Intelligence Tradecraft - Sharpen your analytic edge

About Intelligence Tradecraft - Sharpen your analytic edge

Join us on “Intelligence Tradecraft”, where we explore the adoption of intelligence tradecraft in the private sector. Hosted by an intelligence and cyber threat intelligence professional, each episode features interviews with top researchers, authors, and practitioners offering practical insights for experts and beginners alike. Whether you’re a seasoned intelligence analyst or just starting your journey, this videocast provides the tools, techniques, and inspiration to elevate your craft and sharpen your analytic advantage. Join our community and master intelligence tradecraft.

Publisher

Freddy Murre

Category

education

Language

en

Explicit

No

First episode

28 Sept 2025

Latest episode

14 Oct 2026

Latest episodes

20 episodes in the feed.

1. 

   14 Oct 2026

   Building a CTI Team: Buy-In, Budgets, and Better Intelligence - Interview with Sherman Chu S3E5

   What does it take to build and run a cyber threat intelligence function, and how can you tell whether the intelligence you’re producing is any good? In this episode, host Freddy Murre sits down with Sherman Chu, who at the time of the interview worked at BlackRock, for a conversation about lessons learned on the job, tradecraft and AI. Sherman recounts his path from Army intelligence support through grad school and a vendor role at Flashpoint, then to end-user teams in financial services, building New York City’s CTI program from the ground up, and a stint at Deloitte. He explains what changes when you move from serving a broad customer base to serving specific stakeholders, and why end-user teams must also collect internally. Freddy and Sherman cover team-building: finding buy-in, keeping collection minimal, justifying budgets, evaluating vendors, and why training so often fails to change how a team works. Sherman shares the courses and books he considers foundational, including The Diamond Model of Intrusion Analysis and Heuer’s Psychology of Intelligence Analysis. A key question that comes up is what separates intelligence from data and information. Sherman offers his own definition, then breaks down what bad intelligence looks like, from marketing dressed up as analysis to context-free indicator sharing. He also explains how inconsistent terminology holds the field back. Over the last couple of years, Sherman’s view of AI has shifted from early skepticism to cautious adoption. He shares how he pairs deterministic code with LLMs to extract adversary procedures from reports, where models still hallucinate, and why analysis remains the hardest step to automate. Their advice for newcomers is to stay curious, build a pet project, and stay humble. If you lead a CTI team, want to join one, or are weighing where AI belongs in your workflow, this episode is well worth your time. RESOURCES Flashpoint - https://flashpoint.io/ Columbia University MA program - https://www.sipa.columbia.edu/sipa-education/masters-programs/concentrations/international-security-and-diplomacy SANS FOR578 CTI -https://www.sans.org/cyber-security-courses/cyber-threat-intelligence Sergio's course "Diamond Model of Intrusion Analysis" -https://school.threatintel.academy/courses/diamond/ Joe Slowik's Training - https://paralus.co/training/ Pherson's Structured Analytic Techniques (SAT) - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/ Richards J. Heuer, Jr. The Psychology of Intelligence Analysis -https://www.ialeia.org/docs/Psychology_of_Intelligence_Analysis.pdf Scott J. Roberts & Rebekah Brown's book "Intelligence-Driven Incident Response - https://www.amazon.com/Intelligence-Driven-Incident-Response-Outwitting-Adversary/dp/109812068X/ VISMA and APT Attribution discussion - https://therecord.media/norway-says-chinese-group-apt31-is-behind-catastrophic-2018-government-hack CHAPTERS 00:00 Introduction and Career Overview 02:09 From Army Intelligence to Academia 06:05 Vendor Versus End User Intelligence 13:54 Building a Government CTI Program 17:17 Training, Certifications, and Key Books 25:14 Building a CTI Function 37:46 Budgets, Tools, and Training Value 47:28 What Counts as Intelligence 52:49 What Makes Intelligence Bad 01:00:06 Shared Language and Industry Maturity 01:07:38 AI Across the Intel Cycle 01:13:13 Hybrid LLM and Code Workflows 01:16:22 AI Limits, Risks, and Democratization 01:22:44 Traits for Aspiring Analysts 01:25:01 Neurodivergence and Staying Humble

2. 

   30 Sept 2026

   Bringing CTI to the Executive Table - Interview with Jan Henrik Schou Straumsheim S3E4

