ThreatSpire logoThreatSpire

The ThreatSpire Field Notes

Intelligence, written by analysts — for analysts.

Tradecraft, threat-landscape reads, and opinion from the ThreatSpire team. Plain language, evidence-first, no vendor noise.

Remote Access Is Still the Front Door to OT
Jason Faulhefer Jul 14, 2026 6 min read

Remote Access Is Still the Front Door to OT

Nearly every publicly reported OT intrusion of the last five years touched remote access at some point. Treating that pathway as a first class collection target is one of the highest leverage moves a CTI program can make.

AccessICS/OTThird Party

Read the post

All posts

Vendor Advisories Are Not Intelligence Yet
Jason Faulhefer Jul 14, 2026 5 min read

Vendor Advisories Are Not Intelligence Yet

A vendor advisory is raw material. Turning it into intelligence for an ICS/OT environment takes exposure mapping, exploitability assessment, and a clear tie to a decision.

CTIICS/OTVulnerabilities
NERC CIP and CTI: Turning Compliance Controls Into Detection Value
Jason Faulhefer Jul 14, 2026 7 min read

NERC CIP and CTI: Turning Compliance Controls Into Detection Value

Most CIP programs treat compliance and threat intelligence as separate universes. The controls that CIP already requires are, with small additions, one of the richest detection surfaces a utility can build.

NERC CIPICS/OTProgram
Actor Tracking for ICS Groups: How to Follow VOLTZITE, ELECTRUM, and Peers Without Losing the Signal
Jason Faulhefer Jul 14, 2026 8 min read

Actor Tracking for ICS Groups: How to Follow VOLTZITE, ELECTRUM, and Peers Without Losing the Signal

ICS focused groups do not behave like ransomware crews. Tracking them requires a different cadence, different collection sources, and a different bar for attribution.

Threat ActorsICS/OTCTI
IOCs in OT: Why Hashes and IPs Fail in the Substation
Jason Faulhefer Jul 14, 2026 6 min read

IOCs in OT: Why Hashes and IPs Fail in the Substation

The IT playbook of hash and IP indicators breaks down inside a substation or plant. Effective OT indicators look more like protocol behavior, engineering workstation drift, and unexpected point writes.

IOCsICS/OTDetection
Purple Team Intelligence: Red Team Findings as a Controlled Collection Source
Jason Faulhefer Jun 25, 2026 8 min read

Purple Team Intelligence: Red Team Findings as a Controlled Collection Source

Red team engagements are usually treated as audits. Treat them as a controlled collection source instead and your CTI program gains ground truth that no feed can match.

purple teamred teamcti collection
Writing Intelligence Assessments That Executives Actually Read
Jason Faulhefer Jun 24, 2026 8 min read

Writing Intelligence Assessments That Executives Actually Read

Most CTI reports lose the executive in the first paragraph. Apply the Pyramid Principle and you will get read, understood, and acted on.

intelligence writingexecutive communicationcti
The SOC and CTI Feedback Loop: How Threat Intel Earns Its Seat in the SOC
Jason Faulhefer Jun 23, 2026 7 min read

The SOC and CTI Feedback Loop: How Threat Intel Earns Its Seat in the SOC

CTI teams complain that the SOC ignores their reports. SOC teams complain that CTI is theoretical. The fix is a small set of feedback rituals.

soc operationsctioperational intelligence
Dark Web Monitoring for CTI: Collection Tradecraft for Underground Markets
Jason Faulhefer Jun 22, 2026 8 min read

Dark Web Monitoring for CTI: Collection Tradecraft for Underground Markets

Dark web monitoring is the most oversold capability in CTI. Done right, it is also one of the most useful. Here is the collection tradecraft that separates the two.

dark webcti collectiontradecraft
Threat Hunting with Intelligence Requirements: Hypothesis-Driven Sweeps That Actually Find Things
Jason Faulhefer Jun 19, 2026 8 min read

Threat Hunting with Intelligence Requirements: Hypothesis-Driven Sweeps That Actually Find Things

Most hunts are searches for the things you already know how to detect. A PIR driven hunting program asks the questions your detections cannot answer.

threat huntingctipirs
Ransomware Negotiation Leaks: Using Leak Site Data to Model the Adversary's Business
Jason Faulhefer Jun 18, 2026 8 min read

