However, traditional Purple Team exercises provide only a snapshot of an organization’s security posture at a given time. In rapidly evolving environments, where infrastructure, applications, security controls, and threats continuously evolve, assessment results can quickly become outdated. Consequently, organizations are left with a critical question: are the detections that worked yesterday still effective today? To answer that question, Purple Teaming must evolve from a periodic exercise into a continuous validation capability.

This article presents a modular workflow we developed to transform threat intelligence into automated adversary simulations. The workflow combines Caldera for attack orchestration, Mythic for realistic Command & Control simulation, and VECTR for measurable Security Operation Center (SOC) assessments: an automated workflow that only needs to be configured once and can be executed whenever needed.

Wavestone’s Purple Team vision and expertise

At Wavestone, we have been performing Purple Team exercises for several years to help our clients ensure that their detection methodologies are not only theoretically sound but truly functional in practice.

The primary objective of our Purple Team approach is to identify technical attack scenarios that go undetected by current security controls, and to identify tailored detection methods that close those gaps. Rather than simply simulating attacks, we systematically evaluate detection across three critical criteria: is the activity logged, has an alert been generated on those logs, and finally, has the alert been properly handled by the SOC team.

With the help of the Blue Team through regular meetings, this structured assessment allows us to identify quick wins (fast, high-impact improvements) and major projects that require deeper architectural changes or long-term investment, all of which are tailored for our client’s environment.

To do so, our Purple Team operations rely on multiple complementary approaches, each with its own strengths and limitations.

Unit Testing

Unit testing is the foundational approach focused on testing specific, isolated TTPs to validate the effectiveness of individual detection rules. By playing these attacks without context or environmental adaptation, security teams can verify that specific log sources, correlations, and alerts are correctly configured and generated as expected. While highly effective for validating individual controls, unit testing provides a restricted view of an organization’s global defensive posture: success against a single, isolated technique does not guarantee the ability to detect and respond to a complex, multi-stage attack chain.

In addition, unit testing introduces several important biases that can distort the realism of detection assessments. First, it requires collaboration with a Blue Team accomplice that provides the required assistance and prevents escalation from becoming too severe. This prevents the identification of some incident response gaps and greatly limits the secrecy of the operation.

Furthermore, once the SOC knows a Purple Team operation is underway, the incident response becomes biased, often for the worse. Since the surprise factor and the pressure of a real incident are absent, these tests do not accurately measure how the SOC would perform under the stress and ambiguity of a genuine, ongoing intrusion.

Trophy-Driven Engagements

Our second approach, trophy-driven engagements, allows us to assess detection through a more realistic scenario. These operations are designed for mature organizations, aiming to evaluate and elevate advanced detection processes and threat hunting capabilities rather than simply validating automated rules.

Similar to a Red Team operation, the offensive team executes a full-scale attack on the information system, not following a pre-defined test list but pursuing predefined trophies. An advantage of this approach is the ability to identify end-to-end scenarios.

Specifically, our trophy-driven engagements often follow the Red to Purple approach: while the Red Team has not been detected, the Blue Team is unaware of the operation which forces genuine and unscripted response. It provides a unique opportunity to evaluate the actual reactions of the security team, effectively bridging the gap between theoretical procedure and real incident response.

However, unlike the unit tests approach, these engagements are not exhaustive: they do not aim to map every specific unit rule on the environment, but rather to test the organization’s overall resilience against a defined adversary blending the detection rules, the escalation processes, the threat hunting and the correlation capability of the team.

Ultimately, trophy-driven engagements represent the final evolution in the Purple Team lifecycle, shifting the focus from “What are our detection flaws?” to “Would a real attacker actually be detected?”

SOC Assessments

SOC assessments focus on evaluating the operational readiness and performance of the SOC. Unlike the previous approaches, which validate detection, this approach measures the human and procedural capacity to detect, qualify, investigate, and remediate threats. It serves to validate that standard operation procedures and playbooks are effectively followed by analysts, while simultaneously identifying visibility gaps in logging and telemetry across the attack lifecycle.

However, SOC assessments often rely on structured scenarios that create a sense of artificiality. The engagement is still a trigger-and-response exercise sugarcoated with procedural validation and human factor evaluation.

