CERT-EU identified at least 174 distinct threat actors active against European Union institutions, bodies, agencies, or their ecosystem in 2025, compared with 110 in 2024. Its 2025 threat landscape review, published in April 2026, also notes that expanded monitoring through automation and AI affected its cybercrime observations. For intelligence teams, this illustrates a practical challenge: process more information while preserving the context needed to judge what it means.
AI in threat intelligence is the use of machine learning, natural language processing, and generative AI to help collect, structure, analyze, and communicate information about cyber threats. It can assist with report summarization, indicator extraction, entity linking, and hunting preparation. Its value depends on whether the resulting intelligence is accurate, relevant to the organization, and useful for a defensible decision.
A useful starting point is a bounded workflow: take a trusted report, preserve its evidence, generate a draft assessment or hunt, and validate the result against local data. Measure the analyst effort and decision quality after verification.
Cyber threat intelligence, or CTI, turns information about adversaries and their activities into context for security decisions. AI can assist that process, but a collection of extracted indicators becomes useful intelligence only when its relevance, reliability, and implications are understood.
An IP address in a report is an observable. An assessment explaining why activity involving that address matters to a particular organization adds intelligence. That assessment needs evidence, a time frame, and appropriate uncertainty.
Teams commonly work with several levels of intelligence. Their boundaries vary between programs, but the distinction helps match AI output to the person who will use it.
Threat intelligence and threat detection work together. Intelligence helps explain what to look for and why; detection examines activity in an environment for evidence of a threat. An external campaign report does not establish that the same campaign has compromised your organization.
For the complementary discipline, explore AI threat detection.
A reliable AI-assisted workflow begins with a decision the team needs to make. Each stage should preserve enough evidence for the next person or system to check the result, including when the evidence is incomplete.
Start with a question that has an owner and a possible action. “What threats exist?” is too broad to guide useful collection. “Which reported identity attacks could affect our cloud administrators, and can we investigate those behaviors?” connects intelligence to an operational need.
Define the relevant systems, users, geographic exposure, and time window. Agree on what would change a decision, such as scheduling a hunt, reviewing a control, or escalating a finding. AI can help draft and organize requirements, but the organization must decide which questions matter.
Inputs may include government advisories, commercial feeds, information-sharing communities, public incident reports, and internal investigation findings. Record the original publisher, publication date, observation period, collection time, and sharing restrictions before processing the content.
Preserve original language alongside translations and retain a stable source reference. If a report quotes another report, record that dependency. Several articles repeating one announcement do not provide several independent confirmations.
Apply sharing restrictions before sending material to an AI service. FIRST's Traffic Light Protocol guidance defines sharing boundaries; it does not replace checks on licensing, permitted processing, or data handling.
Natural language processing can identify entities such as malware names, vulnerabilities, domains, and organizations, then propose relationships between them. The 0-CTI research abstract, for example, describes transformer-based extraction of entities and relationships from CTI reports. That demonstrates a research approach, not a universal accuracy level for deployed systems.
Preserve the original value alongside a normalized version. A defanged domain needs careful handling; a similar-looking string may be a benign example rather than malicious infrastructure. Mark whether each item is an observed fact, a source assessment, or an analyst inference.
Simple deterministic parsing can be appropriate for well-formed hashes or addresses. Use a language model where surrounding language matters, such as determining whether a report describes an observed technique or merely discusses a possibility.
AI can help connect extracted information to an asset inventory, technology stack, or intelligence requirement. A vulnerability report about an absent product should not receive the same operational attention as credible exploitation affecting an exposed system the organization uses.
Keep source trust separate from the credibility of a specific claim. CERT-EU's CTI framework distinguishes source reliability, information credibility, confidence in an assessment, and estimative probability. These are different judgments.
A fluent model answer does not establish any of them. Ask what evidence supports the assessment, whether other reporting is independent, what remains unknown, and which observation would change the conclusion.
An output should fit its destination. A leadership brief needs implications and decisions. A threat hunter needs a hypothesis, relevant behaviors, available telemetry, and a way to interpret the results. A detection engineer needs logic that can be tested and maintained.
