Consequence is not enough: The role of cyber intelligence in improving cyberattack estimates

Intelligence assessments continue to emphasise adversary ability and desire to hold critical infrastructure at risk. At the same time, the field of cyber threat intelligence is predominately focused on a review of past cyberattacks to yield insights into future risk. Few researchers focus on methods to improve assessments of adversary capability and intent or address the need for more proactive, predictive analysis. This paper identifies some of the existing weaknesses in cyber threat intelligence analysis and provides some recommendations for how organisations can more comprehensively consider their cyber risk.