Creating Cyber Threat Intelligence Like a Journalist

While CTI often focuses heavily on technical tools and jargon, analysts should prioritise answering the core questions of ‘who, what, when, where, why, and how’, just like a journalist building a story. There are many parallels between journalistic techniques and CTI practices, including source vetting, confidence assessment, audience awareness, and turning raw information into actionable, contextual insights. The talk encourages CTI professionals to think beyond data collection and focus on producing relevant, accurate, timely, and usable intelligence that reaches the right audience in the right format.