AI can draft hunting queries, but the draft must match the actual data schema, fields, permissions, and query language. A query that executes successfully may still search the wrong field or omit the relevant time range. A query that returns no matches may reflect missing logs.
Connect this stage to an established threat hunting process. Promote repeatable logic through detection engineering, with validation and ownership, before relying on it in production.
Capture what happened after dissemination. Did the intelligence trigger a useful investigation? Did the analyst correct an entity, reject a mapping, or discover that required telemetry was unavailable?
Store corrections with the original output and the version of the workflow that produced it. Feedback can improve prompts, retrieval, rules, and evaluation datasets. It does not mean a deployed model automatically learns safely from every analyst action; updates need their own review and testing.
Different AI techniques support different tasks. Choose the simplest method that can produce a verifiable result, and evaluate the complete workflow rather than assuming that a more complex model will perform better.
A large language model, or LLM, generates and interprets language. An agent adds a workflow in which a model can select tools and perform successive steps. Giving a model access to a query tool changes what it can do, but does not establish that its conclusions are correct.
Retrieval augmented generation, or RAG, supplies retrieved material as context for a model's response. A knowledge graph can add explicit relationships to that context. Both approaches depend on the quality, freshness, and permissions of the underlying information.
These methods can coexist. An extraction rule might identify a hash, a language model might summarize its reported use, and a graph might link it to related observations. The analyst should be able to inspect each transformation.
AI can reduce repetitive preparation work and make more source material accessible to analysts. Those benefits should be measured after source checking, corrections, and investigation, because a fast draft can still create substantial downstream work.
A team can use AI to match reporting against the technologies, suppliers, and identities it depends on. The resulting queue can explain why a report deserves attention, what local evidence is available, and which owner should review it.
For vulnerability prioritization, separate the existence of a vulnerability from evidence of exploitation and from local exposure. A model-generated urgency label should point to the relevant evidence and asset context. A high-impact report about a product the organization does not use may justify awareness without an immediate remediation task.
AI-assisted entity resolution can help analysts find reports that describe related infrastructure, aliases, or behaviors. This can reduce the work of assembling a campaign timeline and highlight contradictions that deserve investigation.
Keep proposed links provisional until supported. Shared infrastructure can have innocent explanations, and attacker techniques are often reused. A similar domain, malware family, or behavior does not establish a common operator. Preserve source-specific actor names rather than silently merging them into one identity.
One evidence set can support a technical hunt brief and an executive summary, provided both preserve the same uncertainty. AI can help adapt vocabulary, extract relevant passages, and identify missing information.
Require each consequential statement to retain a source reference. A summary must not turn “suspected access” into “confirmed compromise” or omit that an observation concerned a different sector or time period. The person accepting the brief should be able to reconstruct its basis without repeating the entire research process.
Broader collection changes what an intelligence team can observe. Evaluate that change separately from improvements in investigation quality or defensive outcomes.
CERT-EU's 2026 review is useful because it qualifies its own observations: the change in its cybercrime reporting reflected both threat activity and expanded monitoring through automation and AI. Its figures describe a specific constituency and collection process. They do not establish a worldwide attack growth rate or isolate AI's contribution to the actor counts.
The implication for an enterprise CTI program is practical. If an AI-assisted workflow processes more sources, the team may discover more actors, relationships, and relevant events. Rising output could reflect better coverage, duplicate reporting, a real threat change, or a combination.
Track the collection denominator alongside the result: sources reviewed, reporting periods, requirements covered, and review effort. Then ask whether the additional intelligence changed a hunt, a control, or an investigation decision. A larger queue is useful when the organization can explain and act on what it contains.
A dependable design keeps source material, generated assessments, and permission to act distinct. The following architecture is a proposed implementation pattern that teams can adapt to their data and risk requirements.
The sequence is straightforward: collect approved sources, normalize and index them, retrieve relevant evidence, generate a constrained draft, validate it, and publish it to an approved destination. Feed corrections back into the evidence store and evaluation process.
Apply access restrictions before retrieval, so a user cannot obtain material they are not allowed to see through an AI summary. Keep the same boundaries when indexing documents, retrieving passages, and storing generated outputs.
Record which source versions were retrieved. A citation to a document that has since changed may not explain an older assessment. Where sources disagree, present the disagreement and its dates rather than combining the claims into a more confident statement.