Because these tests are centered on known, pre-planned triggers, they fail to force analysts to perform deep, investigative log correlation or to detect anomalous patterns across multiple, seemingly benign events : this test is still designed to « evaluate what is working today » and not « what must work tomorrow ».

Finally, this scripted nature leaves no room for genuine Threat Hunting. Indeed, the SOC is never pushed to proactively uncover the plan of the adversary in the long run. By focusing on reactive playbook execution rather than the ambiguity of an evolving campaign, these assessments miss an important aspect of the human factor evaluation: the inability to detect a sophisticated threat that does not trigger a predefined, “noisy” alert.

The “T-Time Trap”

Despite their differences, all three approaches suffer from the same fundamental limitation: they evaluate an organization’s security posture at a specific point in time.

Modern information systems are constantly evolving. Infrastructure migrations, cloud transformations, software deployments, and changes to security tooling can all affect the effectiveness of detection and response capabilities. A detection rule validated during a Purple Team exercise may no longer function as expected following a routine infrastructure change.

At the same time, threat actors continuously adapt their tactics, techniques, and procedures. With the development of AI augmented attacks, the defensive profile is constantly evolving: what was secured yesterday can be obsolete today.

Consequently, organizations must regularly reassess their defensive capabilities to ensure they remain aligned with the evolving threat landscape.

Yet the cost, complexity, and manual effort associated with traditional Purple Team engagements often prevent organizations from performing assessments at the required frequency. This creates a gap between security validation and operational reality, leaving defenders with only a periodic view of their true defensive readiness.

Empowering the Defense: Self-Service & CTI-Driven Automation

The limitations of traditional Purple Teaming raise an important question: how can organizations validate their defensive capabilities more frequently without significantly increasing costs and operational overhead?

The answer lies in shifting from consultant-driven assessments to defender-driven validation. Rather than waiting for periodic Purple Team engagements, security teams should be able to continuously assess their detection and response capabilities whenever needed.

CTI as the Engine of the workflow

Cyber Threat Intelligence (CTI) provides a valuable source of information on how threat actors operate. By documenting adversaries’ tactics, techniques, and procedures (TTPs), CTI enables organizations to move beyond generic attack simulations and focus on realistic threat scenarios relevant to their environment.

Instead of being treated as static reports consumed once and archived, CTI can serve as the foundation for repeatable defensive assessments. Every newly identified technique, campaign, or threat actor profile can become an opportunity to validate existing security controls and identify detection gaps.

Translating TTPs into Automated Scenarios

While CTI identifies what adversaries do, organizations still need a way to reproduce those behaviors in a controlled and repeatable manner.

By translating documented TTPs into automated attack scenarios, security teams can continuously test their ability to detect and investigate activities associated with specific threat actors. While this translation effort must be performed once, the resulting scenarios can be executed repeatedly with minimal overhead, allowing organizations to validate their defenses whenever needed.

This approach significantly reduces the manual effort traditionally required to prepare and execute Purple Team exercises while ensuring consistency across assessments.

Enabling Autonomous Defensive Assessments

Automation empowers the Blue Team to operate more autonomously. Instead of depending on external engagements or dedicated Red Team resources, defenders can execute assessments themselves whenever operational changes occur.

For example, assessments can be triggered following major infrastructure migrations, the deployment of new security controls, or the publication of threat intelligence related to a relevant adversary.

This self-service approach enables organizations to validate their defensive posture at the required frequency, ensuring that detection capabilities remain aligned with both infrastructure changes and the evolving threat landscape.

Overcoming Market Automation Limits: The Caldera & Mythic Integration

While attack orchestration frameworks already exist, they often come with operational limitations. For instance, Caldera relies on generic agents that do not implement advanced Command and Control (C2) capabilities such as in-memory PowerShell execution, Inline Assembly execution, or Beacon Object Files (BOFs). As a result, while Caldera excels at automating adversary emulation scenarios, it may not accurately reproduce the tradecraft employed by sophisticated threat actors. Furthermore, in environments where realism is a key objective, the presence and behavior of the Caldera agent may allow defenders to quickly identify the exercise, limiting the fidelity of the assessment.

