Security teams that spend their days chasing indicators of compromise — the IP addresses, file hashes, and domain names that mark known malware — may be missing the real game. That’s the argument Martin Lee made in his latest Threat Source newsletter, published Thursday. And if he’s right, the consequences for how organizations spend their money and train their analysts are significant.
The newsletter cuts to a simple point. IOCs are tactical.
They block what you already know. They don’t tell you who is coming after you next, or why. Lee wrote that the cybersecurity industry currently excels at using and disseminating these atomic indicators.
They fit neatly into key-value data stores. Their value can be enhanced with added context structured in STIX or MISP format.
But that, he argued, is only the tactical layer. The real promise of AI, in his view, sits deeper in the intelligence lifecycle. It’s about indexing and making sense of the broader picture — adversary behavior, infrastructure patterns, strategic intent.
That shift has consequences for everyone from SOC analysts to C-suite executives. For one, it changes the skill set required. Analysts who can only read a blocklist won’t be the ones in demand.
The people who will matter are those who can ask the right questions of an AI system, who understand what strategic intelligence looks like, and who can interpret patterns that aren’t just a hash match. That is a harder skill to teach than how to copy-paste an IOC into a firewall rule.
It also changes the tooling market. Right now, vendors sell a lot of products that generate, share, and automate IOCs. If the industry shifts toward AI-driven intelligence that goes deeper, those products lose value.
New ones emerge. The newsletter did not specify which AI tools or methods Lee considers most promising.
But the implication is clear: the current generation of threat intelligence platforms, built around atomic indicators, may need a fundamental redesign. There is a cost angle too. IOCs are cheap to produce and distribute.
Strategic intelligence takes more work. It requires data scientists, threat researchers, and analysts who can train models and validate their outputs. That is not a cost every organization can bear.
Smaller firms may find themselves left behind, relying on the same old IOCs while larger competitors and nation-state adversaries move to a smarter game. Lee acknowledged that AI offers some advantage to attackers.
But he emphasized it also offers advantages to defenders — particularly in how threat intelligence is managed, indexed, and value is derived from it. The debate in the cybersecurity community has often been framed as a binary: AI as a force multiplier for attackers, or a tool that makes human defenders obsolete. Lee called that framing too simple.
The reality is more nuanced. What to watch next.
If the industry takes Lee’s argument seriously, expect to see more investment in AI systems that don’t just flag known bad stuff, but that map out adversary campaigns over time. Expect job postings to change. Expect the next generation of security certifications to test for strategic thinking, not just IOC recall.
And expect the vendors who adapt fastest to become the ones who survive. The newsletter arrived as the cybersecurity community continues to debate how to integrate AI without over-relying on it. Lee’s piece does not name specific threat groups or recent attacks.
It does not offer a product recommendation. It simply points out that the industry has built a machine that is very good at one thing — and that one thing may not be enough.
