Intelligence Tradecraft - Sharpen your analytic edge

In this episode of Intelligence Tradecraft, host Freddy Murre sits down with Joe Slowik, a threat intelligence veteran whose career spans the US Navy, Los Alamos National Laboratory, MITRE, and the vendor world (Dragos, DomainTools, Gigamon, Huntress, and now DataMinr).In the conversation, Joe makes the case that intelligence is fundamentally about decision support, not raw data feeds or research written for other analysts. He and Freddy dig into what separates good reporting from bad, why stakeholder alignment and rigor (ICD 203, clear separation of fact vs. assessment) matter, and when a "flash report" beats a polished deep-dive.They also tackle the attribution debate — how-centric vs. who-centric attribution, the mess of overlapping naming schemas (APT10 vs. APT31, the Visma case), and why "trust us, we're Microsoft" isn't tradecraft. Joe explains the thinking behind his Applied Threat Intelligence training and the gap it was built to fill.The back half turns to AI: where LLMs genuinely help (research, scripting), where they're dangerous (cognitive offloading, model decay, drying up the junior-to-senior pipeline), who's accountable for AI-generated output, and how threat actors are using these tools, from better phishing to voice cloning. Joe's bottom line for newcomers: critical thinking, communication, and curiosity come before any prompt-engineering skill.ResourcesJoe Slowik's LinkedIn - https://www.linkedin.com/in/joe-slowik/Joe Slowik's Blog and Courses - https://paralus.co/Freddy' Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications Los Alamos National Laboratory - https://www.lanl.gov/ NIST Cyber Threat Intelligence definition - https://csrc.nist.gov/glossary/term/cyber_threat_intelligenceCTI used in books (Google Search) - https://books.google.com APT 1 Report - https://services.google.com/fh/files/misc/mandiant-apt1-report.pdf Moonligh Maze on Wikipedia - https://en.wikipedia.org/wiki/Moonlight_MazeSANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence ICD 203 - https://www.dni.gov/files/documents/ICD/ICD-203.pdfMLitt in Terrorism and Political Violence - https://cstpv.wp.st-andrews.ac.uk/masters-in-terrorism-and-political-violence/ Routledge Handbook of Terrorism Research - https://www.routledge.com/The-Routledge-Handbook-of-Terrorism-Research/Schmid/p/book/9780415520997 APT Groups and Operations Rosetta Stone (not mine) - https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/edit?pli=1&gid=1864660085#gid=1864660085 Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications Tradecraft Primer: SATs - https://www.cia.gov/resources/csi/static/Tradecraft-Primer-apr09.pdf An Illustrated Book of Bad Arguments - https://bookofbadarguments.com/ Weston's Rulebook for Arguments - https://hackettpublishing.com/philosophy/logic-mathematics/critical-thinking/a-rulebook-for-arguments-group Joe's Critique of Practical Threat Intelligence - https://pylos.co/2026/05/03/a-brief-critique-of-practical-threat-intelligence/ Cognitive Offloading - https://sistemasi.ftik.unisi.ac.id/index.php/stmsi/article/view/6180 OpenAI Research - https://openai.com/research/index/Chapters00:00 Intro and Joe's career path06:11 The Evolution of Cyber Threat Intelligence and intelligence15:05 Rigor, reporting, & attribution29:50 The Relevance of Intelligence in Incident Response and CTI47:09 Building & measuring a CTI function01:00:13 Training teams (and why it doesn't stick)01:07:37 Integrating LLMs in Intelligence Work01:19:50 Skills for the Future of CTI

SummaryWill Woodall shares his 14-year journey through intelligence roles in the UK government and transitioning to private sector intelligence. He explains motivations for leaving government (slow recruitment and limited recognition), contrasts public vs private sector work, and emphasizes core intelligence methodology: the yardstick/estimated probability language, source evaluation and confidence, structured analytical techniques, and clear writing and delivery tailored to customers. In the interview. Will and Freddy debate what distinguishes information from intelligence, how to measure intelligence program value through customer action and feedback, challenges