The ThreatSpire Field Notes

Intelligence, written by analysts — for analysts.

Tradecraft, threat-landscape reads, and opinion from the ThreatSpire team. Plain language, evidence-first, no vendor noise.

Grimm's Gadgets Jun 4, 2026 8 min read

Building an Evidence Timeline

Don't paste a pile of bullet points and call it an actor timeline. Record what was reported, where it came from, how good the source is, and what *you* concluded, all kept separate. Then it survives the "how do you know?" question.

CTIEEITLDRThreat Intelligence

Read the post

All posts

Jason Faulhefer Jun 4, 2026 12 min read

Building a Threat Intelligence Program Around Intelligence Requirements

Most threat intelligence programs start with a feed subscription and a wish. The ones that succeed start with a clear set of intelligence requirements that tie every collection decision, every analysis product, and every dissemination channel to a decision-maker's need.

CTIIntelligence RequirementsProgram Design

Jason Faulhefer Jun 2, 2026 10 min read

The Intelligence Requirements Process: From Stakeholder Question to Evidence-Backed Answer

A step-by-step walkthrough of the Intelligence Requirements Process — the repeatable workflow that turns a stakeholder question into an evidence-backed answer that actually changes decisions.

CTIIntelligence RequirementsProcess

Jason Faulhefer Jun 1, 2026 9 min read

Intelligence Requirements Examples: 12 PIRs Mature CTI Teams Actually Use

Twelve real Priority Intelligence Requirements that mature CTI teams maintain — with the decisions they support, the consumers they serve, and the IRs and EEIs that flow out of each. Use them as templates for your own program.

CTIPIRIntelligence Requirements

Jason Faulhefer May 30, 2026 12 min read

How to Develop Priority Intelligence Requirements (Step-by-Step with Examples)

A practical, step-by-step process for developing Priority Intelligence Requirements that drive decisions instead of noise. Includes concrete examples, templates, and a checklist.

CTIPIRIntelligence Requirements

Jason Faulhefer May 29, 2026 8 min read

What Are Priority Intelligence Requirements? Definition, Examples, and How They Drive a CTI Program

Priority Intelligence Requirements are formal questions that connect threat intelligence to real decisions. Learn what PIRs are, see real-world examples, and discover how they transform a CTI program from reactive reporting into strategic security.

CTIPIRsIntelligence Requirements

Jason Faulhefer May 29, 2026 9 min read

Priority Intelligence Requirements (PIRs): A Practical Guide for CTI Teams

PIRs are the contract between CTI and the people who use it. A practical guide to writing, ranking, and operating Priority Intelligence Requirements without turning your program into a paperwork exercise.

CTIPIRsIntelligence Requirements

Grimm Gadgets May 4, 2026 4 min read

Do Not Rush

When advisories drop and Slack lights up, analysis fragments. A controlled approach — observed, assessed, unknown, next actions — keeps reasoning intact while everything else accelerates.

AnalysisTradecraft

Jason Faulhefer May 4, 2026 9 min read

The Double-Edged Sword of AI: Why Faster Development May Be Creating Bigger Cyber Risks

AI is making developers faster and analysts more efficient — but it is also shipping insecure code, exposed secrets, and unreviewed cloud infrastructure at machine speed. The result is a new class of invisible enterprise risk.

Artificial IntelligenceAppSecDevSecOps

Jason Faulhefer Apr 28, 2026 7 min read

Threat Intelligence Is Broken: Why Most Organizations Collect Feeds But Gain No Real Defense

Most enterprises have built an expensive repository of disconnected threat data that rarely yields measurable defensive outcomes. The fix is operational intelligence — relevance, exposure, exploitability, action.

CTIStrategySOC

Grimm Gadgets Apr 28, 2026 5 min read

AI Did Not Replace the Attacker. It Made the Attacker Faster.

The 2025 breach data tells a clear story: credential theft, phishing, and unpatched systems still dominate. AI did not invent new intrusion categories — it accelerated the ones attackers were already running.

Artificial IntelligenceThreat Landscape

Jason Faulhefer Apr 27, 2026 7 min read

Cybersecurity Has Entered the Autonomous Machine Defense Race

Anthropic Mythos, Google''s agentic SOC, Microsoft''s AI Zero Trust, and CrowdStrike''s AI runtime security — taken together, these are not isolated product launches. They signal an industry-wide control-plane shift.

StrategyArtificial IntelligenceSOC

Jason Faulhefer Apr 27, 2026 8 min read

Junior CTI Analysts Need to Learn How the Pieces Fit Together

Juniors can recognize the actor name, copy the IOCs, and map MITRE techniques. The harder part is figuring out whether any of it matters to the organization — and what someone should actually do next.

CTITradecraftTraining

Jason Faulhefer Apr 25, 2026 6 min read

Claude Mythos and the OT Threat Horizon: What Utility Operators Need to Know Now

Mythos is a frontier AI system capable of autonomously discovering zero-days in every major OS and browser — software underpinning the HMIs, engineering workstations, and remote access gateways in your control centers today.

OT/ICSNERC CIPArtificial Intelligence