Conversely, modern Command and Control frameworks such as Mythic provide realistic adversary simulation capabilities and advanced execution methods, but they lack the orchestration and automation features required to perform repeatable Purple Team assessments at scale.

To bridge this gap, we developed the Mythic plugin for Caldera, which integrates directly with the Mythic C2 framework. The objective was to combine Caldera’s automation and orchestration capabilities with Mythic’s realistic Command and Control capabilities. Within this architecture, Caldera remains responsible for orchestrating CTI-driven attack scenarios, while Mythic provides the execution layer used to simulate advanced adversary tradecraft.

This integration enables organizations to automate complex attack chains while maintaining a level of realism closer to that of real-world intrusions.

Mythic Caldera plugin: Adversary Emulation Library

The plugin extends Caldera by integrating Mythic C2 and providing custom adversary profiles, fact sources, payloads and parsers. Together, these components enable operators to quickly turn threat intelligence into automated adversary emulation scenarios while significantly reducing the need for manual configuration.

The plugin includes 5 custom adversary profiles, each designed to emulate a distinct threat model and associated attacker tradecraft:

• Insider: Simulates an internal attacker, such as a Windows Administrator, with TTPs implemented exclusively using Windows living-off-the-land binaries (LOLBins).
• Cybercrime: Simulates an opportunistic attacker leveraging publicly available offensive tools and remote attack techniques conducted through the Mythic SOCKS5 proxy infrastructure.
• APT: Simulates a sophisticated threat actor using advanced tradecraft, including low-level Windows API calls, Apollo built-in commands, and in-memory payload execution techniques.
• Linux – Insider: Simulates an internal attacker, such as a Linux Administrator, with TTPs implemented exclusively using native Linux commands and utilities.
• Linux- Cybercrime: Simulates an opportunistic attacker targeting Linux environments, with TTPs implemented using common open-source offensive tools.

To improve reusability, the plugin leverages Caldera fact sources to dynamically parameterize abilities. Instead of hardcoding environment-specific values, facts such as domain names, IP addresses, credentials, payloads, or operational parameters are injected at runtime. This approach allows the same adversary profile to be reused across multiple environments with minimal modifications.

The library also includes a collection of payloads and parsers used to support advanced attack simulations. Payloads are automatically synchronized with Mythic and can be leveraged by abilities during operation execution, while parsers dynamically extract information from command outputs and transform it into facts that can be consumed by subsequent abilities.

Finally, the plugin provides a growing library of more than 180 reusable abilities covering a wide range of ATT&CK techniques. These abilities can be combined into adversary profiles or executed individually to validate specific detections and response procedures.

Mythic Caldera plugin: Caldera-Mythic Integration

At the core of the integration are two command-line interfaces (CLIs): apollo_exec.py and athena_exec.py. These CLIs interface with the Mythic API and are used by the Caldera agent Sandcat to programmatically task Apollo (Windows) and Athena (Linux) agents .

For example, The Apollo CLI takes a Mythic callback ID, a command, and optional arguments, and supports additional options to extend execution behavior:

• -uploads: upload files before execution
• -downloads: download files after execution
• -deletes: remove files after execution
• -ps: import a PowerShell script in-memory before execution
• -pid: specify a target process ID for process injection

To streamline the interaction between Caldera and Mythic, the plugin implements two core functionalities:

• Connect C2: generates the apollo_exec.py and the athena_exec.py CLIs based on the provided Mythic C2 configuration parameters to enable communication with the Mythic API.
• Sync Payloads: automatically registers the payloads required by Caldera operations on Mythic, including .NET assemblies, DLLs, executables, and Beacon Object Files (BOFs).

Mythic Caldera plugin: Execution Workflow

Within our workflow, MITRE Caldera is used as an orchestration platform rather than a traditional Command and Control (C2) server. The Caldera agent (Sandcat) is deployed on the same host as the Caldera server and is responsible for coordinating the execution of attack scenarios. Instead of executing abilities directly, it delegates their execution to the Mythic C2 infrastructure.

