Cyber Threat Intelligence Podcast

A lot of cybersecurity advice falls apart the moment the “asset” is a turbine, a boiler, a rail system, or a water plant. We sit down with Andrew Ginter, VP of Industrial Security at Waterfall Security Solutions and author of multiple OT cybersecurity books, to get practical about what actually matters in operational technology security: understanding how attacks work, where they enter, and what they can do in the physi...

Most threat intel programs don’t fail because analysts can’t research. They fail because the intelligence isn’t built for a real audience. We sit down with Marcelle Lee, CEO and founder of Fractal Security Group, to get brutally practical about stakeholder-driven cyber threat intelligence and how to turn priority intelligence requirements (PIRs) into outputs people actually use.

We talk through what stakeho...

Your CTI program can publish reports all day and still fail one basic test: does it change what anyone does next? That question drives our conversation with Liam, a cyber threat intelligence analyst supporting the Government of Alberta and the Cyber Alberta community, where “relevance” is not theoretical, it is local, proximate, and tied to real incidents across the province.

We get specific about what it takes t...

CVSS can scream “critical” while the real risk in your environment is quietly sitting somewhere else and threat actors know it. We sit down with Brandon, a former United States Marine Corps intelligence specialist and longtime cyber threat intelligence practitioner, to get brutally practical about what actually drives smart vulnerability prioritization in 2025. 

We talk through why vulnerability management i...

Telegram isn’t just where fraud gets discussed, it’s where entire criminal markets operate in the open. I sit down with Eric Huber, who leads adversary intelligence and disruption work at TD Bank Group, to map how cyber-enabled financial crime really works today: the blend of fraud, payments, cybersecurity, cryptocurrency, and now AI. If you’ve ever wondered why CTI in banking feels different than “classic&r...

The fastest way to fall behind in cybersecurity is to stay reactive while attackers iterate in real time. We sit down with Will Thomas, known across the CTI community as “BushidoToken” to get practical about what actually helps defenders: threat actor profiling that is repeatable, actionable, and built for change.

We start with how Will builds community-ready resources like the ransomware tool matrix and his thre...

Most organizations say they “do CTI,” but what they really have is a pile of threat feeds, glossy reports, and alerts nobody trusts. We sit down with Joshua Copeland, cybersecurity executive, board advisor, and creator of the Unpopular Opinion series, to get brutally practical about what cyber threat intelligence should be: decision support that changes behavior inside a real security program.

We talk through wha...

Ever wonder why your TI platform ingests thousands of new indicators a day and still finds almost nothing useful? We dig into the gap between volume and relevance with Sergio Albea of SWITCH, who built a simple, powerful framework to make IOCs matter for real users in real environments. The idea is direct: score every indicator by system, language, location, and sector so your detections match the way attackers actually operate.

Attribution is getting weird. The same ransomware ecosystem that used to leave clear fingerprints is now full of affiliate “job hopping,” shared tooling, rapid rebrands, and deep web noise that can trick even experienced cyber threat intelligence teams.

Pedro Kurtzman sits down with Katya Kandratovich to map what’s changing and what’s stubbornly staying the same. We talk about why ransomware remains a...

Think your Mac is the safe corner of the network? Olivia Gallucci joins Pedro Kertzman to dismantle the myth of “secure by default” and show how modern attackers slip past comfort-zone defenses. We dig into the real blind spots on macOS, why unified logging and strict entitlements complicate endpoint visibility, and how Apple’s Endpoint Security API helps—while still leaving gaps clever adversaries can explo...

The moment a “hacktivist” group starts speaking with a state’s voice, the puzzle of attribution changes. We explore how Russian-speaking cybercrime transformed after 2022, why so many crews began to move in sync with national narratives, and what language, targeting, and coordination can reveal about influence without leaning on weak assumptions. Our guest, analyst Anastasia Sentsova, brings deep regional fluency ...

🎙 Season 2 Starts March 3rd

Season 1 was about building foundations.
Season 2 is about raising the bar.

We’re diving deeper into the Cyber, Threats, and Intelligence, with practitioners who live it every day.

FULL Video: https://youtu.be/oa2t9GQl6EU

📅 Premiere: March 3rd
🔔 Subscribe now so you don’t miss it.

The threat landscape evolves.
So should we.

Send us Fan Mail

Support the show

Thanks ...

Want fewer fire drills and smarter security moves? This season finale brings together the strongest lessons from our guests on how cyber threat intelligence turns uncertainty into clarity—and clarity into action. We share what actually works when the data is partial, the stakes are high, and leadership wants proof that CTI moves the needle on risk and cost.

We start with the core: prioritization under uncertainty. You&...

Want a front-row seat to how cyber threat intelligence turns noise into decisions that save real money and protect trust? Pedro Kertzman sits down with Alex Keedy, a seasoned CTI leader with experience at Flashpoint, ZeroFox, Intel 471, Deloitte, and Booz Allen Hamilton, to unpack the craft of translating technical signal into business impact. From a political science beginning to profiling actors and advising executives, Alex show...

Curiosity can rewrite a career—and change how an investigation ends. We sit down with Valeri Soloninka, a Russian-speaking cybersecurity professional now protecting government entities in the UAE, to trace a path from hands-on engineering to enterprise SOC work and into the high-impact world of operational and tactical cyber threat intelligence. Along the way, we unpack how fundamentals like networking, DNS, and OS internals ...

What if your best career move starts where you least expect it? Charlotte joins us to share how a love for global history and policy, a bout of academic burnout, and a train-to-hire detour into agile software set the stage for a thriving path in cyber threat intelligence. Her story shows how curiosity, timing, and a willingness to say yes can turn scattered experiences into a focused CTI career.

We dig into the practical dif...

Remember when critical infrastructure defenders had to convince people that cyber attacks were even possible? Those days are gone. Today's challenge is prioritizing defenses in a landscape where threats are multiplying faster than resources.

Sarah Freeman, Chief Engineer for Intelligence Modeling and Simulation at MITRE's Cyber Infrastructure Protection Innovation Center, takes us on a journey through the evolution of indust...

Imagine a criminal enterprise so sophisticated it employs lawyers, creates flashy recruitment videos, and operates its own university. Welcome to the modern ransomware ecosystem, expertly decoded by threat intelligence researcher Tammy Harper in this eye-opening episode.

Harper pulls back the curtain on the surprisingly corporate structure of ransomware operations, revealing a three-tiered hierarchy ranging from invite-only ...

"Basically, everyone just do  whatever they feel like and then call it intelligence." With these provocative words, Freddy Murre cuts straight to the heart of what's wrong with most cyber threat intelligence practices today.

Drawing from 13 years of intelligence experience spanning military operations and private sector work, Freddy exposes the critical disconnect between intelligence methodology and what many CTI teams...