Solving for Opportunity: The Role of Threat Intelligence in the Age of AI

Recently, someone asked me whether the age of AI meant the death of threat intelligence (TI).

It’s not the death, but it does mean that TI, alongside most of the security discipline, must evolve quickly.

TI is designed to take raw data from disparate sources and turn it into actionable, defensive steps that help organizations strengthen their security posture. But in the AI age, the information we can learn about an adversary and how long that information remains true is fundamentally shifting. 

That means TI practitioners have to reevaluate how we actually help keep people safe.

Security has long defined threats as a combination of capability, intent, and opportunity. Opportunity has usually been the most difficult element to characterize, because it varies significantly between client environments, systems, and exposures. 

Today, that equation is changing with a shifting focus toward collecting and understanding opportunity data.

The Challenge of Creating Meaningful Impact

TI has historically gotten a bad rep for “admiring the problem.” Intel shops around the world, including ones I’ve worked in, have published 75-page reports that buried readers in technical detail without clearly explaining what steps they could take to reduce the threat. The community has noticed that the long-form report is becoming less popular. Few people have the time to read through and distill the reports into meaningful steps for their own organization.

This is a lesson the U.S. Federal government recognized decades ago. When I worked for the Department of Defense, the majority of our reports for policy-makers were a maximum of three pages, including any graphics. And that was when we were managing just a fraction of the data and alerts that exist today.

With documented intrusions drastically increasing, tens of thousands of CVEs being published every year, and vendor research teams publishing actor reporting on top of that, we have more data than we know what to do with. These reports make their way to defenders, who then have to determine whether any of it applies to them.

That leaves executives and security practitioners asking “what am I supposed to do with this data” and “what is the most important thing for me to handle first?” Those are the fundamental questions TI should help answer, when it’s done well.

Capability × Intent × Opportunity = Threat

The “how” of this effort comes down to a well-known model in the TI field. The most frequently used threat equation posits that Capability × Intent × Opportunity = Threat.

TI has always attempted to measure all three elements, but we’ve primarily focused on Capability and Intent when asked to analyze risk outside our own organization. This is because we could accurately determine whether a threat actor had the skill to do what organizations were worried about, and whether that skill supported that threat actor’s broader targeting missions.

Opportunity doesn’t function in the same way since it has to be observed inside specific environments and it changes frequently. This means we typically assessed Opportunity more vaguely, informed by occasional point-in-time penetration tests, infrequent scans, or a scoped assessment covering a subset of systems.

Historically, this was not something most organizations could measure in a scalable way. And while agentic testing is what now makes that possible at scale, AI is also the reason that the Capability and Intent categories are becoming less predictive indicators on their own.

We’ve measured Capability by looking at a threat actor’s skills, based on factors like custom malware, exploit development, and the infrastructure they stood up. That assessment is less relevant when those capabilities can be augmented by AI, giving more people advanced technical skills they previously didn’t have at their disposal.

Opportunity is the one area where organizations actually have the control to enact change.

In a similar vein, we’ve judged Intent by victimology and timing: who an actor targets, and whether attacks line up with world events. But Intent is a human trait. When AI tools, not people, decide what to attack next, the result may reflect what was exploitable rather than what anyone intended.

This evolution is extremely important for TI teams, because Opportunity is the one area where organizations actually have the control to enact change.

Filling the Gaps in Opportunity Data

Part of the AI transformation is that opportunity data derived from penetration testing no longer needs to be sporadic. It’s now possible to run continuous, agentic penetration tests to reveal exploitable risk.

‍This is the type of data Armadin’s Threat Intelligence team focuses on: opportunity data that informs opportunity intelligence.

Analyzing this data at scale is where I’ve felt the most hope in creating clear, actionable TI in the age of AI. The IT and cybersecurity communities are, quite frankly, exhausted. The role requires a constant focus on defense, and we lose that fight too often, because it’s inherently asymmetric. We need to identify and defend all footholds, while our adversaries only need to get through our defenses once.

It’s also a long-running joke in the TI and cyber communities that our adversaries always seem to find their way in on our nights, weekends, and holidays. Our response plans reflect that reality.

But it’s refreshing what we found during our analysis of this adversary opportunity data. We’re seeing major consistencies in where and how organizations are vulnerable. We’ve assumed, for a long while, that opportunity data is inherently unique for each organization. What we’re finding is that reviewing it in bulk produces clear patterns that help organizations know where to put budget and effort, rather than guessing.

These are only a few of the key takeaways in our findings, so I’d encourage you to take a look at this new data as a whole:

• The asymmetry can be less one-sided than it has historically seemed, once you look at kill chains rather than individual findings. In this case, an adversary needs every step in a chain to succeed, but a defender only needs one of them to fail. Even among the small share of findings where no vendor patch existed, most had a point somewhere in the chain where the organization could sever it.
• In 93% of the severe findings we evaluated, the weakness could be remediated by the organization without relying on third party action. This felt huge, considering the defensive burden most practitioners have struggled with.
• Building on this, roughly half of the severe findings we uncovered could be fixed without application code, meaning they didn’t require engineering-focused sprints before a client could be defended. For anyone who has fought that fight before, you already know what great news that is.
• Finally, 88% of our severe findings were outside of external published sources. That might sound like bad news, given how many security teams prioritize this data. Published CVEs and KEV entries still matter, but they describe only a fraction of what an attacker can reach in a given environment. Chasing them alone leaves most of the exposure unseen. We’re working on closing that gap even further through our “Emerging Threats” pipeline, but that’s a story for another time.

In 93% of the severe findings we evaluated, the weakness could be remediated by the organizations without relying on third-party actions.

Which brings me back to the original question about whether TI is dead.

Threat intelligence isn’t dying, but the element of it that produces the most value might look different going forward. For most of my career the useful TI work was describing adversaries, because that was what we could see at scale. Even though Opportunity was always the more actionable term, it was challenging to measure in meaningful ways. That is what has changed, in my perspective, for TI in the age of AI.

We’re still early in this evolution, but I have confidence that we’re returning to our roots. TI’s goal has always been to turn data into defensive steps somebody can actually take. Focusing on measurable, actionable opportunity intelligence is what will give organizations the control to do so.

Read the Findings

Download Opportunity Intelligence: Reducing Exposure to Adversaries to see the detailed findings.

View the Press Release >>