Anticipate: Threat Intelligence and Exposure at Machine Speed

All courses / AI Blue / Module 2 / Chapter 5

Learning objectives

After the lesson the participant can:

• Describe the five stages from report to routed hypothesis and locate the two human decision points and the verification step
• Explain what EPSS, the KEV catalogue and the EUVD each answer and why none of them replaces local asset context
• Identify the five things AI does badly in intelligence extraction and the control that answers each
• Design a weekly intelligence-to-detection routine with a named reviewer, seeded errors and a conversion rate

Key concepts

Hypothesis

A statement about adversary behaviour that could be true in this estate and can be tested. An accepted hypothesis is routed to a detection requirement, a hunt, a patch priority or a recorded decision to do nothing, with the reason.

Grounding check

Every technique, indicator and claim in an extraction links to a quoted span of the source. A proposal without a span is rejected without further discussion.

The join

The B1 task of combining each vulnerability from the public feeds with local asset context, such as internet reachability, the data and business process carried and compensating controls, because the feeds know nothing about the organisation.

Seeded errors

Known errors inserted into a share of batches, such as an altered indicator, a neighbouring technique or an unsupported attribution, to measure whether review catches them. The routine seeds one in every batch of twenty proposals.

Conversion rate

The share of accepted hypotheses that reached a deployed detection, a completed hunt or a changed priority within 30 days, measured monthly and reported at team level.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The decision to accept a hypothesis is described as the one least suited to automation. What does your organisation know about itself that an extraction system would not have been told?
2. Hansa Mutual's risk is that extraction outruns the engineering capacity to use it. How would you recognise a flood of accepted but unused hypotheses, and what would you change?
3. A grounding check does not catch tampered provenance, because the quoted text is genuine. Which of the chapter's controls covers that hazard, and how strong is it?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Why does the extraction system in the chapter's pipeline hold no tools that act, such as updating a block list?

   1. Because adversaries write some of what it reads, so a hostile document must end as no more than a bad proposal
   2. Because the AI Act classifies intelligence extraction as a high-risk AI system that may not act
   3. Because STIX 2.1 objects cannot be written to a block list automatically
   4. Because the exposure feeds are refreshed too rarely for automated use
   Show the answer

   A. Because adversaries write some of what it reads, so a hostile document must end as no more than a bad proposal
   The chapter's controls for hostile sources do not depend on the model behaving well: at Level 1 Assisted the extractor writes a proposed record to a queue and cannot change any control.

2. What does the EPSS feed provide, according to the chapter?

   1. A list of vulnerabilities for which exploitation in the wild has already been observed
   2. A European database launched by ENISA under the NIS 2 Directive
   3. A probability that a published CVE will be exploited in the wild in the next 30 days
   4. A ranking of the organisation's assets by internet exposure
   Show the answer

   C. A probability that a published CVE will be exploited in the wild in the next 30 days
   EPSS estimates the likelihood of exploitation in the next 30 days; KEV says exploitation has happened, and the EUVD adds European coverage. None knows anything about the organisation.

3. In the routine's defaults, what does the seeded-error catch rate control?

   1. Whether the extraction system may be promoted to Level 3 Bounded
   2. Which analyst receives the reviewer role in the following quarter
   3. Whether indicators in the block list are allowed to expire
   4. Whether the team may move from full review to sampled review
   Show the answer

   D. Whether the team may move from full review to sampled review
   The routine keeps full review until the catch rate is established, and the summary states that a catch rate that falls returns the team to full review.