AI and threat intel: first steps to integrate Artificial Intelligence into your Cyber Threat Intelligence efforts

When an emerging technology comes along, it's natural to ask how it can be implemented to help with our specific challenges. With AI, it's no different. While tools like ChatGPT, Gemini, and Copilot were created for many general use cases, there's a lot of ground for innovating in more specialized applications, such as Cyber Threat Intelligence and risk mitigation.

This can easily create confusion, questions, and doubts regarding what role AI can fulfill in your strategy. The very first step is understanding that you don't need to develop an AI solution from scratch. Platforms like Polaris are made to be ready for frictionless integration into many workflows while also being cost-effective.

Still, understanding where artificial intelligence can excel and how it can be made to perform to its full potential are also important steps to ensure this technology brings value to the team.

Match AI's strengths to your needs

As an industry, we are still exploring how AI can be used to tackle all kinds of problems. Focusing too much on what the technology will be able to do in the future may lead to missed opportunities since AI already has viable applications right now.

We already know deep learning algorithms and large language models (LLMs) can gather, analyze, and repackage information in a way that is more meaningful to us. Many tasks involve gathering or linking information from different sources, so thinking about how to automate these tasks with the help of AI is a great starting point.

For Cyber Threat Intelligence tasks, this means being able to collect information on threats, actors, and exposures. This has implications for open source intelligence (OSINT) since filtering data from all public sources—sometimes in several languages—is a considerable challenge for a human analyst. Most importantly, AI can do this fast.

The takeaway here is that looking at what AI does best is one of the easiest ways to find tasks that can be readily improved by it. There's no need to speculate whether AI will be better than your analyst when you're just employing the technology to speed up a step in a larger workflow or doing something that wasn't even possible before. Thanks to AI's cost-effectiveness and ease of deployment, it's very easy to experiment.

Making the most out of what AI can do

AI is good at filtering information, but it needs to know how. That's where your attack surface map comes in.

Your attack surface map and topics of interest are the keywords, topics, threats, vulnerabilities, systems, and exploits that matter the most to your business or your team. By feeding this information into Polaris, for example, the AI model can remove information that brings no value to your ecosystem.

This approach has several advantages. When analysts have a curated source of information, they can start working on that data immediately, allowing them to respond earlier to incidents or potential threats identified by the threat intelligence workflow.

The more you improve your mapping, the greater the benefits will be. While AI can check numerous sources, custom filtering will ensure analysts save time and reduce the number of alerts and events they must handle.

Covering your blind spots

Even if you're not yet ready to implement AI into your threat intelligence or risk mitigation workflows, you can also consider AI to cover current blind spots. Here are some ideas:

• Monitor new solutions or third parties. 

  When considering a new software solution (be it on-premises or as a software-as-a-service) for your environment, cyber security is an essential factor. AI can help you monitor risks or threats associated with a service or third party before any analyst spends time on an assessment. You can also share intelligence with your vendors and remain informed on any risks your ext.
• Stay informed about industry threats. Your current cyber threat intelligence effort may have prioritized specific threats or actors, meaning not all threats affecting your industry or business are being monitored. AI can quickly close that gap.
• Focus on AI where speed and availability matter the most. AI works 24/7. This can close an informational gap you may have at certain times when fewer analysts are active.
• Consider the advantages of content at scale. The intelligence collected by AI may be useful to different teams inside your organization. You can also use generational AI for other tasks that demand content at scale, such as user training (phishing training, for example).
  
  

It's easy to see that there are several avenues to take your first leap into AI. By starting from where it makes the most sense for you, no matter how modest at first, you can cast aside many of the complexities and challenges that come to mind when we think about AI. In truth, it's not really that difficult—as long as you take the first step, the rest of the journey will become a lot clearer.