Cyber Threat Intelligence is spreading. The SANS CTI Survey 2026 recorded 90% of organizations have allocated resources to CTI, from small functions to dedicated teams. However, far fewer know how to get the most out of it, so CTI teams often have their ROI questioned.
Part of that is on the CTI team itself. Part of it comes down to organizational structure, training, policies, and how well leadership positions the team for success.
So this article speaks to you, the leaders around and above CTI teams, as well as the teams themselves.
Four ideas to explore
And none of them involve buying a new $250,000 Threat Intelligence Platform (TIP).
Enroll every CTI analyst in tailored business training.
Have CTI work directly with your revenue generating teams.
Put demand and capacity behind forecasting.
Enable access to AI tools, with governance and guardrails.
These recommendations draw on my ten years in threat intel, plus 23 CTI practitioner research interviews and 20 survey responses collected in 2026. To acknowledge my bias, my career has been in the private sector, so the article’s language leans that way, though most ideas transfer to other sectors.
1. Enroll every analyst in business training
Get more from your CTI team by enrolling analysts in business training that is highly tailored to your organization. It should cover what the core business is, how your company makes money, where it operates, its supply chain, relevant regulations, and how the executive committee and board operate. Analysts from computer science or political science backgrounds can find the business side foggy. This education helps them tie a threat to a business outcome and prioritize it by its real impact.
This is not an original idea, many CTI leaders recommend analysts get business-savvy:
“I would recommend analysts invest time in understanding things like how does a business operate, how do executives think about risk, what do stakeholders actually care about and then ultimately how is a decision made and I think if they can understand those dynamics the value, how effective their intelligence [is] will increase drastically.” Craig Watt, Senior Threat Intelligence Consultant.
But where we can level up is by the organization taking ownership and building a proper training course, rather than a one-hour presentation. The more analysts know about the organization, the easier it is to protect.
2. Mandate a relationship between CTI and the revenue generators
Have your CTI team spend time with the primary revenue generating teams. The goal is to build relationships, understand their intelligence needs, and collect intelligence requirements from them that shape CTI collection and production. For example, if CTI builds a relationship with a capital markets team, they can provide intelligence on the cyber and geopolitical risks in a region to help that team evaluate investing there.
Our organization has “AI tools, we have chatbots, we have AI products, and so you have to keep an eye on the entire market of how they’re being abused […] so that way you can come back and help your product teams as well.” Jen Kwas, Senior CTI Analyst, SaaS company.
CTI then stops only serving stakeholders in your Information Security department and starts serving the highest-impact business units. CTI can play a direct role in the organization making better decisions about expanding business operations into new markets and geographies. This is a crucial step in shifting CTI from a perceived cost-centre into one that enables business.
“The asks move from “hey, CTI, we need you to triage this alert” […] to “we need you to provide context or clarify why this particular thing matters to the business.” Brett A. Tolbert, Principal Cybersecurity Advisor, Energy sector.
3. Ring-fence time for forecasting
One of CTI’s most underused services is forecasting with structured analytic techniques (SATs). We are going through some of the most volatile geopolitical and technological landscapes simultaneously, alongside inflation, trade wars, and real wars. Strategic intelligence forecasts can provide early warning of what could happen next, but the tyranny of immediate intelligence (responding to today’s incidents) so often consumes analysts’ time.
Change this by ring-fencing capacity for forecasting. Set the expectation that CTI will start providing forecasts on the top three crises for quarterly C-suite meetings. The objective? Help inform the C-suite so they can better navigate your organization through today’s messy operating environment.
Targeting forecasts at your organization’s senior leaders justifies pulling analyst hours away from producing immediate intelligence, and drives CTI’s value right to the top of the organization.
“If something happens that has a geopolitical implication, that has downstream macroeconomic effects, it has supply chain effects, and it has regulatory effects […] If you can translate all those things into ‘hey, this is going to affect our business’ […] that’s where the strategic side of intel really comes into play.” Kyle Croll, CTI Lead, Toyota Financial Services.
4. Give them AI tools, with guardrails and governance
AI or automation came up with 22 of the 23 CTI practitioners I interviewed. In a subset of 13 research interviews, I asked about the educational content they need, 12 said AI.
Exploring AI is key for CTI analysts staying competitive. The SANS 2026 CTI Survey noted 45% of organizations are currently using AI in their CTI programs, with another 32% planning to adopt it. More importantly, it’s key to keeping up with the threat actors abusing LLMs.
Organizations should position their analysts to safely explore this technology’s use cases and limitations. We want exploration that speeds up workflows without risking intelligence quality. Enable this by giving CTI teams access to tools on the condition that policy, governance, and guardrails are used.
For an excellent policy example, I recommend the free “Responsible AI Integration Guidelines for CTI Teams” in Audra Streetman’s article, Quantifying and communicating the value of human-led intelligence in an AI era.
Why not run an experiment?
The biggest tragedy I’ve observed with CTI is its true value is rarely felt outside its inner circle of stakeholders. That can all change. Even if you implemented one or two of these ideas, your CTI team could add significantly more value to your organization. What do you have to lose?
[CTA: For more articles and free resources by Josh, visit TI Essentials: https://feedly.com/ti-essentials]