Depending on the nature of the technique being executed, TTPs are handled through one of two execution paths:

• Network-based attacks: network-oriented TTPs, such as lateral movement or remote service interactions, are executed by the Caldera agent through a SOCKS5 proxy exposed by Mythic. Traffic is routed through the Apollo agent using tools such as proxychains.

• System execution attacks: Host-based TTPs are executed directly on compromised systems through Mythic agents. In this scenario, the Caldera agent leverages the apollo_exec.py CLI to interact with the Mythic API, tasking the Apollo agent to perform the requested action.

Objective Measurement: Assessing SOC Progress Using VECTR

A major limitation of tools such as Caldera is their Red-Team-centric design. While they excel at orchestrating and executing attacks, they do not provide a user-friendly interface for Blue Team analysts to review, enrich, and track assessment results. Consequently, accessing and interpreting the outcome of Purple Team exercises can become tedious, particularly when multiple operations are conducted over time.

To address this challenge, we integrated VECTR into our workflow. VECTR is a Purple Team platform designed to centralize attack and detection data, providing a common operational picture for both Red and Blue Teams. By correlating adversary actions with defensive observations, it enables organizations to objectively measure detection capabilities and track their evolution over time.

To streamline this process, we developed the VECTR plugin for Caldera. Once triggered by the operator, the plugin automatically exports completed operations to VECTR as campaigns, enabling the automatic generation of attack graphs and MITRE ATT&CK heatmaps while eliminating hours of manual reporting effort.

Vectr Caldera plugin: Campaign Creation

The plugin extends Caldera by exporting completed operations as VECTR campaigns. During the export process, the plugin transfers operation steps, execution status, executed commands, MITRE ATT&CK technique mappings, timestamps, and command outputs (stdout/stderr).

The plugin displays available Caldera operations along with their execution status. Once an operation is completed, the operator can trigger the export with a single click after providing the VECTR connection parameters. The export process is performed asynchronously to avoid blocking the Caldera execution thread.

Once exported, the operation appears as a campaign in VECTR. To maintain traceability between both platforms and ensure campaign uniqueness, the campaign name is composed of the Caldera operation name followed by the first 8 characters of the corresponding operation identifier.

Vectr Caldera plugin: Campaign Enrichment

Each ability included in a Caldera operation is mapped to a corresponding test case within the VECTR campaign. As a result, every test case is automatically enriched with relevant Red Team information, including the associated ATT&CK technique, execution status, timestamps, commands, and operational metadata:

For abilities that were executed, command outputs (stdout/stderr) are exported to VECTR and attached as Red Team logs. These logs provide analysts with detailed visibility into the actions performed during the assessment and can be reviewed to better understand the execution flow and investigate detection opportunities.

Bringing It All Together: End-to-End Demonstration

The following video brings together all components presented throughout this article, illustrating an end-to-end automated Purple Team assessment workflow, from automated adversary emulation with Caldera and Mythic to the visualization of adversary activities and operational results within VECTR.

What’s next?

While the workflow significantly reduces the effort required to conduct Purple Team assessments, one manual step remains: translating threat intelligence into executable Caldera abilities and adversary profiles.

Today, this process requires analysts to review CTI reports, identify relevant TTPs, and manually implement the corresponding abilities within the adversary emulation library. Although this effort only needs to be performed once for each technique, it remains dependent on human expertise and can become time consuming when operationalizing large volumes of threat intelligence.

Future work will focus on leveraging Artificial Intelligence to automate this process. By combining large language models with ATT&CK knowledge and existing ability templates, CTI reports could be automatically transformed into executable Caldera abilities, significantly accelerating the operationalization of threat intelligence and further reducing the effort required to maintain an up-to-date adversary emulation library.

This would complete the automation chain, enabling organizations to move from threat intelligence acquisition to automated adversary emulation and SOC assessment with minimal human intervention.

Cet article Automated CTI-powered Purple Teams est apparu en premier sur RiskInsight.

In this context, integrating Cyber Threat Intelligence (CTI) into organizations’ cybersecurity strategy and overall posture has become a key asset to anticipating increasingly sophisticated and innovative attacks and their potential operational impacts. Indeed, CTI provides early insight into potential threats and supports proactive posture by strengthening detection, reinforcing defenses, and enhancing incident responses. More than just collecting raw indicators, it constitutes a decision-driven process, aimed at improving the understanding of adversaries by turning data into actionable intelligence capable of answering precise cybersecurity questions.