like expert bias and stakeholder alignment, and how AI/LLMs can help with volume and practical tasks but require validation and human questioning. He advises aspiring analysts to pursue analytical subjects, develop domain expertise, and learn core intelligence components.ResourcesExtrac AI - https://www.extrac.ai/index.htmlSANS Admiralty Scale blog post 1 - https://www.sans.org/blog/enhance-your-cyber-threat-intelligence-with-the-admiralty-system SANS Admiralty Scale blog post 2 - https://www.sans.org/blog/admiralty-code-part-2-ticketmaster-data-breach-claims LinkedIn Post on what makes something intelligence - https://www.linkedin.com/posts/fmurre_in-your-opinion-when-does-something-go-from-activity-7181221399561203712-mV-mKing's College London, the Intelligence Studies Program - https://www.kcl.ac.uk/study/postgraduate-taught/courses/intelligence-and-international-security-ma/teachingStructured Analytic Techniques (SATs) Training - https://inteltradecraft.com/sat-certificationsAnalytic standards ICD203 - https://www.dni.gov/files/documents/ICD/ICD-203.pdfPHIA UK Analytic Standards - https://www.gov.uk/government/publications/phia-common-analytical-standards/phia-common-analytical-standardsLinkedIn Freddy M - https://www.linkedin.com/in/fmurre/LLMs getting worse - https://royalsocietypublishing.org/rsos/article/12/4/241776/235656/Generalization-bias-in-large-language-modelChapters00:00 Introduction to Intelligence and Personal Journey07:15 Transitioning from Government to Private Sector11:53 Understanding Intelligence Methodology and Standards18:59 Defining Intelligence vs. Information23:27 The Role of AI in Intelligence31:02 Training and Methodologies in Intelligence47:06 Challenges in Implementing Intelligence in the Private Sector54:16 Measuring Success of Intelligence Programs58:13 Challenges in Applying Intelligence in Organizations01:02:06 Advice for Aspiring Intelligence Professionals01:15:50 Influential People and Career Moments01:17:28 Closing Remarks and Future OutlookThis conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview happened on July 2nd, 2025 in London, UK.

SummaryListen to Nadia Tuominen's path from crime science student to intelligence analyst in London’s Metropolitan Police, where she learned mostly on the job in a changing organization. She explains how austerity and lack of development pushed her to leave for sports integrity in tennis, then into the financial sector to work on economic crime. A later shift into academia and training lets her “close the circle” by teaching police officers and practitioners, creating qualifications she wishes had existed earlier. Across her journey, she emphasizes intelligence as a reasoning process, the importance of frameworks, elevating analysts from “support staff” to specialists, and helping people think better rather than just learn tools. Nadia emphasizes the need for analysts to be proactive, build relationships, and continuously develop their skills to adapt to the changing landscape of intelligence work.Key takeawaysIntelligence is a reasoning process for decision-making, not magic or perfect prediction.Definitions of intelligence should fit each organization’s mission and context, rather than chasing one universal formula.Frameworks like the UK National Intelligence Model, though imperfect, become clearly valuable once you work in less-structured private-sector environments.Analysts should be treated as specialists, not generic “support staff,” to improve respect, pay, and decision quality.Training should focus on how analysts think (cognition, self-awareness, bias) as much as on tools and structured techniques.Biases are unavoidable and not inherently bad; the aim is to understand and manage them, not pretend they can be removed.Many law enforcement analysts lack formal, portable qualifications, so building accessible, practice-based education helps careers and professionalizes the field.Resources and references mentionedNIM https://library.college.police.uk/docs/npia/NIM-Code-of-Practice.pdfICD 203 https://www.dni.gov/files/documents/ICD/ICD-203.pdfIntelligence Architecture Mind Map - https://github.com/Errum/IntelArchitectureMapPsychology of intelligence Analysis - https://www.cia.gov/resources/csi/static/Pyschology-of-Intelligence-Analysis.pdfAnalyst & Decision-Maker Conference - https://i2group.com/events/analyst-decision-maker-conference-2026Chapters02:59 Journey into Intelligence and Law Enforcement05:56 Training and Development in Intelligence Analysis09:12 Transitioning from Law Enforcement to Sports Integrity12:07 Understanding Intelligence Frameworks14:51 Exploring Financial Crime and Economic Crime17:49 The Role of Academia in Intelligence Analysis20:51 Training and Cognitive Function in Intelligence23:59 Defining Intelligence: Perspectives and Processes27:10 The Importance of Forward-Looking Intelligence29:57 Analysts as Specialists, Not Support Staff37:13 The Role of Analysts in Decision Making38:25 Understanding AI and Its Implications40:30 Critical Thinking in AI Usage42:35 Explainability and Trust in AI44:22 Evaluating AI vs Human Intelligence46:24 The Importance of Input in AI48:28Training and Experience in Intelligence Analysis55:33 Measuring the Value of Intelligence01:01:05 The Dialogue of Intelligence01:04:17 The Future of AI in Intelligence01:12:10 Preparing for a Career in Intelligence

SummaryIn this podcast episode, Elizabeth Dos Santos shares her journey from a 25-year career in the FBI, focusing on intelligence analysis and counter-terrorism, to the private sector, teaching intelligence. She discusses the challenges she faced, the importance of communication skills, and her transition to the private sector. Elizabeth emphasizes the role of AI in intelligence, the need for critical thinking, and the significance of structured analytic techniques in training. She also provides valuable advice for aspiring intelligence analysts, highlighting the importance of writing and presentation skills.TakeawaysElizabeth Dos Santos has a rich background in intelligence, having worked for the FBI for nearly 25 years.Her journey into intelligence began through a suggestion from her father.She emphasizes the importance of communication skills in intelligence analysis.Elizabeth shares her transition from government to private sector work and the cultural differences.She highlights the importance of structured analytic techniques in training and analysis is emphasized.Elizabeth advises aspiring analysts to focus on writing and presentation skills.The conversation touches on the need for transparency in AI and the importance of critical thinking.AI presents both opportunities and challenges in the field of intelligence.Resources and references mentionedThe Psychology of Intelligence Book - https://www.cia.gov/resources/csi/books-monographs/psychology-of-intelligence-analysis-2/ The Six Thinking Hats Book - https://www.amazon.com/Six-Thinking-Hats-Edward-Bono/dp/0241257530 Pherson Associates - https://pherson.org/ ICD 203 - https://www.dni.gov/files/documents/ICD/ICD-203.pdf SANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence Is all Intelligence Forward Looking blog post - https://inteltradecraft.com/is-all-intelligence-forward-looking The Thinking, Fast & Slow Book - https://www.amazon.com/Thinking-Fast-Slow-Daniel-Kahneman/dp/0374275637 Training with Intelligence Tradecraft - https://inteltradecraft.com/sat-certifications IAFIE - https://www.iafie.org/ The Structured Analytic Techniques (SAT) Book - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X The SAT Handbook book - https://www.amazon.com/Handbook-Analytic-Tools-Techniques-5th/dp/0979888093/ Admiralty Scale SANS Blog - https://www.sans.org/blog/enhance-your-cyber-threat-intelligence-with-the-admiralty-system/ SANS FOR589 Cybercrime course - https://www.sans.org/cyber-security-courses/cybercrime-intelligence/ Chapters00:00 Introduction to Elizabeth Dos Santos01:51 Journey into Intelligence08:44 Career Development in the FBI12:40 Challenges and Growth in Intelligence19:39 Transitioning to the Private Sector27:52 The Role of AI in Intelligence53:23 Advice for Aspiring Intelligence Analysts01:07:29 The Importance of Communication in Intelligence01:14:19 Structured Analytic Techniques and IAP01:18:19 Conclusion and Reflections on IntelligenceThis conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview happened on May 13th, 2025 in Copenhagen, Denmark.

