Alexandra Borgeaud
Research expert covering cybersecurity and tech in Latin America
Cyber Threat Intelligence (CTI) - statistics & facts
In a century characterized by remote and hybrid work environments coupled with increasingly frequent cybercrimes, the need to protect digital assets and network devices has become greater too. The higher number and diversity of threats, along with the development of cloud computing, have reshaped the cyber threat intelligence (CTI) market - particularly by increasing the attack surface, as many employees now use their own devices for work purposes cumulated with the fact that they have less secure home connections. In 2024, the global threat detection system market was estimated at around 13.5 billion U.S. and was expected to exceed 54 billion U.S. dollars by 2034.
Data gathering and analysis
Simply put, CTI provides critical contextual and actionable data on the evolving threat landscape targeting a company, allowing it to act or react based on reliable and specialized intelligence. In 2023, over half of organizations worldwide had a dedicated CTI team. CTI is based on a variety of sources, ranging from open-source intelligence, technical intelligence, to social media or even dark web intelligence. In 2023, most CTI teams gathered their data from external sources such as media reports and news, followed by community or industry groups. With the increasing number of intrusions and adversary activities making the headlines, CTI teams must consider this type of information when gathering intelligence and analyzing data. In 2023, the most used method for CTI data analysis was intuitive or experience based judgement, followed by threat modeling.Let the (threat) hunting games begin
Threat intelligence teams are usually made up of cybersecurity and threat intelligence analysts, along with engineers, vulnerability researchers, network security experts and more. After the team is established, the threat hunting process can begin. Turning CTI into something palpable and actionable requires a process that highlights unusual activity within a company's network. Such proactive measures enhance an organization’s defense system by allowing it to react quickly in the eventuality of a cyberattack. Additionally, threat intelligence plays a crucial role in Security Operations (SecOps) by providing insights into the latest threats, vulnerabilities, and attacker tactics, allowing organizations to stay ahead of the ever-evolving threat landscape and protect themselves against cyberattacks. Looking ahead, governments and companies alike will have to adapt their resources and teams to a rapidly evolving threat landscape.