In general, we distinguish three complementary forms of intelligence to reinforce an organization’s cybersecurity posture:

• Strategic, guiding long‑term decisions and investment priorities,
• Tactical, analyzing attackers’ tools and Tactics, Technics and Procedures (TTPs) to shape defensive posture,
• Operational and technical, providing actionable details such as Indicators of Compromise (IoCs) and Indicators of Attack (IoAs) to counter specific, recent threats.

As CTI spans multiple levels of decision‑making, its effectiveness depends on an organization’s ability to process growing volumes of heterogeneous data, detect weak signals, and produce actionable intelligence across all layers. These capabilities remain highly challenging for traditional CTI tools given data volume and heterogeneity. Throughout this article, we will present several use cases in which the use of enterprise-internal AI acts as a powerful lever to truly enhance CTI. To do so, our analysis is grounded in the CTI‑CMM model, which provides stakeholders with a structured framework for strengthening their CTI maturity. Designed to assess a program’s maturity and capability growth, the CTI‑CMM proposes a comprehensive mapping of CTI use cases across eleven domains, providing a clear and systematic foundation for evaluating where AI can most effectively enhance CTI activities.

Not all AI use cases in CTI deliver the same value or should be approached in the same way. Building on its experience across CTI engagements, Wavestone has developed a three-tier model – Safe Wins, Accelerators, and Frontier Bets – designed to structure use cases based on their AI maturity, impact on decision-making, and alignment with an organization’s CTI maturity.

Safe Wins

“Safe Wins” are use cases where AI can already improve CTI performance with minor changes to a “traditional” CTI governance model (i.e., analyst accountability, validation and dissemination workflows, and control over what is automated versus what remains expert judgment). They are low-regret and easy to implement, delivering fast ROI by automating high-volume tasks such as filtering, enrichment, and correlation. Outputs are reversible, errors are easy to detect, and AI is typically used for triage or processing, making them ideal entry points.

AI to enhance threat detection and preparedness (1a.)

AI has become a powerful ally in processing and correlating unstructured data collected through Threat Intelligence Platforms (TIP) to be transformed into actionable intelligence. While organizations should rely on TIP for data collection on IOCs and IOAs from human-selected qualitative feeds and OSINT sources, the true added value of enterprise-controlled AI for attack prevention and preparedness lies in its capacity to improve the quality of incoming data through confidence scoring. Given its capacity to process vast amount of data quickly (IP, domain, hash, behavior, etc.), AI can be used to correlate features (e.g., similarities to past malware, links to threat actors, unusual behavior) and verify false positives in incoming IOCs to assign a confidence score and avoid blocking relevant information on the Blue Team side.

AI to structure and standardize CTI data analysis and report (1b.)

AI can support CTI teams by assisting in the analysis of raw intelligence data from multiple sources using large language models. It helps restructure reports according to standardized models such as STIX, ensuring that the right information is placed in the appropriate fields. Attacker procedures, techniques, and contextual elements can be extracted and transformed into structured data in a consistent manner. This improves overall data quality, readability, and interoperability with TIPs and downstream security tools. As a relatively simple and low risk use case, it primarily acts as an analyst productivity booster for structuring reports in a standardized format.

AI to operationalize CTI for offensive security operations (1c.)

When it comes to red and purple team activities, AI acts as a strong enabler by helping CTI teams identify recurring TTPs across reports, cluster similar procedures, and consolidate duplicates into exploitable building blocks. AI can support analysts in extracting the most relevant information from threat reports and OSINT to maintain a consistent and actionable threat-driven knowledge base. AI can also help generate macro scenarios based on threat reports and publicly available intelligence, including actor selection and attack patterns. However, to be considered a safe win it must remain a decision-support tool, as end-to-end technical scenario generation would require sensitive data, the adequate responsibility model, and data confidentiality safeguards to avoid improper exposition and misuse.

AI to support strategic alignment of intelligence requirements (1d.)

