Intelligence Tradecraft - Sharpen your analytic edge

What makes intelligence trustworthy enough to act on, and how easily is that trust lost? In this episode, host Freddy Murre sits down with Bart van den Berg, who leads the security unit at the Clingendael Institute in the Netherlands, to discuss critical thinking in a crisis, the tradecraft behind credible analysis, and where LLMs fit without eroding trust. Bart’s path into intelligence runs from an economics and business degree with a master’s in the Chinese economy, through six years as an infantry officer and several as a trainer, to lead analyst at the Dutch National Cybersecurity Center. He describes the culture shock of leaving a rigid, procedure-driven military for open-ended civilian work, a shift also Freddy knows from his move from government intelligence into private sector finance.Cyber threat intelligence changes when it collides with geopolitics. The Log4j crisis and Russia’s invasion of Ukraine pushed Bart toward strategic questions from decision makers, while undersea cable incidents and DDoS claims triggered waves of reporting without a real rise in incidents. Drone sightings and the vague label of hybrid warfare showed how easily speculation fills the gap when facts are missing. Trustworthy intelligence, Bart argues, comes down to tradecraft: rigor, speed, sourcing and tailoring to a decision maker. That separates intelligence from opinion, and he explains why he ranks attitude and skills above knowledge when training analysts. AI tests that standard: Bart recalls an LLM handing him fabricated quotes, explains why that threatens an analyst’s reputation. He also shares where LLMs help, from proofreading to challenging his own arguments, but argues that responsibility must stay with humans and that analysts have to prove their added value on top of AI. Whether you are training analysts, briefing decision makers, or deciding how far to trust AI, Bart’s experience shows that credibility is built on rigor and sourcing and lost on one unchecked claim.RESOURCESClingendael Institute - https://www.clingendael.org/ NCSC-NL - https://www.ncsc.nl/en NCSC-UK - https://www.ncsc.gov.uk/information/log4j-vulnerability-what-everyone-needs-to-know NCSC-NL GitHub - https://github.com/NCSC-NL/log4shell Causes for undersea cable disruptions - https://joint-research-centre.ec.europa.eu/jrc-explains/subsea-cables-how-vulnerable-are-they-and-can-we-protect-them_en Sweden closes sabotage probe - https://www.sverigesradio.se/artikel/sweden-closes-sabotage-probe-into-damaged-baltic-sea-cable Drones at Copenhagen Airport in 2025 - https://www.reuters.com/world/danish-police-find-no-proof-drones-caused-copenhagen-airport-shutdown-2026-06-25/ Freddy asks, When does something become intel - https://www.linkedin.com/posts/fmurre_in-your-opinion-when-does-something-go-from-share-7180879793012285441-NK8V/ Grammarly - https://www.grammarly.com/ CHAPTERS00:00 Career Journey Into Intelligence04:00 From Military To Think Tank07:26 Trainer Years And Russian Influence10:47 Cyber Intelligence Meets Geopolitics14:40 Incident Hype And Hybrid Warfare24:27 Separating Signal From Noise28:59 Leaving The NCC For Clingendael31:13 Military Training And Analytical Foundations36:04 Training And Skill Development47:06 Intelligence Inside Government52:21 Defining Good Versus Bad Intelligence58:44 AI Limits And Hallucinations1:08:09 Where AI Belongs In Analysis1:12:16 AI's Future And Human Responsibility1:20:08 Why Analysts Still Matter

What separates good intelligence from noise, and why do so many organizations struggle to act on it? In this episode, host Freddy Murre sits down with Ondra Rojčík, an IBM security consultant with over 15 years in Czech government intelligence, to discuss tradecraft, stakeholders, and how AI fits into the intelligence cycle.Ondra explains why he stepped back from management to return to hands-on analysis, and reflects on what struck him about transitioning from a 250-person agency to a global tech giant. He also describes arriving at NATO and realizing how much basic tradecraft he lacked. That realization later inspired him to build a university course on intelligence analysis.Freddy and Ondra debate where information ends and intelligence begins. For Ondra, good intelligence answers the "so what" for a specific organization. Most public threat reports fail because they lack this tailoring. He walks through how his team built its own process for priority intelligence requirements, while being candid about executives unready to act, the public