Follow-up: I asked last month about CTI aggregators for CISOs
A month ago I asked this sub how CISOs actually consume threat intel. The thread wasn't too active but was gold.
A few things worth noting:
- One of you gets Claude Code to generate a morning threat brief mapped to your stack, industry, and geos. That's the product half the vendor market is trying to sell.
- Another said the best CTI they've seen is an analyst who writes a weekly one-pager — which quietly anchors the real price of this problem at $80K–$120K/year.
- Recorded Future / Dataminr users kept saying the same thing: the intel is fine, the synthesis is the bottleneck.
Then I come across the SANS 2026 CTI Survey who said the quiet part out loud: 91% of CISOs value CTI, only 26% say it actually influences their decisions. A 65-point gap.
So I started a small newsletter to test one hypothesis: what if threat briefs were written as decision packages, not intelligence reports? Act Now / Watch / Awareness. Two pages max. AI in the loop, human on the call.
Issue #0 is a manifesto, not a threat brief. Issue #1 will be the real thing. I'm publishing in the open partly to keep myself honest.
Link in comments. Not selling anything.
Question back to the sub: if you had to cut a CTI report down to one screen your CEO would actually read before their 8am, what stays and what dies?