Topic starter
02/08/2026 11:55 am
TL;DR: Current events, geopolitics, and external news sources are still shaping CTI priorities, Anomali’s summary of the SANS 2023 CTI Survey reports. CTI programs now need reusable paths to turn that intelligence into decisions across the organisation.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “SANS 2023 CTI Survey Results”.
Key questions
Q: Why do external events and geopolitics change CTI priorities so quickly?
A: External events change CTI priorities because attacker behaviour is often shaped by what is happening outside the enterprise, not by internal planning cycles.
Q: What breaks when CTI is not connected to internal exposure data?
A: CTI loses actionability when it is not tied to assets, logging, and vulnerability context.
Q: How should security teams operationalise CTI when intelligence becomes cross-functional?
A: Security teams should treat CTI as a shared decision service, not a standalone research output.
Practitioner guidance
- Define CTI decision owners Map which teams own action for intelligence-driven decisions, including SOC triage, vulnerability prioritisation, and response escalation.
- Standardise CTI consumption formats Create separate but consistent intelligence outputs for tactical responders, programme managers, and leadership.
- Fuse external and internal signals Require every high-priority intelligence item to be paired with an internal exposure check, such as affected assets, logging coverage, or active vulnerabilities.
Bottom line: CTI is shifting from a specialist reporting function into a shared decision layer that supports multiple teams.
Glossary terms: Threat Intelligence, Cross-Functional Intelligence, Intelligent Prioritisation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:03 pm
Cross-functional CTI is becoming a governance problem, not a content problem. The article points to a shift where intelligence value depends on who consumes it and how fast it can be acted on. That means CTI leaders now need operating rules for prioritisation, handoff, and accountability, not just better reporting templates. The field is moving toward intelligence as a coordination layer, and practitioners should treat that as a programme design issue.
A question worth separating out:
Q: How do you know if a CTI programme is actually working across teams?
A: A CTI programme is working when the same intelligence consistently triggers the right action in the right team, without rework or delay. Look for evidence such as fewer stalled handoffs, faster prioritisation of relevant vulnerabilities, and clearer escalation decisions. If the output is widely read but rarely used, the programme is informing people rather than changing outcomes.
👉 Read our full editorial: SANS CTI survey shows intelligence work is becoming cross-functional