sector's superior training budgets, and the difficulty of measuring impact.They also weigh in on AI: LLMs excel at narrow tasks like summarization, but framework-mapping tests that looked promising on small samples fell apart at scale. Furthermore, stakeholders cannot simply rely on LLMs because they often do not know which questions to ask. Spotting unlisted threats remains the analyst's job. Meanwhile, adversaries use LLMs for speed and scale, raising the question: do more attempts mean more successful attacks?Whether you are maturing a CTI function, trying to influence leadership, or integrating LLMs, Ondra's experience proves that good tradecraft is only half the job; the other half is reaching people ready to act.RESOURCESIBM Acquisition of Red Hat - https://www.ibm.com/investor/news/ibm-completes-acquisition-of-red-hat Czech National Cyber Security Agency - https://nukib.gov.cz/en/ Pherson SAT Book - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/ Intelligence training with Freddy - https://inteltradecraft.com/sat-certifications Pherson & Heuer SAT Book - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/ Ondra's Medium profile - https://medium.com/@orojcik FIRST CTI 2026 - https://www.first.org/conference/firstcti26/ Ondra PIRs at SANS - https://www.sans.org/blog/bridging-gaps-cti-practical-guide-threat-informed-security-pirs CHAPTERS00:00 Ondra's Path Into Intelligence04:08 Leaving Government for Industry06:32 Government vs Private Sector Culture09:10 Learning Tradecraft the Hard Way12:58 Teaching and Practicing Tradecraft20:41 What Counts as Intelligence25:28 Sharing Knowledge and Building PIRs30:20 Intelligence Culture in Industry33:46 Maturing a CTI Team37:17 Training Budgets and Follow-Through42:00 Measuring the Value of Intelligence46:04 How Analysts Use AI Today49:13 AI's Future in CTI57:30 Adversaries, AI and Attack Success1:04:25 People Who Opened Doors

What does it take to build and run a cyber threat intelligence function, and how can you tell whether the intelligence you’re producing is any good? In this episode, host Freddy Murre sits down with Sherman Chu, who at the time of the interview worked at BlackRock, for a conversation about lessons learned on the job, tradecraft and AI.Sherman recounts his path from Army intelligence support through grad school and a vendor role at Flashpoint, then to end-user teams in financial services, building New York City’s CTI program from the ground up, and a stint at Deloitte. He explains what changes when you move from serving a broad customer base to serving specific stakeholders, and why end-user teams must also collect internally. Freddy and Sherman cover team-building: finding buy-in, keeping collection minimal, justifying budgets, evaluating vendors, and why training so often fails to change how a team works. Sherman shares the courses and books he considers foundational, including The Diamond Model of Intrusion Analysis and Heuer’s Psychology of Intelligence Analysis.A key question that comes up is what separates intelligence from data and information. Sherman offers his own definition, then breaks down what bad intelligence looks like, from marketing dressed up as analysis to context-free indicator sharing. He also explains how inconsistent terminology holds the field back. Over the last couple of years, Sherman’s view of AI has shifted from early skepticism to cautious adoption. He shares how he pairs deterministic code with LLMs to extract adversary procedures from reports, where models still hallucinate, and why analysis remains the hardest step to automate.Their advice for newcomers is to stay curious, build a pet project, and stay humble. If you lead a CTI team, want to join one, or are weighing where AI belongs in your workflow, this episode is well worth your time. RESOURCESFlashpoint - https://flashpoint.io/ Columbia University MA program - https://www.sipa.columbia.edu/sipa-education/masters-programs/concentrations/international-security-and-diplomacy SANS FOR578 CTI -https://www.sans.org/cyber-security-courses/cyber-threat-intelligence Sergio's course "Diamond Model of Intrusion Analysis" -https://school.threatintel.academy/courses/diamond/ Joe Slowik's Training - https://paralus.co/training/ Pherson's Structured Analytic Techniques (SAT) - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/ Richards J. Heuer, Jr. The Psychology of Intelligence Analysis -https://www.ialeia.org/docs/Psychology_of_Intelligence_Analysis.pdf Scott J. Roberts & Rebekah Brown's book "Intelligence-Driven Incident Response - https://www.amazon.com/Intelligence-Driven-Incident-Response-Outwitting-Adversary/dp/109812068X/ VISMA and APT Attribution discussion - https://therecord.media/norway-says-chinese-group-apt31-is-behind-catastrophic-2018-government-hackCHAPTERS00:00 Introduction and Career Overview02:09 From Army Intelligence to Academia06:05 Vendor Versus End User Intelligence13:54 Building a Government CTI Program17:17 Training, Certifications, and Key Books25:14 Building a CTI Function37:46 Budgets, Tools, and Training Value47:28 What Counts as Intelligence52:49 What Makes Intelligence Bad01:00:06 Shared Language and Industry Maturity01:07:38 AI Across the Intel Cycle01:13:13 Hybrid LLM and Code Workflows01:16:22 AI Limits, Risks, and Democratization01:22:44 Traits for Aspiring Analysts01:25:01 Neurodivergence and Staying Humble

Jan Henrik Schou Straumsheim, a partner in PwC's cyber advisory practice, sits down with host Freddy Murre to talk about the real work behind cyber threat intelligence. His interest in the field traces back to getting his hands on his father's old 386 computer and a book his mother gave him on the history of codes, and later took shape during years as a reserve infantry officer in Norway's armed forces, where he trained at the Defense Intelligence School and eventually became his unit's intelligence officer (S-2). From there, his career moved through a summer internship at Accenture, a part-time job in the security operations center at mnemonic, a pivot into consulting, and almost a decade now at PwC.The conversation explores what actually separates CTI from cybersecurity, and why so much of what gets sold as intelligence is really just unfiltered data dumps. Jan Henrik and Freddy debate how analysts should weigh sources, including the tricky question of trusting personas on dark web forums, then turn to how private-sector teams train and retain analytical skill, and why Nordic organizations still lag in treating CTI as more than a detection add-on. Jan Henrik shares a real client case, where a board commissioned a foresight report on AI risk, showing what it looks like when CTI actually reaches the boardroom.The conversation then shifts to AI's role in intelligence work: how Jan Henrik uses large language models every day, why he still insists on a human checking every output before his name goes on it, and where the line sits between AI as a sparring partner and AI replacing analytical judgment altogether. They close on a reminder that opportunity often comes from someone else opening a door, and why passing that on matters.This episode with Jan Henrik is a grounded, occasionally blunt conversation about what good intelligence work actually requires, well worth a listen for anyone trying to make CTI matter to the business it's meant to serve.RESOURCESsimon singh the code book - https://www.amazon.com/dp/0385495323 Mnemonic Internships - https://www.mnemonic.io/no/careers/internships/Hatlebrekke The Problem of Secret Intelligence - https://www.amazon.com/dp/0748691839Freddy's SANS CTI Summit presentationFrom Gut to Gold Standard: The Admiralty System in CTI - https://youtu.be/y-CSDxMMXb0?t=5Freddy's SANS posts on Admiralty Scale - https://www.sans.org/profiles/freddy-murstad#resources SANS Cybercrime Investigations - https://www.sans.org/cyber-security-courses/cybercrime-investigations Washington D.C. police gaming crime statistics - https://www.washingtonpost.com/dc-md-va/2026/05/08/dc-police-crime-statistics-internal-investigation-findings/ Research article Non-Determinism of “Deterministic” LLM System Settings in Hosted Environments - https://aclanthology.org/2025.eval4nlp-1.12/Research article Cognitive offloading, critical thinking and attitudes towards artificial intelligence https://pubmed.ncbi.nlm.nih.gov/42377671/Freddy's LinkedIn Profile -https://www.linkedin.com/in/fmurre/ CHAPTERS0:00 Early path into cybersecurity2:12 From mnemonic's SOC to PwC8:27 Building PwC's global CTI arm10:38 CTI versus cybersecurity defined11:45 Military intelligence background18:40 What actually counts as intelligence20:05 Separating good intel from bad26:19 Training and upskilling analysts32:57 CTI maturity across the Nordics41:20 Linking CTI to enterprise risk50:28 Building a successful CTI function56:30 Measuring CTI's real value1:03:12 AI's rapid rise in CTI1:14:51 AI risks and human oversight1:26:01 Career-defining opportunities and mentorship

