Cyber threat intelligence in practice: Implications of the blurred lines between public and private intelligence activity

Intelligence is recognised as crucial for strengthening organisational security, particularly in the cyber domain. Companies have developed their own intelligence capabilities to address this requirement. Cyber threat intelligence (CTI) has historically been understood as a primarily technical, politically neutral practice. In contrast, this paper argues that CTI is socio-technical, collaborative and political. Interviews with industry and government practitioners were undertaken to better understand how CTI practitioners viewed their work. The findings underlined the importance of personal trusted relationships and collaboration. Companies were found to be working closely with government, often in ad hoc and informal ways. Moreover, the public and private sector were viewed as having different, complementary forms of visibility into the cyber domain. Together, this has contributed to a blurring of the lines between public and private organisations. These findings suggest that companies should promote trusted personal relationships through a combination of formal and less formal methods. At the same time, companies should be alive to the risks inherent in conducting intelligence activities in ‘operational intimacy’ with state actors, particularly in a period of increasing geopolitical competition and conflict.