JAGS keynote: The intricacies of wartime cyber threat intelligence

May 9th, 2025  |  31 mins 7 secs

apt research, cti, nation-state, threat-intel, zero-day

Three Buddy Problem - Episode 45: (The buddies are trapped in timezone hell with cross-continent travel this week).

In the meantime, absorb this keynote presented by Juan Andres Guerrero-Saade (JAG-S) at CounterThreats 2023. It's a frank discussion on the role of cyber threat intelligence (CTI) during wartime and its importance in bridging information gaps between adversaries. Includes talk on the ethical challenges in CTI, questioning the impact of intelligence-sharing and how cyber operations affect real-world conflicts. He pointed to Ukraine and Israel as examples where CTI plays a critical, yet complicated, role. His message: cybersecurity pros need to be aware of the real-world consequences of their work and the ethical responsibility that comes with it.

Acknowledgment: Credit for the audio goes to CyberThreat 2023, SANS Institute, NCSC, and SentinelOne.

Cast: Costin Raiu, Juan Andres Guerrero-Saade and Ryan Naraine.

Michael Laventure, threat detection and response, Netflix

June 10th, 2021  |  30 mins 32 secs

supply chain, threat-hunting, threat-intel

Netflix threat detection and response practitioner Michael Laventure joins the show to talk about a simple goal to "do security better." We discuss a transition from .gov security work to the fast pace of Silicon Valley, the culture clashes that can make life difficult, the value of threat-intelligence to a modern security program, and why we should all be optimistic about the future of cybersecurity.

Costin Raiu, Global Director, GReAT, Kaspersky Lab

September 3rd, 2018  |  51 mins 21 secs

apt, ics-scada, targeted-attacks, threat-intel

Veteran malware hunter Costin Raiu talks about writing his own an anti-virus program as a teenager in Romania, his work tracking advanced threat actors globally, and why he assumes his computer is compromised by at least three APT groups.

Josh Lefkowitz, Founder and CEO, Flashpoint

August 28th, 2018  |  32 mins 10 secs

analytics, entrepreneur, internet-scans, threat-intel

Flashpoint chief executive Josh Lefkowitz talks about how his previous work as a counter-terrorism analyst underscored the value of contextual threat-intelligence, his company's approach to gathering and analyzing data, and his mission to be an extension of a client's security team.

Dan Hubbard, Chief Security Architect, Lacework

July 16th, 2018  |  38 mins 12 secs

analytics, entrepreneur, internet-scans, threat-intel

Lacework Chief Security Architect Dan Hubbard joins the podcast to discuss his new research on container security, the challenges of securing cloud deployments, and why technological advancements have widened attack surfaces.

Andrew Morris, Founder and CEO, GreyNoise Intelligence

May 31st, 2018  |  37 mins 19 secs

analytics, entrepreneur, internet-scans, threat-intel

Founder and CEO of GreyNoise Intelligence Andrew Morris talks about his anti threat-intelligence company, the ways SOCs are using it to filter through scanning noise and the trials and tribulations of bootstrapping a start-up.

Juan Andrés Guerrero-Saade, Principal Security Researcher, Recorded Future

May 14th, 2018  |  1 hr 1 min

apt, threat-intel

Principal Security Researcher at Recorded Futures Insikt Group, Juan Andrés Guerrero-Saade, explains the nuances of good threat intelligence, sheds light on nation-state hacker activity and warns that adversaries don't have to be sophisticated to launch successful attacks.

Robert M. Lee, Chief Executive Officer, Dragos Inc.

May 10th, 2018  |  54 mins 44 secs

apt, ics-scada, targeted-attacks, threat-intel

The founder and CEO of Dragos, Inc. Robert M. Lee cuts through the hype around threats to critical infrastructure and offers a matter-of-fact take on active defense, “hacking-back,” and nation-state espionage operations.

Mischel Kwon, Founder and CEO, MKA Cyber

April 26th, 2018  |  39 mins 2 secs

analytics, entrepreneur, internet-scans, threat-intel

Founder and CEO at MKACyber Mischel Kwon joins the podcast to address the state of the SOC (Security Operations Center) and how businesses should deal with issues around excessive alerts, incident response times, and outdated metrics.

Tim Maurer, Scholar, Carnegie Endowment for International Peace

March 5th, 2018  |  32 mins 31 secs

apt, ics-scada, targeted-attacks, threat-intel

Tim Maurer, a scholar at the Carnegie Endowment for International Peace, talks about nation state-backed hacking activity and the dangers of breaking trust in the global financial system.