In this episode of Intelligence Tradecraft, host Freddy Murre sits down with Rebecca Ford, a cyber threat intelligence analyst who started out on the government side with Army Cyber and DISA, focused heavily on North Korea and the Asia-Pacific region. From there, she moved into the private sector, where she's spent the better part of a decade helping grow a CTI function from an early-stage team into something far more mature.Rebecca traces her path into the field: an overheard conversation about true-crime shows that led an Army analyst to recruit her, on-the-job training in an era before cyber threat intelligence even had a name, and the 2014 Sony hack as the moment the discipline truly landed on the map. She and Freddy explore what separates useful intelligence from what she calls being reduced to "news reporters with a microphone." The difference lies in handing stakeholders a raw threat feed versus giving them analysis that actually drives a decision. Rebecca shares her working definition of intelligence, built around an adversary's intent, opportunity, and capability. They also get into the two very different audiences an analyst serves, senior leadership and network defenders, and why treating report counts as a success metric misses the point entirely. The conversation covers building real relationships with stakeholders, the argument for "fusion centers" that merge cyber, physical, travel, and financial-crime intelligence, and the considerable value of community and mentorship in a field where, as Rebecca puts it, your next opportunity usually comes from someone who already knows you.A large part of the discussion is about AI: where it genuinely speeds up research and helps an analyst get started, why Rebecca still verifies everything by hand before it goes out, and why she believes human judgment should stay in charge of the final call.Rebecca ends with a reminder that showing up and investing in the community, whether at conferences, in focus groups, or at vendor events, is part of the job for anyone hoping to build a career in the field. RESOURCESSony Hack - https://www.bbc.com/news/world-asia-30573040Gert Jan's Metrics - https://github.com/gertjanbruggink/metrics SANS CTI Summit 2026 Visual Summary - https://www.sans.org/blog/visual-summary-sans-cti-summit-2026 Rebecca's LinkedIn - https://www.linkedin.com/in/rebeccaford/ Freddy's Intelligence Architecture Mind Map - https://github.com/Errum/IntelArchitectureMapReuters IKEA bets on remote interior design as AI changes sales strategy - https://www.reuters.com/technology/ikea-bets-remote-interior-design-ai-changes-sales-strategy-2023-06-13/ CHAPTERS00:00 Welcome & Rebecca's Background00:57 Breaking Into Cyber Threat Intel02:58 Learning Cyber Intel From Scratch04:30 The Sony Hack Turning Point06:53 From Army Cyber to DISA09:32 Adjusting to the Private Sector12:29 Defining Intelligence and Stakeholders15:16 Proving Value and Building Community23:14 Good Intelligence vs. Bad Intelligence26:20 Mentorship and Learning From Mistakes34:01 Team Diversity and Fusion Centers40:25 Misconceptions and Measuring Impact47:00 Communicating With Stakeholders55:07 Where AI Fits in Intel1:13:15 Mentors, Advice & Closing Thoughts

In this episode of Intelligence Tradecraft, host Freddy Murre talks with Rebekah Brown, senior researcher at the University of Toronto's Citizen Lab, about what it actually takes to do intelligence work well, in government and in the private sector. Rebekah's background spans the field: she started as a Marine Corps cryptologic linguist and NSA analyst, later led threat intelligence at Nike, and worked the vendor side at Rapid7. Today, she co-authors the SANS FOR578 course and has co-written an incident response book with Scott Roberts. The conversation traces how a clerical error sent her through Mandarin Chinese training instead of Korean, why private-sector CTI teams so often import government habits that don't fit the business they're protecting, and why translating between technical teams and leadership is often the real job description. They spend real time on definitions: what separates intelligence from reporting, what makes intelligence good or bad, and why so much of what gets labeled cyber threat intelligence in the private sector is really just collected information without analysis behind it. Rebekah and Freddy also trade stories about the growing pains of building a threat intelligence function inside a business that doesn't think in nation-state terms, and what it actually takes to make expensive training change how a team works day to day. When it comes to AI, Rebekah explains where she believes LLMs can genuinely support brainstorming, coding, and research tasks, and