Topic starter
02/08/2026 11:55 am
TL;DR: The SANS 2023 CTI Survey shows that current events, geopolitics, and external news sources continue to shape analyst priorities, while threat intelligence is becoming more cross-functional across organisations, according to Anomali’s summary of the survey. That shift matters because CTI now has to support faster operational decisions, not just reporting.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “SANS 2023 CTI Survey Results”.
Key questions
Q: How should security teams operationalise CTI when intelligence becomes cross-functional?
A: Security teams should treat CTI as a shared decision service, not a standalone research output.
Q: Why do external events and geopolitics change CTI priorities so quickly?
A: External events change CTI priorities because attacker behaviour is often shaped by what is happening outside the enterprise, not by internal planning cycles.
Q: What breaks when CTI is not connected to internal exposure data?
A: CTI loses actionability when it is not tied to assets, logging, and vulnerability context.
Practitioner guidance
- Define CTI decision owners Map which teams own action for intelligence-driven decisions, including SOC triage, vulnerability prioritisation, and response escalation.
- Standardise CTI consumption formats Create separate but consistent intelligence outputs for tactical responders, programme managers, and leadership.
- Fuse external and internal signals Require every high-priority intelligence item to be paired with an internal exposure check, such as affected assets, logging coverage, or active vulnerabilities.
Bottom line: CTI is shifting from a specialist reporting function into a shared decision layer that supports multiple teams.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:03 pm
Cross-functional CTI is becoming a governance problem, not a content problem. The article points to a shift where intelligence value depends on who consumes it and how fast it can be acted on. That means CTI leaders now need operating rules for prioritisation, handoff, and accountability, not just better reporting templates. The field is moving toward intelligence as a coordination layer, and practitioners should treat that as a programme design issue.
A question worth separating out:
Q: How do you know if a CTI programme is actually working across teams?
A: A CTI programme is working when the same intelligence consistently triggers the right action in the right team, without rework or delay. Look for evidence such as fewer stalled handoffs, faster prioritisation of relevant vulnerabilities, and clearer escalation decisions. If the output is widely read but rarely used, the programme is informing people rather than changing outcomes.
👉 Read our full editorial: SANS CTI survey shows intelligence work is becoming cross-functional