Future of Threat Intelligence

Early cybercrime forums operated almost entirely in Russian, creating a barrier to entry that kept most analysts out. Amanda Lerner, Ph.D., Lead Cyber Threat Intelligence Analyst in financial services, broke through with a Yale PhD in Russian literature and the cultural fluency to decode dark web “Ringlish.”Amanda tells Eli how she went from investigating bitcoin mixing services at the Manhattan DA’s Cyber Intelligence Unit to leading CTI in the financial sector, and why LLMs lower the language barrier but cannot replace the cultural context real threat intelligence requires.Topics discussed:How Russian became the lingua franca of cybercrimeDecoding “Ringlish” slang on dark web criminal forumsFrom Yale Russian literature PhD to cyber threat intelligenceInvestigating bitcoin mixing services at the Manhattan DA’s OfficeWhy cultural context still outweighs LLM translation in CTICybercrime-as-a-service operations that mirror legitimate businessesEvaluating forum credibility through reputation and thread historyHow the shrinking Runet shapes adversary worldviewsKey Takeaways: Learn Russian or invest in native-speaking analysts to access cybercrime forums where cultural fluency reveals what translation alone misses.Study the history of CarderPlanet and early Odessa-based carding forums to understand how Russian became the default language of the cybercriminal underground.Recognize “Ringlish” as the true working language of cybercrime forums, a blend of Russian grammar with English technical terms that LLMs still struggle to parse accurately.Use LLMs as a starting point for translating forum content, but always layer in human cultural context to catch slang, sarcasm, and coded language.Treat cybercrime-as-a-service vendors like business competitors by mapping their offerings, pricing, reputation scores, and customer feedback across forums.Verify breach claims on forums by checking the poster’s account age, reputation score, transaction history, and thread responses before escalating internally.Monitor the shrinking Runet to understand how restricted information access shapes Russian-speaking threat actors’ worldviews and operational motivations.Apply academic research methods like source triangulation, fact-checking, and critical reading directly to threat intelligence analysis workflows.Spend dedicated time reading cybercrime forum threads end to end to build intuition for how threat actors communicate and operate.Trace cryptocurrency transactions back to dark web forum advertisements to connect financial flows with specific threat actor personas and campaigns.Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website

Over 60% of false positives trace back to vendor-provided detection rules. That finding, from a first-of-its-kind SANS report Alex Hurtado helped produce, captured why detection engineering has become its own discipline, one that treats rule management like a CI/CD pipeline.Alex, Head of Detection Strategy at Nebulock, breaks down how AI is reshaping the detection lifecycle, from query generation to self-healing alert tuning, and flags a critical blind spot where current logs cannot distinguish a legitimate AI agent action from a malicious one.Topics discussed:Treating detection rule management as a CI/CD pipelineVendor rules as the leading source of false positivesApplying AI to query generation and alert tuningDistinguishing AI slop from actionable threat researchChaining atomic detections across data sources for coverageClosing the visibility gap on AI agent telemetryOpen source tools for monitoring AI agent activityKey Takeaways:  Treat detection rule management like a CI/CD pipeline to keep pace with evolving environments and shifting attack surfaces.Audit vendor-provided detection rules first when investigating false positive volume, since they account for over 60% of false positives according to the SANS report.Apply AI to query generation and alert tuning so detection engineers spend less time writing SPL, SQL, or AQL and more time on coverage strategy.Chain atomic detections across multiple data sources and TTPs to build behavior-based alert narratives instead of relying on single-event rules.Curate threat intelligence sources manually before feeding them into AI workflows to filter out AI-generated slop masquerading as research.Evaluate open source AI agent telemetry projects like Perplexity's Numbat and Huntress contributor Anton Uvrotsky's A10 to start building visibility into agent activity.Map your detection backlog against both internal environment changes and external threat landscape shifts to prioritize what to build next.Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website

