65% water bill reductions in student housing through proper equipment matching rather than universal solutions.
Understanding building performance standards evolution from passive benchmarking compliance to active energy management across 56+ jurisdictions.
Calculating Scope 3 emissions across 50,000+ suppliers where local contractors often lack their own emissions tracking capabilities.
Evaluating solar investment frameworks where virtual net metering policies shift payback periods from 13 years to 5 years in select markets.
Using bounded rationality theory to design resident engagement that accounts for limited time, information, and mental bandwidth rather than assuming rational decision-making.
39 min
August 14, 2025T. Rowe Price’s PJ Asghari’s "What, So What, Now What" Framework for Threat Intel
What does it take to transform a traditional event-driven SOC into an intelligence-driven operation that actually moves the needle? At T. Rowe Price, it meant abandoning the "spray and pray" approach to threat detection and building a systematic framework that prioritizes threats based on actual business risk rather than industry hype.
PJ Asghari, Team Lead for Cyber Threat Intelligence Team, walked David through their evolution from a one-person intel operation to a program that directly influences detection engineering, fraud prevention, and executive decision-making. His approach centers on the "what, so what, now what" framework for intelligence reporting — a simple but powerful structure that bridges the gap between technical analysis and business action.
Topics discussed:
Moving beyond event-based monitoring to prioritize threats based on sector-specific risk profiles and threat actor targeting patterns rather than generic threat feeds.
Focusing on financially-motivated actors, initial access brokers, and PII theft rather than nation-state activities that rarely target mid-tier financial firms directly.
Addressing the cross-functional challenge that spans HR, talent acquisition, insider threat, and CTI teams.
Using mise en place principles from culinary backgrounds to establish clear PIRs that align team focus with organizational needs.
Creating trackable deliverables through ticket systems, RFI responses, and cross-team support that translates intelligence work into measurable business impact.
Maintaining critical thinking and media literacy skills while leveraging automation for administrative tasks and threat feed processing.
Key Takeaways:
Implement the "what, so what, now what" reporting structure to ensure intelligence reaches appropriate audiences with clear business implications and recommended actions.
Build cross-functional relationships with fraud, insider threat, and vulnerability management teams to create measurable value through ticket creation and support requests rather than standalone reporting.
Establish sector-specific threat prioritization by mapping threat actors to your actual business model rather than following generic industry threat landscapes.
Create trackable metrics through service delivery, including RFI responses, expedited patching recommendations, and credential compromise notifications to demonstrate concrete value.
Focus hiring on inquisitive mindset and communication skills over certifications, using interviews to assess critical thinking and ability to dig deeper into investigations.
Map threat actor TTPs to MITRE framework to identify defense stack gaps and provide actionable detection engineering guidance rather than just IOC sharing.
Invest in dark web monitoring and external attack surface management for financial services to catch credential compromises and brand abuse before they impact customers.
Establish regular threat actor recalibration cycles to ensure prioritization remains aligned with current threat landscape rather than outdated assumptions.
Listen to more episodes:
Apple
Spotify
YouTube
Website
26 min
August 07, 2025EP 25 — Stoneweg's Thomas Stanchak on Testing Sustainability Upgrades with Real Residents
Thomas Stanchak, Managing Director of Sustainability at Stoneweg US, built their sustainability program from scratch using weekly animated videos to educate his team, proving that engagement comes before technology implementation. His education-first approach to transforming a $2+ billion multifamily portfolio focuses on economics over environmental messaging, recognizing that investment committees need financial evidence beyond "doing the right thing."

Thomas’ asset management background provides unique insight into precise leverage points for maximum impact. His systematic approach integrates sustainability across real estate investment cycles — timing initiatives around refinancing opportunities, acquisition due diligence, and disposition planning to amplify both financial returns and environmental outcomes. His framework treats multifamily properties as intimate environments where sustainability improvements must genuinely enhance quality of life rather than impose conservation sacrifices.

Topics discussed:
How asset management experience provides critical insight into sustainability program leverage points and implementation strategies rather than traditional corporate responsibility approaches.
The importance of economics-focused messaging over environmental virtue signaling when building investment committee confidence for long-term sustainability capital commitments.
Systematic integration of sustainability initiatives with real estate investment cycles, including acquisition planning, refinancing coordination, and disposition value optimization strategies.
Why multifamily properties offer unique advantages for environmental impact through homogeneous asset types, resident relationship intimacy, and scalable technology deployment approaches.
Data-driven approaches to achieving ambitious emissions reduction targets through focused building-level performance analysis rather than scattered technology implementations.
Resident engagement strategies that position sustainability improvements as quality of life enhancements rather than conservation-focused restrictions or behavior modification programs.
Solar technology adoption challenges in commercial real estate, including misconceptions about system operation, maintenance requirements, and performance monitoring capabilities.
The evolution of battery storage beyond traditional monolithic systems toward integrated appliance-level grid interaction and DC architecture possibilities.
ESG reporting landscape changes and why regulatory compliance should serve as a foundation rather than ceiling for sustainability program development.
Shadow metering and building management system investments as foundational infrastructure for proactive asset monitoring and risk mitigation strategies.
33 min

About Future of Threat Intelligence

From the publisher's feed

Welcome to the Future of Threat Intelligence podcast, where we explore the transformative shift from reactive detection to proactive threat management. Join us as we engage with top cybersecurity…

Share Future of Threat Intelligence

Sign up to save your podcasts

Future of Threat Intelligence

Future of Threat Intelligence episodes

About Future of Threat Intelligence

More shows like Future of Threat Intelligence

Risky Business

Risky Bulletin