where she draws a hard line at analysis itself. The two also debate how AI might reshape the size and shape of intelligence teams in the years ahead. It's a grounded, experience-driven conversation for analysts, team leads, and anyone trying to prove the value of intelligence inside their organization. RECOURCES The Marine Corps Logo - https://www.war.gov/Multimedia/Photos/igphoto/2001789719/ Defense Language Institute Foreign Language Center - https://www.dliflc.edu/ University of Toronto Citizen Lab - https://citizenlab.ca/ The Cuckoo's Egg - https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espionage/dp/1668048167/ Ghost Net Report - https://citizenlab.ca/research/tracking-ghostnet-investigating-a-cyber-espionage-network/ Intelligence-Driven Incident Response - https://www.amazon.com/Intelligence-Driven-Incident-Response-Outwitting-Adversary/dp/109812068X/ Scott Roberts LinkedIn - https://www.linkedin.com/in/scottroberts/ SANS FOR578 - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence Rob M Lee LinkedIn - https://www.linkedin.com/in/robmichaellee/CHAPTERS00:00 Welcome and introductions 0:37 High school to the Marines 1:22 Becoming a Marine linguist 3:56 A lucky mix-up at NSA 5:45 Early training and mentors 9:44 What is intelligence? 14:17 Good intelligence versus bad 16:32 Leading and teaching Marines 20:37 Injury ends a military career 25:12 Standing up Nike's threat intel 31:28 Rapid7 and the CTI boom 38:19 Bridging techies and leadership 45:01 Writing the book and course 58:15 Measuring intelligence's real value 1:02:27 Where AI fits in intel

Staff Threat Intelligence Advisor Josh Darby MacLellan at Feedly kicks off season three by unpacking his path into CTI, what separates intelligence that gets used from intelligence that gets ignored, and why core skills like stakeholder communication may outlast technical specialties as AI reshapes the field. Josh started his career with childhood dreams of becoming a criminal lawyer, shifted through academic study of international relations and security, and unfolded into more than a decade of private-sector threat intelligence work across Canada, the US, and multiple specialties within CTI. Josh is blunt about where the field falls short. Good intelligence is connected to a decision and a decision-maker, versus reports written for other analysts that never get read. Josh and Freddy discuss team structure, and why CTI teams that skew small and heavily technical tend to miss the core skills of stakeholder conversation that keep a function relevant when budgets tighten. Josh argues communication is a trainable skill, the same way he trained himself to become a clearer public speaker despite two speech impediments and years of mumbling through bombed public talks.As for AI, Josh draws a clear line between what he'll delegate and what he won't. He uses LLMs for collection support, editing, and even as a stand-in second analyst to catch his own blind spots, but he won't hand over the analysis stage. Trusting an unreviewed AI process, he argues, is a bit like citing a source you've never actually read. Freddy pushes back with his own testing of LLMs on structured analytic techniques, and the two get into what's actually lost when a black box quietly decides what information matters.RESOURCES NATO Intelligence Cycle - https://ac.nato.int/resources/uploads/2284/picture2-intel-8Wgsa2.png Freddy's Intelligence Architecture Mind Map - https://github.com/Errum/IntelArchitectureMap/files/14615837/240315.-.Intelligence.Architecture.v0.7.42.pdfGert Jan's Measuring value of CTI - https://github.com/gertjanbruggink/metrics Feedly - https://feedly.com/ Intel471's CU-GIRH - https://github.com/intel471/CU-GIR Sherman Chu's Tyranny of Current Intelligence - https://www.youtube.com/watch?v=IETRHdMejaw Sherman's slides - https://www.sans.org/presentations/were-in-now-now-the-tyranny-of-current-intelligence-and-how-to-manage-itIntel Tradecraft Courses and Trainings - https://inteltradecraft.com/sat-certifications IRM Workshop - https://www.intel471.com/lp/building-an-intel-workshop SANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence Josh Darby's SANS presentation "Can We Forecast Our Own Fate" - https://www.youtube.com/watch?v=B9TkeUbD1Mk Josh's slide deck - https://www.sans.org/presentations/can-we-forecast-our-own-fate-mapping-the-future-of-the-cti-industry-with-satsFeedly CTI Essentials - https://feedly.com/ti-essentialsWebinar: What CTI practitioners recommend you focus on in 2026 - https://feedly.com/ti-essentials/posts/what-cti-practitioners-recommend-you-focus-on-in-2026Freddy