Curiosity might be a disease, and I’m pretty sure my condition is terminal. I’ve always had a hard time…
James W. — Decision Intelligence Executive
Curiosity might be a disease, and I’m pretty sure my condition is terminal. I’ve always had a hard time accepting the first answer, especially in threat intelligence. Someone tells me who the actor is, and I want to know why we think that. We find the vulnerability they exploited, and I start wondering why they chose that one. We see them targeting a particular part of the business, and now I want to understand what they know about that environment that we might not.
That tendency can probably be exhausting for people who just want the assessment finished, but I think there’s real business value in refusing to stop at the convenient answer.
CTI gets interesting when curiosity takes us beyond indicators and into relationships. Adversary behavior starts connecting to business dependencies, identity, architecture, third parties, operational weaknesses, and ultimately the things the organization cannot afford to lose or interrupt.
Sometimes that curiosity confirms what we already suspected, while other times it completely wrecks a comfortable assumption and forces us to rethink where we’re spending money, what we’re hunting for, or which risk actually deserves attention.
I’m increasingly convinced that the second outcome is where some of the best intelligence happens, because being wrong early enough to change direction is considerably cheaper than being confidently wrong during an incident. So if curiosity really is a disease, I’m probably not looking for treatment; I’d rather keep asking the question everyone thought we had already answered.
3 reactions · 1 comments
Comments
Mario M.: What stands out to me is the difference between knowing what happened and understanding why it happened. In CTI, the second question often seems more valuable. An IOC or TTP tells us something about the attack, but understanding why a specific vulnerability, target, or access path was chosen can reveal much more about the adversary and the environment they were targeting.