Ransomware Negotiation Leaks: Using Leak Site Data to Model the Adversary's Business

Leak site posts and negotiation transcripts are public, abundant, and underused. Read them like a business analyst and you can predict pricing, dwell, and exfiltration behavior.

ransomwarectileak site analysis
Supply Chain Intelligence: Vendor Risk Through an Intelligence Lens
Jason Faulhefer Jun 17, 2026 7 min read

Supply Chain Intelligence: Vendor Risk Through an Intelligence Lens

Vendor risk programs ask the wrong questions and get the wrong answers. Here is how to apply a CTI lens to the suppliers most likely to bring an adversary into your network.

supply chainthird party riskcti
Nation-State Attribution: Communicating Uncertainty Without Diluting Impact
Jason Faulhefer Jun 16, 2026 7 min read

Nation-State Attribution: Communicating Uncertainty Without Diluting Impact

Attribution is a probabilistic claim, not a verdict. Here is how to communicate confidence honestly without producing a report that no one can act on.

attributionctiintelligence writing
The Half-Life of an IOC: Operationalizing Decay and Confidence Scoring
Jason Faulhefer Jun 15, 2026 7 min read

The Half-Life of an IOC: Operationalizing Decay and Confidence Scoring

An IOC is not a fact. It is a perishable claim. Treat indicators like radioactive isotopes with a half-life and your blocklists, hunts, and reports get a lot more honest.

indicators of compromisectidetection engineering
From ATT&CK Mapping to Detection Logic: Closing the SIEM Handoff Gap
Jason Faulhefer Jun 12, 2026 8 min read

From ATT&CK Mapping to Detection Logic: Closing the SIEM Handoff Gap

Mapping a report to MITRE ATT&CK is not the same as detecting the behavior. Here is how to translate technique IDs into SIEM and SOAR logic your SOC can actually run.

mitre attackdetection engineeringctisoc
Intelligence Requirements Management: Tracking, Reviewing, and Retiring PIRs
Jason Faulhefer Jun 11, 2026 10 min read

Intelligence Requirements Management: Tracking, Reviewing, and Retiring PIRs

Creating Priority Intelligence Requirements is only half the battle. The other half is managing them over time: tracking progress, reviewing relevance, and knowing when to retire a requirement that has served its purpose or outlived its usefulness.

CTIPIR ManagementIntelligence Lifecycle
The CTI Intelligence Collection Plan: Turning PIRs into Daily Analyst Work
Jason Faulhefer Jun 10, 2026 11 min read

The CTI Intelligence Collection Plan: Turning PIRs into Daily Analyst Work

A practical guide to building a CTI collection plan that converts approved PIRs into the daily analyst rhythm - source assignments, frequencies, named owners, gap registers, and weekly reviews that keep the plan alive.

CTICollection PlanIntelligence Requirements
Cyber Threat Intelligence Requirements: Translating Business Risk into Collection Tasks
Jason Faulhefer Jun 8, 2026 7 min read

Cyber Threat Intelligence Requirements: Translating Business Risk into Collection Tasks

How to turn vague executive worries about cyber risk into specific, assignable intelligence collection tasks - with a five-part requirement template and a 30-day starter plan.

CTIIntelligence RequirementsRisk Management
Building a Threat Intelligence Program Around Intelligence Requirements
Jason Faulhefer Jun 4, 2026 12 min read

Building a Threat Intelligence Program Around Intelligence Requirements

Most threat intelligence programs start with a feed subscription and a wish. The ones that succeed start with a clear set of intelligence requirements that tie every collection decision, every analysis product, and every dissemination channel to a decision-maker's need.

CTIIntelligence RequirementsProgram Design
Building an Evidence Timeline
Grimm's Gadgets Jun 4, 2026 8 min read

Building an Evidence Timeline

Don't paste a pile of bullet points and call it an actor timeline. Record what was reported, where it came from, how good the source is, and what *you* concluded, all kept separate. Then it survives the "how do you know?" question.

CTIEEITLDR
The Intelligence Requirements Process: From Stakeholder Question to Evidence-Backed Answer
Jason Faulhefer Jun 2, 2026 10 min read

The Intelligence Requirements Process: From Stakeholder Question to Evidence-Backed Answer

A step-by-step walkthrough of the Intelligence Requirements Process — the repeatable workflow that turns a stakeholder question into an evidence-backed answer that actually changes decisions.