AI can also support the definition and refinement of priorities and objectives within the threat intelligence function. More specifically, AI participates in accelerating analytical processes by assisting in the drafting and continuous refinement of priority intelligence requirements (PIRs) and proposing stakeholder-tailored reporting frameworks. It also helps distill complex program signals into intermediate insights, enabling analysts to focus on interpretation and decision‑making. Human validation remains essential to ensure alignment with the organization’s broader cyber strategy and performance frameworks. However, failing to account for AI’s inherent limitations, particularly in terms of accuracy, reliability, and explainability, may introduce significant risks, including the generation of misleading insights that could misalign intelligence outputs with enterprise cybersecurity objectives.

These “Safe Wins” illustrate how AI can already strengthen CTI across several operational dimensions: improving the quality and exploitation of intelligence data for defensive activities (a), accelerating the structuring and usability of CTI reporting (b), supporting threat-informed offensive security operations through better TTP extraction and scenario preparation (c), and assisting in the drafting of intelligence requirements and designing of reporting. By enhancing efficiency, consistency, and scalability across these activities, these use cases establish a strong foundation for the next tier of applications, where AI supports more analytical and decision-driven processes requiring greater maturity and governance.

High-Potential Accelerators

“High-potential Accelerators” target more mature CTI teams, where AI acts as a force multiplier rather than a substitute for expertise. They significantly amplify analyst productivity by scaling detection, supporting hypothesis generation, and translating intelligence into actionable outputs. However, these use cases require high-quality contextual data, structured processes, and robust governance (e.g., human-in-the-loop, explainability, feedback loops) to ensure reliable and controlled outcomes.

AI to scale financial fraud and brand impersonation detection (2a.)

AI can enhance CTI by scaling the identification of fraud and brand impersonation assets across large data streams and monitored perimeters. It enables the detection of newly created lookalike domains and cloned websites/logos across domains using NLP^[1], computer vision, and behavioral analytics. These assets can be enriched with technical indicators (DNS, hosting infrastructure, registration patterns) and contextual signals (content similarity, redirection flows), then correlated into coherent attack campaigns and ingested into TIPs. The resulting intelligence can be disseminated to blue teams to support detection, blocking, and take-down actions. While the automation of large-scale discovery and triage allows CTI teams to focus on validation, prioritization, and business impact, it requires strong governance and coordination between CTI, fraud/brand protection, legal, and security operations teams to minimize false positives and ensure effective response.

AI to prioritize vulnerability patching (2b.)

AI can support vulnerability management by dynamically prioritizing patching efforts based on threat intelligence, underlying technologies, and the exposure and criticality of business applications. By combining threat context, exploit activity, asset environment, and enterprise-specific constraints, AI can estimate a risk score for each vulnerability. This score is used to raise targeted alerts and guide patching teams toward the most critical remediation actions. The approach embeds all threat-related elements within the organization’s context, allowing AI to act as an intelligent decision-support layer rather than a generic scoring mechanism. This use case complexity arises from the need for AI to access and correlate large volumes of sensitive and critical data across security, IT, and asset management systems.

AI to support threat hunting and penetration testing (2c.)

When it comes to guiding proactive hunt hypotheses and prioritizing them using threat‑actor TTPs, campaigns, and priority intelligence requirements, AI adds real momentum. It can help generating hunting hypotheses from observed TTPs, turning them into queries or playbooks, highlighting which hunts should come first based on PIRs, vulnerabilities, or asset signals, and summarizing the results of ongoing investigations. Paired with an internal knowledge base or RAG^[2]‑enhanced context, AI supports hunters move through their environment with greater clarity and focus. Additionally, AI can assist the teams in the execution of penetration testing and adversary simulation activities. By automating offensive workflows and simulating complex, real-world attack scenarios, it enables more scalable, efficient, and realistic testing, helping teams better keep pace with increasingly AI-enabled threats. However, this does not imply that AI can replace CTI and offensive security teams. Success in AI-supported penetration testing relies on expert control, business awareness, and rigorous risk management. Human expertise remains essential for interpreting results and making informed decisions.