and Josh Think smarter, not harder: Making SATs work in CTI - https://feedly.com/ti-essentials/posts/think-smarter-not-harder-making-sats-work-in-ctiFeedly AI - https://feedly.com/ai MLitt in Terrorism Studies - https://www.st-andrews.ac.uk/subjects/international-relations/terrorism-mlitt/CHAPTERS0:00 Intro and Welcome1:01 Josh's Path Into CTI4:04 CTI Maturity Across Countries8:08 Pivot to Protective Intelligence12:12 Defining Intelligence and CTI13:13 Good vs Bad Intelligence16:16 The Intelligence Cycle23:23 Engaging Stakeholders Directly26:26 Core Skills and Job Security33:33 Training and Certifications40:40 Building Well-Rounded Teams43:43 Mentoring and Giving Back49:49 AI's Role in the Cycle58:58 How Josh Uses AI1:05:05 People Who Shaped His Career

If you've ever read a text or sat in a briefing and quietly wondered what actually separates this "intelligence" from someone's hot take on LinkedIn, a journalist with a deadline, an analyst with a search bar, or an AI, this episode is for you.The host, Freddy Murre, sits down with Arno Reuser, the man who founded the Dutch Defence Intelligence Service's open-source intelligence (OSINT) capability in the early 1990s, before most of Europe had a word for it. What follows is less an interview than a working argument about how OSINT should actually be done, and where the field has gone soft.Arno doesn't mince words. He'll tell you the "information explosion" everyone complains about is just proof you skipped your stakeholder and requirement analysis. That most of what gets sold as OSINT is the word "OSINT" stapled to “everything”, such as tools. That he has, by deliberate choice, never written an analytical judgment in his life, and why that line between collection and analysis matters more than people think. For anyone who's argued about what counts as OSINT versus PAI (Publicly Available Information), or where collection ends and all-source begins, this is the debate you want to engage with.Along the way: the librarian's discipline, he says, underpins all good intelligence work, the collection plan he calls "worth gold," the classroom trick thousands of students have failed, and a run of war stories from his teachings, such as a prison break by email to a deepfake that fooled cyber experts who personally know him.The back half takes on two problems every practitioner is living with right now. How do you put a value on intelligence when the same report is priceless to one decision-maker and useless to the next? And what is AI actually good for? Arno uses LLMs daily and is genuinely amazed by them, but only for things he can verify. He and Freddy get specific on hallucinations, sycophancy, model collapse, and the difference between a real summary and a machine that just shortens the text and deletes the one sentence that mattered.RESOURCESMaersk Website - https://investor.maersk.com/news-releases/news-release-details/cyber-attack-update Dutch Police Data Breach - https://www.politie.nl/nieuws/2024/oktober/2/update-over-datalek-politie.html When does something go from a Google answer to Intelligence - https://www.linkedin.com/posts/fmurre_in-your-opinion-when-does-something-go-from-activity-7181221399561203712-mV-m/ LexisNexis Library - https://www.lexisnexis.com/en-us/products/digital-library.page Vague questions in OSINT - https://opensourceintelligence.biz/vague-osint-questions/ Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications Pherson Structured Analytic Techniques for Intelligence Analysis - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/Routledge Handbook of Terrorism Research - https://www.routledge.com/The-Routledge-Handbook-of-Terrorism-Research/Schmid/p/book/9780415520997 AI Model Collapse - https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=AI+model+collapse&btnG= CHAPTERS00:00 From literature searcher to founding military OSINT04:00 Becoming a librarian: the Kampen archive moment08:00 Where OSINT stops and intelligence begins11:00 Why "cyber" keeps getting OSINT wrong15:00 What actually makes something "intelligence"?24:00 The information explosion myth32:00 The classroom trick: think before you type36:00 The collection plan that's "worth gold"42:00 The human factor cyber keeps ignoring45:00 War stories: validation and getting fooled51:00 Learning the craft: sources, sources, sources55:00 Customers ask for what they think you can do01:08:00 Can you measure the value of intelligence?01:11:00 AI and LLMs: amazed but skeptical01:32:00 Deepfakes, the NATO photo & "how likely is it?"

