The Practice of Cyber‑Threat Intelligence in Organizations: A Socio‑Technical Case Study of a Mature Financial Organization
This case study examines how a leading Australian financial organization operationalizes 𝗰𝘆𝗯𝗲𝗿-𝘁𝗵𝗿𝗲𝗮𝘁 𝗶𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲 (𝗖𝗧𝗜), using military intelligence doctrine (the intelligence cycle) as a theoretical lens. The research, framed as a stakeholder-activity process model, reveals 𝗮 𝗳𝘂𝗻𝗱𝗮𝗺𝗲𝗻𝘁𝗮𝗹 𝗶𝗻𝘃𝗲𝗿𝘀𝗶𝗼𝗻 𝗼𝗳 𝗲𝘀𝘁𝗮𝗯𝗹𝗶𝘀𝗵𝗲𝗱 𝗶𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲 𝗻𝗼𝗿𝗺𝘀.
Instead of strategic requirements driving CTI downward from leadership, 𝗶𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲 𝗳𝗹𝗼𝘄𝘀 𝘂𝗽𝘄𝗮𝗿𝗱 𝗮𝗻𝗱 𝗼𝘂𝘁𝘄𝗮𝗿𝗱 from technology operations. This challenges the assumption of intelligence-led security in civilian contexts. The study finds 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀 𝗽𝗮𝗿𝗮𝗱𝗼𝘅𝗶𝗰𝗮𝗹𝗹𝘆 𝗹𝗶𝗺𝗶𝘁 𝗖𝗧𝗜'𝘀 𝘀𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝗰 𝘃𝗮𝗹𝘂𝗲 𝗱𝘂𝗲 𝘁𝗼 𝗶𝘁𝘀 𝗹𝗼𝘄 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗽𝗼𝘀𝗶𝘁𝗶𝗼𝗻𝗶𝗻𝗴, a 𝗸𝗻𝗼𝘄𝗹𝗲𝗱𝗴𝗲 𝗴𝗮𝗽 𝗯𝗲𝘁𝘄𝗲𝗲𝗻 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗮𝗻𝗱 𝗜𝗧, and a lack of strategically relevant analytical products. The findings provide an empirical explanation of CTI practice and a diagnostic model for bottom-up operationalization.
Instead of strategic requirements driving CTI downward from leadership, 𝗶𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲 𝗳𝗹𝗼𝘄𝘀 𝘂𝗽𝘄𝗮𝗿𝗱 𝗮𝗻𝗱 𝗼𝘂𝘁𝘄𝗮𝗿𝗱 from technology operations. This challenges the assumption of intelligence-led security in civilian contexts. The study finds 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀 𝗽𝗮𝗿𝗮𝗱𝗼𝘅𝗶𝗰𝗮𝗹𝗹𝘆 𝗹𝗶𝗺𝗶𝘁 𝗖𝗧𝗜'𝘀 𝘀𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝗰 𝘃𝗮𝗹𝘂𝗲 𝗱𝘂𝗲 𝘁𝗼 𝗶𝘁𝘀 𝗹𝗼𝘄 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗽𝗼𝘀𝗶𝘁𝗶𝗼𝗻𝗶𝗻𝗴, a 𝗸𝗻𝗼𝘄𝗹𝗲𝗱𝗴𝗲 𝗴𝗮𝗽 𝗯𝗲𝘁𝘄𝗲𝗲𝗻 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗮𝗻𝗱 𝗜𝗧, and a lack of strategically relevant analytical products. The findings provide an empirical explanation of CTI practice and a diagnostic model for bottom-up operationalization.