The euphoria around AI is over, and the flaws are showing up at a speed nobody imagined a year ago. Jim Almerico, CISO at Ironbridge CISO Consulting, tells Eli that organizations deploying AI without understanding how it operates are repeating the mistakes of the early internet and IoT eras.Jim shares lessons from securing PsiQuantum under a 90-day CMMC deadline for a $31 million DARPA contract, why identity access management is the foundation for governing AI agents, and how quantum computing is approaching its tipping point.Topics discussed:Why AI security mirrors early internet and IoT security failuresGoverning autonomous AI agents through identity access managementCompleting CMMC certification in 90 days for a DARPA contractHow open defender communication would strengthen collective securityPreparing encryption and certificates for post-quantum readinessSecuring MCP and API connections against unintended data exposureWhy blind trust in AI is the biggest organizational riskKey Takeaways: Require model cards and data flow documentation before deploying AI so security teams know exactly how a system operates before they protect it.Clean up identity access management for knowledge workers first, because AI agents will inherit every unresolved permission in the system.Build AI governance around containment controls, not checklists, since the organizations behind the most advanced AI could not contain their own products.Demand open communication between defender teams, treating shared intelligence as the biggest force multiplier in security.Start quantum readiness now by inventorying encryption and certificates, even though the quantum tipping point may be years away.Audit MCP and API connections for unintended data exposure before integrating AI tools across organizational boundaries.Approach AI adoption with the understanding that both benefits and harm are real, and resist blind trust in any tool your team cannot fully explain.Listen to More Episodes:  ⁠YouTube⁠  •  ⁠Apple⁠  •  ⁠Spotify⁠  •  ⁠Website⁠

In our latest episode of the Future of Threat Intelligence podcast, Mark Kreitzman, Chief Cyber Evangelist at Efani, shares how organized crime is scaling SIM swap attacks with AI, why most U.S. financial institutions still rely on SMS authentication, and how Efani's reversed MVNO model locks every carrier and phone store out of customer accounts.Mark knows these attacks firsthand. In 2017, an attacker ported his number for 61 minutes, stole his crypto, and ported it back to hide the attack. That experience drove him to help build a secure mobile service now protecting executives, crypto holders, and high-net-worth individuals with up to $5 million in insurance backing per customer.Topics discussed:How organized crime and AI are scaling SIM swap attacks from lone hackers to industrial operationsEfani's reversed MVNO model that locks carriers, phone stores, and support agents out of customer accountsWhy 80% of U.S. financial institutions still default to SMS authenticationThe Marks and Spencer breach that started with a middle manager's SIM swap and cost 350 million eurosHow every data breach feeds targeting data to SIM swap attackersKey Takeaways:Separate email accounts across personal, banking, and crypto to prevent a single compromised address from exposing multiple accounts.Replace SMS-based authentication with authenticator apps and hardware keys wherever your financial institutions allow it.Audit which services are tied to your mobile number and remove phone-based recovery from high-value accounts.Assume your personal data is already exposed from past breaches and layer your defenses accordingly.Evaluate your mobile carrier's security model, because the default carrier setup prioritizes convenience over account protection.Monitor unexpected password reset texts or authentication codes as potential reconnaissance by attackers testing your accounts.Protect executive and leadership phone numbers as enterprise attack surfaces, not just personal devices.Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website

Resource constraints, not attacker sophistication, are the biggest cyber threat facing state and local governments, and AI is widening the gap by making low-skill attackers faster and more convincing. In our latest episode of the Future of Threat Intelligence podcast, Randy Rose, VP of Security Operations and Intelligence, Center for Internet Security, shared how community defense, essential controls, and human verification hold the line as phishing and deepfake threat intelligence evolve.Topics discussed:Why resource constraints are the number one cybersecurity challenge for state and local governmentsHow AI makes low-skill attackers faster while ransomware and phishing stay the top threatsMapping CIS Implementation Group 1 controls to top MITRE ATT&CK techniques to reduce riskWhy traditional phishing training is obsolete after AI-written phishing and deepfake attacksHow community defense turns one organization's attack into protection for thousandsKey Takeaways:Prioritize an essential set of controls, starting with CIS Implementation Group 1, to buy down the most risk against top threats like ransomware.Map your controls to the top MITRE ATT&CK techniques so you know which defenses deliver the greatest impact.Retire phishing training built on spotting typos and odd phrasing, and train people for general skepticism instead.Build proactive verification, such as two-person integrity, before trusting an email, phone call, or video feed.Inventory access alongside hardware and software, tracking who and what has access to what, including AI and agent tools.Maintain and exercise an updated incident response plan, and know exactly who to call in each scenario.Use AI for data translation, correlation, and enrichment at scale, and reserve creative thinking and context for people.Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website