SUMMARYFormer military intelligence analyst turned consultancy director Martijn Docters van Leeuwen joins Freddy Murre to unpack what cyber threat intelligence really is, and why so many teams "talk the talk" without "walking the walk", i.e. doing the work. Martijn Docters van Leeuwen has done the whole journey, infantry, military intelligence, stopping ATM skimming and gas attacks in the Netherlands, to building a bank's first CTI team, and now being a cybersecurity consultant.So when he talks about CTI being a tradecraft and not a report that magically lands in your inbox, he's not theorizing. He's been the only analyst in the room wearing all seven hats, the guy getting asked "why does this cost so much?", the one trying to prove value in the six quiet months when nothing's on fire.We get into the stuff analysts actually argue about: why most teams are great at talking the talk and bad at doing it, the trap of living in your own little football field while the business has no idea what you do, how people game their own metrics to manufacture a crisis, and where AI genuinely helps versus where it's just a confident liar with no fingers. Threat vs. risk, mirror imaging, incident-driven vs. intel-driven, and the brutal truth that training does nothing if you walk out the door and never apply it.If you do this work, or you're trying to convince someone it's worth doing, pour a coffee and settle in.RESOURCESStructured Analytic Techniques (SAT) Certification Training by Intel Tradecraft and Pherson - https://inteltradecraft.com/sat-certificationsIntelligence Mind Map - https://github.com/Errum/IntelArchitectureMapWhen does something go from a Google answer to Intelligence - https://www.linkedin.com/posts/fmurre_in-your-opinion-when-does-something-go-from-activity-7181221399561203712-mV-m/Mitre Att@ck - https://attack.mitre.org/resources/attack-data-and-tools/Mark Arena - CTI: Comparing the incident-centric and actor-centric approaches - https://medium.com/@markarenaau/cyber-threat-intelligence-comparing-the-incident-centric-and-actor-centric-approaches-f20cfba2dea2ASML The world's supplier to the semiconductor industry - https://www.asml.com/enSANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence TIBER European Central Bank - https://www.ecb.europa.eu/paym/cyber-resilience/tiber-eu/html/index.en.htmlFreddy's resources on SANS - https://www.sans.org/profiles/freddy-murstad#resources The intelligence cycle - https://github.com/Errum/IntelArchitectureMapBasic cyber-hygiene guidance from CISA - https://www.cisa.gov/topics/cybersecurity-best-practicesNSM ICT Security Principles - https://nsm.no/advice-and-guidance/publications/nsm-ict-security-principlesSANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligenceObsidian (note-linking/mind-mapping for research) - https://obsidian.md/CTI-CMM - https://cti-cmm.org/CREST - https://www.crest-approved.org/Google Notebook LM - https://notebooklm.google/Intelligence minor, Leiden University - https://www.universiteitleiden.nl/en/education/minors/minor/fgga-minor-intelligence-studiesHeuer & Pherson Structured Analytic Techniques for Intelligence Analysis - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/CHAPTERS00:00 Introduction & from military intel to CTI08:30 Building a bank's first CTI team15:00 What is intelligence — and what is CTI?26:00 Talking the talk vs. doing the work35:00 Incident-driven vs. intelligence-driven CTI46:00 Tradecraft, methodology & pricing CTI work53:00 Collection, analysis & tailoring reports01:04:00 Mirror imaging & understanding threat actors01:08:00 Measuring the value of a CTI program01:19:00 Threat vs. risk: capability, intent & opportunity01:24:00 Training intel skills & making it stick01:36:00 Can AI help us do intelligence better?

