SANS CTI survey shows intelligence work is becoming cross-functional

At a glance

What this is: Anomali’s summary of the SANS 2023 CTI Survey says CTI programs are broadening into cross-functional operating models while external events increasingly shape intelligence priorities.

Why it matters: That matters because CTI teams now have to support faster operational decisions across security, risk, and response functions rather than serving as a standalone reporting layer.

Context

Cyber threat intelligence works best when it is tied to decision-making, not treated as an isolated research function. The problem the article surfaces is governance, not just tooling: teams consume intelligence from many sources, but they still need a repeatable way to decide what matters, who acts, and how quickly.

The survey summary also points to a broader operating model change. CTI is no longer limited to a small analyst group feeding alerts upward. As intelligence work becomes cross-functional, the boundary between CTI, security operations, risk, and business stakeholders gets thinner, which changes how programmes are governed and measured.

Key questions

Q: How should security teams operationalise CTI when intelligence becomes cross-functional?

A: Security teams should treat CTI as a shared decision service, not a standalone research output. That means defining owners, handoff paths, and standard formats for SOC, vulnerability management, incident response, and leadership. The goal is to make intelligence reusable across the organisation without losing the speed or context needed for action.

Q: Why do external events and geopolitics change CTI priorities so quickly?

A: External events change CTI priorities because attacker behaviour is often shaped by what is happening outside the enterprise, not by internal planning cycles. When programmes rely on current news and public reporting, they need clear relevance criteria to separate genuine exposure from general awareness. Otherwise, the team chases headlines instead of threats that map to its environment.

Q: What breaks when CTI is not connected to internal exposure data?

A: CTI loses actionability when it is not tied to assets, logging, and vulnerability context. Analysts may still produce useful assessments, but the organisation cannot easily decide what to fix, detect, or escalate first. In that state, intelligence becomes informative rather than operational, which weakens response speed and prioritisation discipline.

Q: How do you know if a CTI programme is actually working across teams?

A: A CTI programme is working when the same intelligence consistently triggers the right action in the right team, without rework or delay. Look for evidence such as fewer stalled handoffs, faster prioritisation of relevant vulnerabilities, and clearer escalation decisions. If the output is widely read but rarely used, the programme is informing people rather than changing outcomes.

Technical breakdown

Why external signals now drive CTI prioritisation

CTI programmes increasingly use external news, geopolitical developments, and public threat reporting as intake signals because adversary activity is shaped by events outside the organisation. In practice, that means intelligence workflows have to translate broad context into scoped, timely priorities. The technical challenge is not collection alone. It is triage, relevance scoring, and mapping raw signals to the assets, sectors, and threat hypotheses that matter most to the organisation.

Practical implication: define a repeatable intake and triage model so external signals become decision inputs, not noise.

How cross-functional CTI changes the operating model

Cross-functional CTI means intelligence is consumed by more than the threat intel team. SOC, incident response, vulnerability management, fraud, risk, and leadership may all need different views of the same intelligence product. That requires shared taxonomy, clear handoff paths, and versioned outputs that can support both tactical action and strategic reporting. Without that structure, intelligence becomes inconsistent and slow to operationalise.

Practical implication: standardise CTI outputs so the same intelligence can be reused across response, prioritisation, and executive decision-making.

Why external sources still dominate intelligence production

The survey summary suggests analysts continue to rely heavily on external over internal sources when consuming and producing intelligence. That reflects the reality that adversary intent, targeting trends, and campaign shifts are often first visible outside the organisation. But external-heavy CTI only works when it is fused with internal telemetry, vulnerability context, and business exposure. Otherwise, it produces awareness without actionability.

Practical implication: connect external threat reporting to internal exposure and detection data before publishing it downstream.

Threat narrative

Attacker objective: The attacker objective is to exploit defender delay by taking advantage of shifting threat conditions before intelligence is operationalised.

