Martin Lee, writing in the latest Threat Source newsletter, has taken aim at a bedrock assumption of modern cybersecurity: that indicators of compromise, or IOCs, are the primary currency of threat defense. His argument, published Thursday from London, does not dismiss IOCs outright. Instead, it positions them as a tactical tool, useful for blocking known threats but largely silent on the deeper questions of adversary behavior, infrastructure patterns, and strategic intent.
The newsletter arrives at a moment of intense debate. The cybersecurity community is wrestling with how to integrate artificial intelligence without overwhelming existing workflows or handing attackers a decisive edge.
Lee frames that debate as a false binary. The real choice, he suggests, is not between AI as a force multiplier for attackers or a replacement for human defenders. It is about where along the intelligence lifecycle AI is applied.
Lee notes that attackers already gain some advantage from AI. That is not new.
What is less discussed, and what his newsletter emphasizes, is the advantage AI offers defenders in managing, indexing, and extracting value from threat intelligence. The industry currently excels at the use and dissemination of IOCs, he writes. These atomic indicators fit neatly into key-value data stores.
Their value can be enhanced with added context structured in STIX or MISP format. But that, he argues, is only the tactical layer. The published text of the newsletter cuts off mid-sentence, but the direction is clear.
Lee is pushing for a shift in thinking. IOCs tell defenders what to block.
They do not tell them who is attacking, why, or how they operate. That kind of knowledge requires a broader intelligence picture—one that AI, in his view, is better suited to index and make sense of. This is not an abstract argument.
It has practical consequences. Security teams drowning in alerts, many of them false positives, need more than a list of hashes and IP addresses.
They need context. They need patterns. They need to understand the adversary’s playbook, not just the next move.
Lee’s point is that AI, properly applied, can help build that understanding. It can turn raw data into actionable intelligence. The newsletter does not specify which AI tools or methods Lee considers most promising.
It does not name specific threat groups or recent attacks. That leaves the discussion at a general level, but the timing is telling.
The cybersecurity industry is awash in AI hype. Vendors promise everything from automated incident response to predictive threat hunting. Lee’s intervention is a reminder that the technology is only as good as the framework it serves.
His argument echoes a longer-standing critique of the IOC model. IOCs are reactive.
They describe what has already been seen. They are easy to share and automate, but they are also easy for attackers to change. A hash can be altered.
An IP address can be swapped. What does not change as easily is the underlying behavior—the tools, techniques, and procedures that define an adversary. That is the intelligence that matters over time.
The newsletter stops short of offering a roadmap. It does not say how to move from a tactical IOC mindset to a strategic intelligence one.
But it raises a question that hangs over the entire field: if the industry is so good at collecting indicators, why is it still so bad at understanding attackers? Lee’s answer, implied if not stated, is that the wrong tools are being applied to the wrong problem. AI, he suggests, should not just be used to find more IOCs.
It should be used to find meaning in the noise.
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “Cybersecurity Newsletter Argues IOCs Are Tactical, Not Strategic”, “description”: “Martin Lee, writing in the latest Threat Source newsletter, has taken aim at a bedrock assumption of modern cybersecurity: that indicators of compromise, or IOCs,…”, “datePublished”: “2026-06-25T17:43:00+00:00T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Beatrice Ferrari”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}}