Limit tool access to what the workflow needs. A report-summarization service can usually operate without privileges to disable accounts, alter detections, or contact external destinations. A separate policy layer should decide whether a proposed action is permitted.
Use a consistent record so intelligence remains inspectable after it leaves the model. A useful starting contract includes:
Treat missing evidence as a visible state. “Not established” is more useful than a plausible completion that later becomes an untraceable fact. Keep generated records separate from approved records so drafts cannot circulate as validated intelligence.
Structured Threat Information Expression, or STIX, provides objects and relationships for representing threat intelligence. Trusted Automated Exchange of Intelligence Information, or TAXII, supports exchanging CTI over HTTPS. Their roles are complementary: representation and exchange.
AI can help propose structured records for these workflows. Validate both structure and meaning before publishing them. A well-formed record can still contain an unsupported attribution, an incorrect indicator, or a relationship that the source never established.
Consider an illustrative enterprise investigating a report about stolen credentials followed by unauthorized changes to cloud account privileges. This is a hypothetical workflow, not a customer incident or a tested performance claim.
The requirement: determine whether comparable behavior appears in the organization's environment and whether its available telemetry can support the investigation.
First, the analyst approves the report for processing. The AI assistant extracts the reported behaviors, affected technologies, observation period, and relevant passages. It records that the report describes another environment; it does not label a local account compromised.
Next, the assistant proposes a hunt hypothesis: a valid account may have been used to make an unusual privilege change and then access sensitive resources. It lists the evidence needed to test that hypothesis, such as sign-in events, privilege-change audit records, cloud activity, and asset or identity ownership.
The analyst checks whether those sources exist, whether retention covers the relevant period, and whether identifiers can be joined reliably. If a required audit source is unavailable, that becomes an investigation limitation and a logging action. The assistant must not represent the missing data as a clean result.
The assistant then drafts a query using the organization's actual schema. A detection engineer checks field names, time handling, filters, and join behavior. The team tests the query against known benign administrative activity and an authorized test case representing the suspected behavior.
Suppose the validated search finds a privilege change. The analyst checks the change record, account owner, related activity, and surrounding evidence. An approved administrative action may explain the event. An unexplained change with corroborating suspicious activity may justify escalation.
The final intelligence record links the external report, local observations, query version, analyst assessment, and outstanding gaps. Any account restriction follows the organization's incident-response authority and established playbooks.
This workflow produces an auditable outcome even when the hunt finds no confirmed attack: a supported assessment, a documented visibility gap, or a tested detection improvement.
Errors in intelligence can spread into briefs, detection logic, and response decisions. Build controls around the places where generated content becomes trusted or gains the ability to affect another system.
A model may invent an indicator, associate a technique with the wrong actor, or cite a passage that does not support its claim. OWASP's misinformation guidance identifies fabricated answers and overreliance on model output as risks for LLM applications.
Require supporting passages for consequential claims and check that they actually entail the conclusion. Allow the workflow to abstain. Preserve distinctions between reported facts, analytical judgments, and recommendations.
Do not interpret a model's self-reported confidence as a calibrated probability of an attack. Use an evidence-based assessment process and test any numerical scoring system against outcomes appropriate to its intended use.
Threat reports, retrieved pages, and other external inputs can contain instructions intended to redirect an AI assistant. OWASP's prompt-injection guidance explains that RAG and fine-tuning do not fully mitigate this risk.
Treat retrieved material as evidence to analyze, not instructions to obey. Constrain tool access, validate outputs outside the model, and require approval for privileged actions. Test whether hostile source content can change the intended task, expose restricted information, or cause an unauthorized tool call.
Poisoned information can also mislead without issuing instructions. A fabricated report may introduce false associations that become more convincing as other systems repeat them. Track provenance and source dependence to avoid counting repetition as corroboration.
Restricted reports may contain victim details, investigation findings, or information shared under specific conditions. Confirm which AI processing environments may receive them, and review retention, access, logging, and reuse terms. A sharing label alone does not settle these questions.
Intelligence also ages. Infrastructure can change ownership, assessments can be revised, and old indicators can lose operational value. Assign review dates appropriate to the item, preserve revocations and corrections, and make superseded records visible to downstream users.
