Consume and Produce: The Economics ofCyber Threat Intelligence Operations

Подробнее о видео

SANS Cyber Threat Intelligence Summit 2023

Consume and Produce: The Economics ofCyber Threat Intelligence Operations
Sherman Chu, Manager, Deloitte

Balancing between consuming and producing while factoring in the limitations of people, processes, and technology (PPT) is a challenge all CTI teams face (vendor or end-user organizations). Some CTI shops might dedicate most of their resources to producing intelligence products, while others may apportion a majority of their capital to the consumption and application of finished intelligence. While there are no perfect formulas that can achieve CTI operational "equilibrium," we can explore the factors that can help us improve our resource allocation to empower CTI operations.

This presentation explores the fundamental economics of CTI, and the factors organizations should consider when allocating people and technology in their CTI program and processes to bolster security. Specifically, we will examine the essential elements of CTI; what PPT means for CTI operations; the effects of CTI consumption/production; and explore ways to balance scarce people and technology resources to bolster CTI capabilities for your organization.

View upcoming Summits:
Download the presentation slides (SANS account required) at