Signals & Stories

For the final episode of this season of Signals & Stories, we’re going back to where the series began with Vertex Project co-founders visi and John “whippit” Rodgers.This time, we’re talking about Synapse itself: why it needed to exist, the intelligence problems it was built to solve, what ten years of working alongside analysts has taught us, and where intelligence analysis goes from here.We dig into why Synapse was designed as a central intelligence system rather than a traditional TIP, the cost of keeping intelligence trapped in reports and siloed tools, and what happens when analysts can turn their previous work into structured, reusable knowledge.We also look ahead at the role LLMs could play in transforming prose into structured data without replacing human analytical judgment, the growing overlap between CTI, fraud, trust & safety, and other intelligence disciplines, and what Synapse 3 represents after years of analyst feedback and lessons learned.In this episode:→ Why the traditional TIP model falls short of broader intelligence analysis→ How structured data allows analysts to build on previous knowledge instead of repeatedly reconstructing it→ Why Synapse intentionally isn’t a data provider, SIEM, or data lake→ The challenge of building a data model that provides structure without dictating the use case→ How analyst pain points have shaped Synapse features and workflows→ Why powerful intelligence tools sometimes come with a learning curve→ Where LLMs can — and shouldn’t — fit into intelligence analysis→ Why the future of intelligence may be increasingly interdisciplinary→ What Synapse 3 represents after a decade of building and learningAnd after 10 episodes reflecting on 10 years of The Vertex Project, whippit sums up the mission pretty simply: “We’re here to help.”Thanks for joining us for Signals & Stories.Learn more about The Vertex Project and Synapse: https://vertex.link/#ThreatIntelligence #CyberThreatIntelligence #IntelligenceAnalysis #Synapse #TheVertexProject

What happens when the people building intelligence software work side-by-side with the analysts actually using it?In the penultimate episode of our Signals & Stories 10-Year Anniversary series, Kali Fencl brings together both sides of the equation: Vertex analysts Jennifer Kolde (thesilence) and Mary Beth Lee (savage), alongside engineers William Gibb (epiphyte) and Mike Moritz (redox).Together, they dig into the relationship between analysts and developers including where their perspectives differ, what they've learned from each other, and how ten years of collaboration has helped shape Synapse.In this episode:🔹 Why analyst "edge cases" aren't always edge cases🔹 How better tooling gives analysts more time to actually analyze🔹 Why messy real-world data complicates software development🔹 How rapid feedback and frequent releases improve the platform🔹 Why good software design often goes unnoticed🔹 How Synapse power users increasingly bridge the gap between analyst and engineer🔹 The tradeoffs behind deciding what features actually get built🔹 How Synapse evolved from an early research project into the platform it is today🎧 Watch the full episode and explore the rest of the Signals & Stories series celebrating 10 years of The Vertex Project.Learn more: https://vertex.link/10-year-anniversary/#CyberThreatIntelligence #ThreatIntelligence #CyberSecurity #IntelligenceAnalysis #SoftwareEngineering #Synapse #VertexProject

How do you know when intelligence is actually trustworthy?In this episode of Signals & Stories, Kali is joined by Vertex co-founder visi stark and Vertex analysts, Jen Kolde (thesilence), Mary Beth Lee (savage), and Ryann Hallback (reign) to explore one of the most fundamental questions in cyber threat intelligence: What makes reporting trustworthy?The conversation starts with a seemingly simple distinction between accuracy and precision, but quickly expands into a broader discussion about analytical transparency, confidence, trust, public reporting, threat actor naming, AI-generated intelligence, and why good intelligence should help people make better decisions—not just present conclusions.Some of the topics we cover include:- Why accurate intelligence isn't always actionable- The difference between accuracy, precision, and trust- Why showing your methodology builds credibility- Confidence language and communicating uncertainty- The ongoing debate around threat actor naming conventions- Balancing timeliness with analytical rigor- Writing intelligence for different audiences- The impact of AI and LLM-generated reporting on trustWhether you're a threat intelligence analyst, SOC analyst, security leader, or simply interested in how cybersecurity reporting is produced and consumed, this episode offers practical insights into evaluating intelligence and producing reporting others can trust.Listen to the full 10-Year Anniversary Podcast Series:https://vertex.link/10-year-anniversary/Learn more about Vertex:https://vertex.linkFollow Vertex for more cyber threat intelligence research, podcasts, and educational content.

Every cyber threat intelligence analyst eventually encounters a few uncomfortable truths.In this episode of Signals & Stories, Kali sits down with Nicole Hoffman, Senior Threat Intelligence Analyst, creator of the Cognitive Stairways of Analysis framework, and author of the Threat Hunter Girl children's cybersecurity series, to discuss the ideas behind her viral "Hard Cyber Threat Intel Pills to Swallow" graphic.Together, they explore why the graphic resonated so deeply with the CTI community and unpack some of the profession's most enduring challenges: balancing threat research with enterprise intelligence, avoiding panic cycles, writing reports that actually influence decisions, and recognizing that more data doesn't always lead to better intelligence.Nicole also shares how her perspective has evolved over a decade in threat intelligence—from caring deeply about attribution to focusing on what truly matters for helping organizations assess and reduce risk. Along the way, she offers practical advice for new analysts, explains why tools can't replace analytical judgment, and discusses the communication skills that separate good intelligence from great intelligence.Topics covered:- The story behind the viral Hard Cyber Threat Intel Pills to Swallow graphic- Threat research vs. enterprise cyber threat intelligence- Why prioritization is one of the most important analyst skills- Escaping "panic cycles" during major cyber events- Why tools don't make better analysts- The role of attribution in intelligence reporting- Writing concise, actionable intelligence for decision-makers- Advice for analysts entering the CTI field🔗 Learn more about Nicole and her work: https://threathuntergirl.com🔗 Explore the full Signals & Stories limited series celebrating 10 years of The Vertex Project:https://vertex.link/10-year-anniversary/Learn more about The Vertex Project and Synapse: vertex.link#CyberThreatIntelligence #CTI #ThreatIntelligence #OSINT #Attribution #CyberSecurity #ThreatResearch #SignalsAndStories #TheVertexProject #SynapseJoin our community:SlackLinkedInTwitter/XBluesky

Even the most experienced cyber threat intelligence (CTI) analysts aren't immune to cognitive bias. In this episode of Signals & Stories, the team explores some of the most common analytical pitfalls that can quietly influence investigations and how strong analytical tradecraft helps avoid them.The conversation covers confirmation bias, premature threat attribution, and the dangers of forcing new activity to fit existing narratives. The team also examines today's intelligence "echo chamber," where repeated reporting can amplify assumptions without adding new evidence, making validation more important than ever.Along the way, the panel discusses why healthy analytical cultures encourage constructive disagreement, how mentorship and professional communities accelerate growth, and why curiosity remains one of the most valuable skills an analyst can develop.Whether you're new to cyber threat intelligence or have spent years in the field, this episode offers practical insights for improving analytical rigor, challenging assumptions, and producing intelligence that prioritizes evidence over ego.In this episode:• Recognizing and overcoming confirmation bias• Avoiding common threat attribution mistakes• Evaluating evidence without forcing connections• Building teams that embrace constructive debate• Why mentorship and continuous learning matter in CTITune in for a thoughtful discussion on what separates good intelligence from great intelligence and how better analytical habits lead to better decisions.Learn more about The Vertex Project and Synapse: vertex.link#CyberThreatIntelligence #CTI #ThreatIntelligence #OSINT #Attribution #CyberSecurity #ThreatResearch #SignalsAndStories #TheVertexProject #SynapseJoin our community:SlackLinkedInTwitter/XBluesky