Martin Lee, writing in Cisco Talos’s Threat Source newsletter on June 25, argues that the AI debate in security has been framed too narrowly. People tend to cast AI as either a weapon for adversaries or a tool that will put analysts out of work. Lee calls the reality “more nuanced.”
Attackers do gain something. Defenders gain too, he writes, especially in how they manage, index and get value out of threat intelligence.
Strong on indicators, weak on context
The industry is good at sharing indicators of compromise, or IOCs. These small, atomic data points slot easily into key-value stores, and STIX or MISP formats can wrap extra context around them. Lee calls that only the tactical layer.
What readers of intelligence reports want is something else: a picture of how a threat applies to their own situation, and what they can do about it with the resources they have. That understanding sits in the natural language of strategic and operational briefings. Those briefings are hard to index. Incident reports, darknet monitoring and malware analysis rarely cross-reference one another, and threat actors often go by different names in different places.
Where language models fit
Lee thinks large language models could help. They have no real understanding of an issue, he notes, but they can spot synonyms and connect entities across huge piles of unstructured text. That should make relevant reports easier to find and make it simpler to generate advice on protecting against a given threat.
He lists two problems still to solve. Defenders need to check the accuracy of the data the models take in, and protect the confidentiality of the questions people put to such a system.
Personal, domain-specific models, he writes, could one day pull relevant reports from scattered sources and answer even a vague query with specific advice. His closing view: people should treat AI as a tool for getting intelligence to the people who need it faster, not as a threat to their jobs, and use it to “make the bad guy’s lives harder.”
Sources
- Beyond IOCs: AI-Enabled Threat Intelligence – The New Frontier of Cyber Defense
- Beyond IOCs: AI-enabled threat intelligence
