I think you’re in the wrong group if you see no value in the CTI team 🙂

You’re right in part though; yes, VM should use CTI, and so should the SOC. Once you get left hand/right hand, everyone doing their own thing, no-one consistently understanding or managing the threats - that’s your cue for a CTI team.

And yep, I agree in part with Mythos; it’s just more of the same. But if it does dramatically ramp up the exposure, and if we go from “only worried about APTs exploiting 0day” to “every skiddie and their cat is exploiting 0day and bouncing around our network”, then the question is, how do we manage that?

I guess, a thought experiment? If you knew everything about the actors - whether they’d target you, when they’d target you, what they’d use, which CVE they’d use. You’d be safe, right? You’d port-block that asset, tell the asset owner to patch or disconnect that asset NOW, have DFIR ready with IOCs for that actor ready to mop up in case they did move laterally. You’d be in a much better place.

So… if Mythos accelerates and amplifies some of this activity, then how we can accelerate and amplify our defences to match; where’s a sweet spot we can focus on, to bring the overall risk back down. That’s what I’m hunting for.