In this conversation, Freddy and Will delve into the world of Cyber Threat Intelligence (CTI) and sharing communities, exploring of Will T, the journey of a cybersecurity professional, the importance of training and community, the challenges faced in threat reporting, and the impact of AI on the field. They discuss the evolution of CTI, the necessity for critical thinking, and the ethical considerations surrounding the use of AI in intelligence work. The conversation emphasizes the need for collaboration and knowledge sharing within the cybersecurity community to enhance overall effectiveness against cyber threats.TakeawaysThe importance of foundational knowledge in cybersecurity.Real-world experience is crucial for developing analytical skills.Training can significantly enhance an analyst's capabilities.Community support is vital for sharing knowledge and resources.AI can assist in summarizing and analyzing data but has limitations.Ethical considerations are paramount when using AI in intelligence.Critical thinking is essential in evaluating threat reports.Transparency in threat reporting builds trust with stakeholders.Continuous learning and adaptation are necessary in cybersecurity.Collaboration within the community can lead to better threat mitigation.Resources & References MentionedRob M. Lee - https://www.dragos.com/team/robert-m-lee/SANS FOR578: https://www.sans.org/cyber-security-courses/cyber-threat-intelligence/ SANS FOR589: https://www.sans.org/cyber-security-courses/cybercrime-investigations/ Chainalysis Blockchain Intelligence: https://www.chainalysis.com/blockchain-intelligence/ SANS blog post on Admiralty Scale https://www.sans.org/blog/enhance-your-cyber-threat-intelligence-with-the-admiralty-system/Oracle incident - https://www.csoonline.com/article/3953644/oracle-quietly-admits-data-breach-days-after-lawsuit-accused-it-of-cover-up.html Flavio Queiroz's LinkedIn post - https://www.linkedin.com/posts/flavioqueiroz_threathunting-threatdetection-threatanalysis-activity-7310254153732141056-b-Ba/ Council of Experts: https://blog.bushidotoken.net/2024/04/strengthening-proactive-cti-through.htmlWill's Projects: https://github.com/BushidoUK#-my-projectsRansomware Tool Matrix: https://github.com/BushidoUK/Ransomware-Tool-MatrixCurated Intelligence: https://www.curatedintel.org/MITRE ATT&CK: https://attack.mitre.org/Diamond Model of Intrusion Analysis: https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf?adlt=strictMapping TTPs: https://github.com/BushidoUK/MITRE-MappingsCurated Intel website - https://www.curatedintel.org/ Microsoft Security Copilot: https://www.microsoft.com/en-us/security/business/ai-machine-learning/microsoft-security-copilotChapters00:00 Introduction to Cyber Threat Intelligence02:48 Career Journey in Cybersecurity06:08 Understanding Cyber Threat Intelligence09:06 The Role of Training in Cyber Intelligence11:57 Teaching and Sharing Knowledge in Cybersecurity15:08 The Importance of Community in Cyber Intelligence17:54 Challenges in Cyber Threat Reporting20:56 The Impact of AI on Cyber Threat Intelligence24:08 Future of AI in Cybersecurity26:47 Ethics and Challenges of AI in Intelligence29:57 Conclusion and Final ThoughtsThis conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview happened on May 2nd, 2025 in Bournemouth, England.

In this conversation, Scott Small, Director of Cyber Threat Intelligence at Tidal Cyber, shares his journey into the field of CTI, discussing his background, current responsibilities, and the importance of curiosity and empathy in intelligence analysis. He emphasizes the role of AI and open-source intelligence in enhancing threat detection and response, while also addressing the challenges of implementing threat-informed defense strategies. The discussion highlights stakeholder engagement, the value of writing in intelligence, and the need for continuous learning and networking within the cybersecurity community.TakeawaysCuriosity is essential for success in intelligence analysis.Writing helps clarify thoughts and improve analytical skills.AI is transforming the landscape of cybersecurity and threat intelligence.Stakeholder engagement is crucial for effective intelligence sharing.Open-source intelligence provides valuable insights for threat analysis.Empathy allows analysts to understand diverse perspectives in intelligence.Structured analytic techniques enhance the quality of intelligence analysis.Networking