CTIIntelligence RequirementsProcess
Intelligence Requirements Examples: 12 PIRs Mature CTI Teams Actually Use
Jason Faulhefer Jun 1, 2026 9 min read

Intelligence Requirements Examples: 12 PIRs Mature CTI Teams Actually Use

Twelve real Priority Intelligence Requirements that mature CTI teams maintain — with the decisions they support, the consumers they serve, and the IRs and EEIs that flow out of each. Use them as templates for your own program.

CTIPIRIntelligence Requirements
How to Develop Priority Intelligence Requirements (Step-by-Step with Examples)
Jason Faulhefer May 30, 2026 12 min read

How to Develop Priority Intelligence Requirements (Step-by-Step with Examples)

A practical, step-by-step process for developing Priority Intelligence Requirements that drive decisions instead of noise. Includes concrete examples, templates, and a checklist.

CTIPIRIntelligence Requirements
What Are Priority Intelligence Requirements? Definition, Examples, and How They Drive a CTI Program
Jason Faulhefer May 29, 2026 8 min read

What Are Priority Intelligence Requirements? Definition, Examples, and How They Drive a CTI Program

Priority Intelligence Requirements are formal questions that connect threat intelligence to real decisions. Learn what PIRs are, see real-world examples, and discover how they transform a CTI program from reactive reporting into strategic security.

CTIPIRsIntelligence Requirements
Priority Intelligence Requirements (PIRs): A Practical Guide for CTI Teams
Jason Faulhefer May 29, 2026 9 min read

Priority Intelligence Requirements (PIRs): A Practical Guide for CTI Teams

PIRs are the contract between CTI and the people who use it. A practical guide to writing, ranking, and operating Priority Intelligence Requirements without turning your program into a paperwork exercise.

CTIPIRsIntelligence Requirements
Grimm Gadgets May 4, 2026 4 min read

Do Not Rush

When advisories drop and Slack lights up, analysis fragments. A controlled approach — observed, assessed, unknown, next actions — keeps reasoning intact while everything else accelerates.

AnalysisTradecraft
Jason Faulhefer May 4, 2026 9 min read

The Double-Edged Sword of AI: Why Faster Development May Be Creating Bigger Cyber Risks

AI is making developers faster and analysts more efficient — but it is also shipping insecure code, exposed secrets, and unreviewed cloud infrastructure at machine speed. The result is a new class of invisible enterprise risk.

Artificial IntelligenceAppSecDevSecOps
Grimm Gadgets Apr 28, 2026 5 min read

AI Did Not Replace the Attacker. It Made the Attacker Faster.

The 2025 breach data tells a clear story: credential theft, phishing, and unpatched systems still dominate. AI did not invent new intrusion categories — it accelerated the ones attackers were already running.

Artificial IntelligenceThreat Landscape
Jason Faulhefer Apr 28, 2026 7 min read

Threat Intelligence Is Broken: Why Most Organizations Collect Feeds But Gain No Real Defense

Most enterprises have built an expensive repository of disconnected threat data that rarely yields measurable defensive outcomes. The fix is operational intelligence — relevance, exposure, exploitability, action.

CTIStrategySOC
Jason Faulhefer Apr 27, 2026 8 min read

Junior CTI Analysts Need to Learn How the Pieces Fit Together

Juniors can recognize the actor name, copy the IOCs, and map MITRE techniques. The harder part is figuring out whether any of it matters to the organization — and what someone should actually do next.

CTITradecraftTraining
Jason Faulhefer Apr 27, 2026 7 min read

Cybersecurity Has Entered the Autonomous Machine Defense Race

Anthropic Mythos, Google''s agentic SOC, Microsoft''s AI Zero Trust, and CrowdStrike''s AI runtime security — taken together, these are not isolated product launches. They signal an industry-wide control-plane shift.

StrategyArtificial IntelligenceSOC
Jason Faulhefer Apr 25, 2026 6 min read

Claude Mythos and the OT Threat Horizon: What Utility Operators Need to Know Now

Mythos is a frontier AI system capable of autonomously discovering zero-days in every major OS and browser — software underpinning the HMIs, engineering workstations, and remote access gateways in your control centers today.

OT/ICSNERC CIPArtificial Intelligence