Monitor for changes in model behavior and input sources. A previously useful prompt or classifier may perform differently after a model update or a shift in reporting language. Re-evaluate the workflow before treating its earlier results as continuing assurance.
Compare an AI-assisted workflow with the current process on the same type of work, using material reserved for evaluation. Judge the resulting decisions and total effort, including validation and rework.
A September 2026 SANS Technology Institute research abstract describes testing three commercial LLMs against 10 CTI reports and evaluating extraction separately from generated hunting queries. Its published abstract supports that evaluation distinction; it does not establish a universal performance benchmark.
Create an analyst-reviewed reference set before comparing outputs. Resolve disagreements and record uncertain cases rather than assuming the first human answer is complete. Keep the source versions, models, prompts, retrieval settings, and test conditions reproducible.
The following scorecard is a proposed evaluation framework. Select measures and acceptance thresholds that match the consequences of an error in the chosen workflow.
Define the evaluation unit consistently. An exact hash, a correctly extracted relationship, and an entire report are different units. Report denominators and error types, including false negatives, rather than relying on one combined accuracy score.
Include contradictory reports, obsolete indicators, ambiguous actor aliases, defanged strings, benign examples, missing telemetry, and hostile instructions embedded in source material. Test content in the languages and formats the team actually handles.
Start with a read-only task such as source-linked extraction or summarization. Introduce query drafting after the team can check evidence reliably. Add controlled execution only when permissions, validation, audit records, and rollback procedures are defined.
A pilot should answer a concrete question: does this workflow help analysts reach supported decisions with acceptable effort and error? If source checking costs more than the preparation work saved, revise the task or method before widening access.
When evaluating a platform, ask how it exposes evidence, preserves permissions, handles corrections, and exports validated records. For broader buying criteria, see the guide to threat-intelligence tools.
External intelligence helps teams decide which behaviors to investigate. Local behavioral evidence helps determine whether related activity is occurring across their own identities, network, and cloud environments.
Vectra AI's AI-native security and observability approach is relevant to that operational connection. Its documented identity use case describes behavioral analysis of human and non-human identities and correlation of identity and network activity. These capabilities can supply context for investigations informed by threat intelligence; they should be evaluated against the organization's actual telemetry and workflows.
Explore identity-based attack detection and containment to assess that connection. Bring an intelligence requirement, a representative hunt, and the evidence you expect an analyst to inspect.
For a product evaluation, request a Vectra AI demo focused on how your team can investigate relevant behavior and reach a supported response decision.
Note: This guide draws on public research, standards, and product documentation. The worked example and evaluation framework are proposed guidance, not results from a product benchmark.
AI can assist with collection, extraction, summarization, and analysis preparation. Analysts remain responsible for intelligence requirements, disputed evidence, contextual judgments, and consequential decisions. Whether a task can be automated depends on its error tolerance, validation, and permissions; one successful workflow does not demonstrate that an analyst role can be replaced.
AI threat intelligence helps develop context about threats and their relevance. AI threat detection analyzes activity for signs of a threat in an environment. Intelligence can inform detection and hunting, while detection findings can feed intelligence analysis. Neither an external report nor an anomaly alone proves a confirmed compromise.
AI can support forecasts and prioritization using available evidence. It cannot guarantee which adversary will attack next, when an attack will happen, or whether it will succeed. Treat predictions as uncertain assessments with defined scope, supporting evidence, and a process for checking outcomes.
No. RAG can provide relevant source material, but retrieval can miss important evidence and a model can misinterpret what it receives. Verify the cited passages, preserve conflicting information, and allow unsupported questions to remain unanswered. Retrieved content also needs prompt-injection controls.
Begin with a clear intelligence requirement, approved sources, source metadata, and analyst-reviewed examples of acceptable output. Add local telemetry and asset context when the task involves relevance assessment or hunting. Confirm access, retention, sharing permissions, and data quality before expanding the workflow.
A bounded, read-only task with easily checked output is a useful starting point. Source-linked extraction or summarization can provide a manageable evaluation. Measure accuracy and review effort before progressing to generated hunts, tool execution, or actions that affect production systems.