Lesson 02 — Cyber Threat Intelligence & Attribution

Lesson 02 · Slide 1

Lesson 02 — Cyber Threat Intelligence & the Limits of Attribution

How to consume threat intelligence and attribution claims critically — so you act on evidence, not on theatre.

Day 1 Decision-making No prerequisites

Notes: The previous lesson said "assume persistent contact." This lesson is how you turn the flood of intelligence about that contact into decisions instead of noise.

Lesson 02 · Slide 2

Three altitudes of intelligence

Strategic — who is likely to target us and why; informs budget and posture. Your altitude.
Operational — which campaigns and techniques are active against our sector; informs priorities.
Tactical — specific indicators (addresses, hashes, domains); informs the tools and the SOC.

Leader's trap

Drowning in tactical indicators while starved of strategic judgement. You should be consuming the top of this list, not the bottom.

Notes: Reveal one at a time. Make the room place themselves: most leaders are handed tactical feeds and asked to react, which is exactly backwards.

Lesson 02 · Slide 3

Intelligence-led defence

Good intelligence does one thing for a leader: it turns adversary behaviour into priorities. If a piece of intelligence does not change a decision, a budget line, or a priority, it is trivia.

The test to apply

"What would we do differently because of this?" If the honest answer is "nothing," stop paying for it.

Notes: This single question kills a remarkable amount of wasted spend and meeting time.

Lesson 02 · Slide 4

Why attribution is hard

Infrastructure is borrowed — adversaries route through others' systems and stolen accounts
Tools are shared and copied — the same malware appears across unrelated actors
False flags are deliberate — sophisticated actors plant another's fingerprints
Attribution is political — naming a state is a diplomatic act, not just a technical one

Notes: The point is not "attribution is useless" — it is "attribution is a probabilistic, often political claim, and you must treat confident naming with suspicion."

Lesson 02 · Slide 5

A report states: "This intrusion was carried out by State X's intelligence service." How much weight do you put on it, knowing nothing else?

C. The headline claim is not the intelligence — the evidence and the analyst's stated confidence are. A. and D. are the traps (deference and confirmation bias); B. overcorrects. Demand the basis and the confidence level, then weigh.

Notes: D is the most dangerous answer in a real boardroom — attribution that flatters existing belief gets waved through. Name that.

Lesson 02 · Slide 6

Reading a report: evidence vs inference

Watch the same report excerpt split into what was observed and what was concluded. Press → to separate each line.

Evidence (observed)

A phishing domain registered 3 days before use
Malware reused from a known toolkit
Activity during one time zone's working hours

Inference (concluded)

"Premeditated, well-resourced operation"
"Consistent with Actor Y" — but the toolkit is shared
"Operators based in country Z" — time zones can be faked

Notes: Reveal evidence/inference in pairs so the room sees how each confident conclusion rests on a softer fact. The time-zone inference is the classic over-reach.

Lesson 02 · Slide 7

Threat-intel theatre

Signs that a feed is generating noise, not decisions:

Thousands of indicators, no prioritisation, no "so what"
Reports that never change a single decision you make
Confident attribution with no stated confidence level or evidence
Dashboards measured by volume ("12,000 threats blocked") rather than risk reduced

Notes: "12,000 threats blocked" is a vanity metric; it tells you nothing about the threats that matter. Push for decision-relevance.

Lesson 02 · Slide 8

Think · pair · share

90 seconds: name one intelligence feed, briefing, or report your organisation receives — and decide whether it has ever changed a decision. If not, what would you do about it?

Notes: Harvest a couple of answers. Most rooms can name at least one feed nobody acts on.

Lesson 02 · Slide 9

What to ask before you act on intelligence

What did we observe, and what did we infer?
What is the analyst's stated confidence, and on what basis?
What would change this assessment?
What decision does this inform — and what will we do differently?

Lesson 03 — why you, personally, are the high-value target this intelligence keeps pointing back to.

Notes: These four questions are the portable takeaway; they reappear on the "questions to ask" sheet in Lesson 14.