Taken together, these High-potential Accelerator cases show how AI amplifies CTI across three core functions: detecting financial fraud and brand impersonation threats (a), prioritizing vulnerability patching (b), and enhancing proactive threat hunting and validation of adversary behaviors (c). Acting as a force multiplier rather than a substitute, AI accelerates intelligence exploitation, improves prioritization, and strengthens decision-making.

Frontiers Bets

“Frontier Bets” represent more complex and experimental AI applications in CTI, requiring significant transformation of operating models and strong governance frameworks. Compared to the two other tiers, they involve higher uncertainty, stronger dependency on data quality, and risks that are harder to detect or control (e.g., bias, hallucination, strategic misalignment). As such, they should be approached through controlled experimentation, with strict guardrails, human oversight, and iterative validation before scaling.

AI to improve situational awareness of the cyber threat landscape (3a.)

AI could help maintain a comprehensive understanding of the cyber threat landscape by serving as a preliminary layer of analysis before CTI experts validate and expand it. More broadly, it could enable the continuous synthesis of the threat landscape from OSINT sources, partners, and vendors, and the detection of emerging trends and correlations for informed strategic decision-making. While the autonomous drafting of CTI reports by large language models raises the risk of biased outputs and AI hallucinations, AI should initially be used to support analysts in drafting activities to help them gain time in the analysis of cyber threats, serving as a pragmatic first step toward broader AI integration in this use case.  The market maturity for use cases supporting the full intelligence lifecycle remains limited, with few industrialized and proven solutions available.

AI to enhance identity-based threat detection and response (3b.)

AI could strengthen CTI for identity‑driven use cases by enabling earlier detection of attacker behaviors and supporting deception techniques such as honey accounts^[3] or canary tokens^[4] to expose and divert adversaries. By treating identities as active sensors, organizations can surface stealthy attacker activity before full compromise. AI could help scale these mechanisms by automating deployment, continuously tuning detection signals, and correlating weak indicators. It could also reduce analyst workload through intelligent alert triage, prioritizing high‑confidence identity‑related threats over noise. Despite its high potential for CTI and IAM teams, this use case remains at an experimental stage due to the limited maturity of identity‑centric deception techniques, integration complexity with IAM and SOC processes, and the need for strong governance to avoid false positives, operational overhead, or unintended exposure of deception assets.

AI is already transforming how organizations produce and use cyber threat intelligence, not by replacing analysts, but by amplifying their ability to process information and enhance decision-making at scale. This article highlights where enterprise-internal AI can deliver value to CTI by focusing on the use cases most relevant in practice. To structure this approach, we introduced a pragmatic three-tier model to help prioritize efforts and adopt AI progressively based on the organization’s maturity, from low-risk “Safe Wins” to more advanced use cases dependent on high-quality data, robust governance as well as human oversight and AI model explainability.

Organizations should therefore focus on applying AI where it creates measurable value and aligns with their level of maturity, reinforcing a key reality: AI does not create CTI maturity, it amplifies it. Recent developments such as Anthropic’s Mythos also illustrate a broader shift in the cyber landscape: AI is beginning to compress the gap between vulnerability discovery and operational exploitation, while significantly reducing the cost and complexity of large-scale offensive operations. While the exact pace and scale of this evolution remain uncertain, it highlights the need for organizations to become “Mythos-ready” by enabling teams to leverage AI for defense while ensuring robust cybersecurity fundamentals.

At Wavestone, we support organizations in navigating this transformation, from identifying high-potential use cases to implementing AI in a controlled, scalable, and value-driven manner across their CTI capabilities.

^[1]NLP (Natural Language Processing) : AI techniques used to analyze and understand human language in text or speech

^[2]RAG (Retrieval‑Augmented Generation) : AI approach in which a generative model is systematically enriched with relevant contextual information retrieved from curated knowledge sources at query time, allowing it to produce outputs that are better aligned with a given operational or analytical context

^[3]Honey account : A decoy user account created to mimic a legitimate identity, used to detect unauthorized access when an attacker attempts to use it

^[4]Canary token : A planted digital artifact (e.g., credential, file, or link) that triggers an alert when accessed or used, revealing potential malicious activity

Cet article Amplifying Cyber Threat Intelligence with AI: A Pragmatic, Maturity Driven Approach est apparu en premier sur RiskInsight.