1. Entry begins in the external environment, where current events, geopolitical developments, and public reporting shape attacker opportunity and defender attention.
2. Escalation occurs when organisations treat intelligence as a reporting function instead of a workflow that can change priorities for SOC, vulnerability management, and response.
3. Impact lands when useful threat context is not translated into timely operational action, leaving detections, patching, and response decisions misaligned with the current threat picture.

NHI Mgmt Group analysis

Cross-functional CTI is becoming a governance problem, not a content problem. The article points to a shift where intelligence value depends on who consumes it and how fast it can be acted on. That means CTI leaders now need operating rules for prioritisation, handoff, and accountability, not just better reporting templates. The field is moving toward intelligence as a coordination layer, and practitioners should treat that as a programme design issue.

External signals are now a primary input into security prioritisation. Current events and geopolitics influence what CTI personnel focus on because attackers do not operate inside organisational calendars. That makes intelligence governance more dynamic, but also more exposed to noise and overreaction. A mature programme must distinguish between attention and action, or else every headline becomes a false priority. Practitioners should align intake criteria to business exposure, not media volume.

CTI now has to serve multiple consumers without losing analytical integrity. Once intelligence is shared across SOC, IR, risk, and leadership, the same finding must support different decisions without being watered down. This is where many programmes break: they produce one artifact for everyone and end up serving no one well. The discipline is moving toward reusable intelligence products, and practitioners should design for different decision horizons from the start.

External intelligence only becomes operational when it is connected to internal context. Threat reports, geopolitical analysis, and vendor feeds matter most when they can be matched to asset exposure, logging coverage, and response playbooks. That is especially true in environments where threat intelligence touches vulnerability management and IAM-adjacent decision paths. The practical conclusion is simple: CTI should shorten time to action, not expand the library of things to read.

What this signals

Cross-functional CTI changes the unit of value from a report to a decision. Teams should expect intelligence programmes to be judged less by volume and more by whether they change prioritisation, escalation, and remediation behaviour.

The practical test is whether intelligence reaches the point of action while it is still relevant. If a CTI finding cannot be mapped to an owner, a control, or a response path, it is probably not mature enough for a cross-functional operating model.

For practitioners

• Define CTI decision owners Map which teams own action for intelligence-driven decisions, including SOC triage, vulnerability prioritisation, and response escalation. Make the ownership explicit so intelligence does not stall between analysis and execution.
• Standardise CTI consumption formats Create separate but consistent intelligence outputs for tactical responders, programme managers, and leadership. Use the same core findings, but tailor the decision context, urgency, and recommended action path for each audience.
• Fuse external and internal signals Require every high-priority intelligence item to be paired with an internal exposure check, such as affected assets, logging coverage, or active vulnerabilities. That keeps external reporting tied to measurable operational relevance.
• Set triage rules for geopolitical and news-driven alerts Build criteria that distinguish strategic awareness from immediate operational priority. Use sector, asset relevance, and likely adversary alignment to prevent news volume from overwhelming the programme.

Key takeaways

• CTI is shifting from a specialist reporting function into a shared decision layer that supports multiple teams.
• External events, geopolitics, and public reporting are increasingly shaping what intelligence teams prioritise.
• The strongest CTI programmes connect outside signals to internal exposure, ownership, and response paths.

Key terms

• Threat Intelligence: Threat intelligence is contextualised information about adversaries, techniques, and signals that helps teams decide what matters and what to do next. In practice, it becomes useful when it is tied to detection, identity scope, and response actions rather than remaining a feed of indicators.
• Cross-Functional Intelligence: Cross-functional intelligence is intelligence work designed to be used by multiple teams rather than a single analyst group. It requires consistent terminology, shared priorities, and outputs that can support operational, risk, and executive decisions without changing the underlying finding.
• Intelligent Prioritisation: Intelligent prioritisation is the process of ranking security issues by context, impact, and likelihood rather than by severity alone. In application security, it helps teams separate urgent risks from background noise, improve remediation focus, and align security work with the exposures that matter most.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is suitable for practitioners who need to connect identity governance to broader security operations and risk decisions.