In this episode of Intelligence Tradecraft, host Freddy Murre sits down with Joe Slowik, a threat intelligence veteran whose career spans the US Navy, Los Alamos National Laboratory, MITRE, and the vendor world (Dragos, DomainTools, Gigamon, Huntress, and now DataMinr).In the conversation, Joe makes the case that intelligence is fundamentally about decision support, not raw data feeds or research written for other analysts. He and Freddy dig into what separates good reporting from bad, why stakeholder alignment and rigor (ICD 203, clear separation of fact vs. assessment) matter, and when a "flash report" beats a polished deep-dive.They also tackle the attribution debate — how-centric vs. who-centric attribution, the mess of overlapping naming schemas (APT10 vs. APT31, the Visma case), and why "trust us, we're Microsoft" isn't tradecraft. Joe explains the thinking behind his Applied Threat Intelligence training and the gap it was built to fill.The back half turns to AI: where LLMs genuinely help (research, scripting), where they're dangerous (cognitive offloading, model decay, drying up the junior-to-senior pipeline), who's accountable for AI-generated output, and how threat actors are using these tools, from better phishing to voice cloning. Joe's bottom line for newcomers: critical thinking, communication, and curiosity come before any prompt-engineering skill.ResourcesJoe Slowik's LinkedIn - https://www.linkedin.com/in/joe-slowik/Joe Slowik's Blog and Courses - https://paralus.co/Freddy' Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications Los Alamos National Laboratory - https://www.lanl.gov/ NIST Cyber Threat Intelligence definition - https://csrc.nist.gov/glossary/term/cyber_threat_intelligenceCTI used in books (Google Search) - https://books.google.com APT 1 Report - https://services.google.com/fh/files/misc/mandiant-apt1-report.pdf Moonligh Maze on Wikipedia - https://en.wikipedia.org/wiki/Moonlight_MazeSANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence ICD 203 - https://www.dni.gov/files/documents/ICD/ICD-203.pdfMLitt in Terrorism and Political Violence - https://cstpv.wp.st-andrews.ac.uk/masters-in-terrorism-and-political-violence/ Routledge Handbook of Terrorism Research - https://www.routledge.com/The-Routledge-Handbook-of-Terrorism-Research/Schmid/p/book/9780415520997 APT Groups and Operations Rosetta Stone (not mine) - https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/edit?pli=1&gid=1864660085#gid=1864660085 Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications Tradecraft Primer: SATs - https://www.cia.gov/resources/csi/static/Tradecraft-Primer-apr09.pdf An Illustrated Book of Bad Arguments - https://bookofbadarguments.com/ Weston's Rulebook for Arguments - https://hackettpublishing.com/philosophy/logic-mathematics/critical-thinking/a-rulebook-for-arguments-group Joe's Critique of Practical Threat Intelligence - https://pylos.co/2026/05/03/a-brief-critique-of-practical-threat-intelligence/ Cognitive Offloading - https://sistemasi.ftik.unisi.ac.id/index.php/stmsi/article/view/6180 OpenAI Research - https://openai.com/research/index/Chapters00:00 Intro and Joe's career path06:11 The Evolution of Cyber Threat Intelligence and intelligence15:05 Rigor, reporting, & attribution29:50 The Relevance of Intelligence in Incident Response and CTI47:09 Building & measuring a CTI function01:00:13 Training teams (and why it doesn't stick)01:07:37 Integrating LLMs in Intelligence Work01:19:50 Skills for the Future of CTI