The Intelligence-Driven Advantage: A Practical Guide to Building CTI Into Your Security Program

No ratings

Presented at BSidesAugusta 2026 by

Timothy Block

In many organizations, Cyber Threat Intelligence (CTI) is viewed as a high-cost luxury reserved for mature SOCs. However, when implemented strategically, CTI is one of the most cost-effective force multipliers available to a security leader. By moving beyond simple "indicator feeds" and focusing on actionable context, organizations can simultaneously sharpen their technical response and revolutionize their security awareness culture. This session explores a pragmatic, low-cost approach to building a CTI-driven security program. We will demonstrate how real-world threat data can be used to enrich the knowledge of security analysts, moving them from reactive alert-clearing to proactive threat hunting. Furthermore, we will show how to transform "boring" security awareness training into a dynamic, intelligence-led engagement program that uses current, industry-specific threats to educate employees. Attendees will learn how to: - Leverage Low-Cost Intelligence: Utilize OSINT, ISACs, and community sharing to build a high-value program on a budget. - Enrich Technical Teams: Use adversary TTPs to prioritize patching, tune detection logic, and build analyst critical thinking skills. - Modernize Awareness: Replace generic training templates with real-world intelligence that resonates with employees and turns them into active "human sensors." - Speak to the Board: Translate technical threat data into the language of business risk and ROI to gain executive buy-in. Whether you are a solo practitioner or leading a growing team, this talk provides a blueprint for using intelligence to build a more informed, resilient, and executive-aligned security organization.