within the cybersecurity community fosters collaboration and learning.Trustworthy sources are vital for accurate intelligence gathering.Incident-driven intelligence can lead to proactive security measures.Resources references mentionedTidal Cyber web site - https://www.tidalcyber.com/ What are TTPs - https://csrc.nist.gov/glossary/term/tactics_techniques_and_procedures Cyber Kill Chain - https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html Unified Kill chain - https://www.unifiedkillchain.com/ my LinkedIn - https://www.linkedin.com/in/fmurre/ my GitHub - https://github.com/Errum/IntelArchitectureMap Katie Nickels - CTI study plan 1 - https://medium.com/katies-five-cents/a-cyber-threat-intelligence-self-study-plan-part-1-968b5a8daf9a Katie Nickels - CTI study plan 2 - https://medium.com/katies-five-cents/a-cyber-threat-intelligence-self-study-plan-part-2-d04b7a529d36 Curated Intel CTI fundamentals - https://github.com/curated-intel/CTI-fundamentals Intelligence Tradecraft Structured Analytic Techniques (SAT) training - https://inteltradecraft.com/sat-certifications Workshop I teach at FIRST CTI - https://www.first.org/conference/firstcti25/program#pIntelligence-Collection-Planning-Workshop-How-to-Create-A-Plan-that-Synchronizes-Collection-with-Your-Stakeholders-Needs NFCERT CTL - https://communication.nfcert.org/hubfs/CTL_Reports/2025%20TLP_CLEAR%20NFCERT%20Cyber%20Threat%20Landscape%20(CTL)%20Report%20v1.0.pdfChapters00:00 Introduction to Cyber Threat Intelligence02:47 Scott Small's Background and Career Path06:10 Understanding Threat Informed Defense08:59 The Role of TTPs in Cybersecurity11:51 The Importance of Storytelling in Cyber Intelligence15:05 Challenges in Implementing Threat Informed Defense17:52 The Role of AI and Machine Learning in Cyber Intelligence21:01 Evaluating Open Source Intelligence (OSINT)23:56 Identifying Trustworthy Sources in Cyber Intelligence26:59 Lessons Learned from Mistakes in Cyber Intelligence29:44 Case Study: Analyzing the Akira Ransomware Group33:10 Future of Cyber Threat Intelligence38:06 Navigating the Landscape of Cyber Threat Intelligence43:37 The Path to Becoming a Cyber Intelligence Analyst46:08 The Importance of Writing in Cyber Intelligence49:31 Essential Skills for a Successful Analyst51:14 Structured Analytical Techniques in Cyber Intelligence54:30 Implementing Intelligence Tradecraft in Organizations58:02 Proactive vs. Reactive Intelligence01:01:33 The Role of AI in Cyber Threat Intelligence01:09:53 The Future of Automated Threats and Defenses01:15:15 The Value of Networking and Community in Cyber IntelligenceThis conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview was recorded in April 23rd, 2025 during the FIRST CTI Conference in Berlin.

Join us in the first episode of our podcast where we interview Garrett Carstens in beautiful Berlin. Garrett shares his extensive experience in cyber threat intelligence, from his beginnings at the US Department of Defense to his current role as VP of Intel Operations at Intel 471. We delve into the transition from government to private sector, the importance of critical thinking in cyber intelligence, the evolution of threat intelligence, and how to effectively measure success in this field. Garrett also discusses the role of artificial intelligence and machine learning in cyber intelligence and provides practical advice for those looking to make a similar career transition.Resources and references mentioned:Intel471 - https://www.intel471.com/ SANS blog - https://www.sans.org/blog/enhance-your-cyber-threat-intelligence-with-the-admiralty-system/ FIRST CTI Conference Agenda - https://www.first.org/conference/firstcti25/program LinkedIn post on "what makes something intelligence?" - https://www.linkedin.com/posts/fmurre_in-your-opinion-when-does-something-go-from-activity-7181221399561203712-mV-m The Intelligence Architecture Mind Map on GitHub - https://github.com/Errum/IntelArchitectureMap SANS courses FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence FOR589 Cybercrime Investigations - https://www.sans.org/cyber-security-courses/cybercrime-investigations Intel471 Handbook - https://www.intel471.com/resources/cyber-underground-handbook GitHub Repo - https://github.com/intel471/CU-GIRThis conversation is a compressed edit of an interview Freddy has conducted as part of his PhD research. The interview was recorded in April 21st, 2025 during the FIRST CTI Conference in Berlin