   Jan Henrik Schou Straumsheim, a partner in PwC's cyber advisory practice, sits down with host Freddy Murre to talk about the real work behind cyber threat intelligence. His interest in the field traces back to getting his hands on his father's old 386 computer and a book his mother gave him on the history of codes, and later took shape during years as a reserve infantry officer in Norway's armed forces, where he trained at the Defense Intelligence School and eventually became his unit's intelligence officer (S-2). From there, his career moved through a summer internship at Accenture, a part-time job in the security operations center at mnemonic, a pivot into consulting, and almost a decade now at PwC. The conversation explores what actually separates CTI from cybersecurity, and why so much of what gets sold as intelligence is really just unfiltered data dumps. Jan Henrik and Freddy debate how analysts should weigh sources, including the tricky question of trusting personas on dark web forums, then turn to how private-sector teams train and retain analytical skill, and why Nordic organizations still lag in treating CTI as more than a detection add-on. Jan Henrik shares a real client case, where a board commissioned a foresight report on AI risk, showing what it looks like when CTI actually reaches the boardroom. The conversation then shifts to AI's role in intelligence work: how Jan Henrik uses large language models every day, why he still insists on a human checking every output before his name goes on it, and where the line sits between AI as a sparring partner and AI replacing analytical judgment altogether. They close on a reminder that opportunity often comes from someone else opening a door, and why passing that on matters. This episode with Jan Henrik is a grounded, occasionally blunt conversation about what good intelligence work actually requires, well worth a listen for anyone trying to make CTI matter to the business it's meant to serve. RESOURCES simon singh the code book - https://www.amazon.com/dp/0385495323 Mnemonic Internships - https://www.mnemonic.io/no/careers/internships/ Hatlebrekke The Problem of Secret Intelligence - https://www.amazon.com/dp/0748691839 Freddy's SANS CTI Summit presentationFrom Gut to Gold Standard: The Admiralty System in CTI - https://youtu.be/y-CSDxMMXb0?t=5 Freddy's SANS posts on Admiralty Scale - https://www.sans.org/profiles/freddy-murstad#resources SANS Cybercrime Investigations - https://www.sans.org/cyber-security-courses/cybercrime-investigations Washington D.C. police gaming crime statistics - https://www.washingtonpost.com/dc-md-va/2026/05/08/dc-police-crime-statistics-internal-investigation-findings/ Research article Non-Determinism of “Deterministic” LLM System Settings in Hosted Environments - https://aclanthology.org/2025.eval4nlp-1.12/ Research article Cognitive offloading, critical thinking and attitudes towards artificial intelligence https://pubmed.ncbi.nlm.nih.gov/42377671/ Freddy's LinkedIn Profile -https://www.linkedin.com/in/fmurre/ CHAPTERS 0:00 Early path into cybersecurity 2:12 From mnemonic's SOC to PwC 8:27 Building PwC's global CTI arm 10:38 CTI versus cybersecurity defined 11:45 Military intelligence background 18:40 What actually counts as intelligence 20:05 Separating good intel from bad 26:19 Training and upskilling analysts 32:57 CTI maturity across the Nordics 41:20 Linking CTI to enterprise risk 50:28 Building a successful CTI function 56:30 Measuring CTI's real value 1:03:12 AI's rapid rise in CTI 1:14:51 AI risks and human oversight 1:26:01 Career-defining opportunities and mentorship

3. 

   16 Sept 2026

   Breaking In, Proving Value, and Staying Ahead in CTI - Interview with Rebecca Ford S3E3

   In this episode of Intelligence Tradecraft, host Freddy Murre sits down with Rebecca Ford, a cyber threat intelligence analyst who started out on the government side with Army Cyber and DISA, focused heavily on North Korea and the Asia-Pacific region. From there, she moved into the private sector, where she's spent the better part of a decade helping grow a CTI function from an early-stage team into something far more mature. Rebecca traces her path into the field: an overheard conversation about true-crime shows that led an Army analyst to recruit her, on-the-job training in an era before cyber threat intelligence even had a name, and the 2014 Sony hack as the moment the discipline truly landed on the map. She and Freddy explore what separates useful intelligence from what she calls being reduced to "news reporters with a microphone." The difference lies in handing stakeholders a raw threat feed versus giving them analysis that actually drives a decision. Rebecca shares her working definition of intelligence, built around an adversary's intent, opportunity, and capability. They also get into the two very different audiences an analyst serves, senior leadership and network defenders, and why treating report counts as a success metric misses the point entirely. The conversation covers building real relationships with stakeholders, the argument for "fusion centers" that merge cyber, physical, travel, and financial-crime intelligence, and the considerable value of community and mentorship in a field where, as Rebecca puts it, your next opportunity usually comes from someone who already knows you. A large part of the discussion is about AI: where it genuinely speeds up research and helps an analyst get started, why Rebecca still verifies everything by hand before it goes out, and why she believes human judgment should stay in charge of the final call. Rebecca ends with a reminder that showing up and investing in the community, whether at conferences, in focus groups, or at vendor events, is part of the job for anyone hoping to build a career in the field. RESOURCES Sony Hack - https://www.bbc.com/news/world-asia-30573040 Gert Jan's Metrics - https://github.com/gertjanbruggink/metrics SANS CTI Summit 2026 Visual Summary - https://www.sans.org/blog/visual-summary-sans-cti-summit-2026 Rebecca's LinkedIn - https://www.linkedin.com/in/rebeccaford/ Freddy's Intelligence Architecture Mind Map - https://github.com/Errum/IntelArchitectureMap Reuters IKEA bets on remote interior design as AI changes sales strategy - https://www.reuters.com/technology/ikea-bets-remote-interior-design-ai-changes-sales-strategy-2023-06-13/ CHAPTERS 00:00 Welcome & Rebecca's Background 00:57 Breaking Into Cyber Threat Intel 02:58 Learning Cyber Intel From Scratch 04:30 The Sony Hack Turning Point 06:53 From Army Cyber to DISA 09:32 Adjusting to the Private Sector 12:29 Defining Intelligence and Stakeholders 15:16 Proving Value and Building Community 23:14 Good Intelligence vs. Bad Intelligence 26:20 Mentorship and Learning From Mistakes 34:01 Team Diversity and Fusion Centers 40:25 Misconceptions and Measuring Impact 47:00 Communicating With Stakeholders 55:07 Where AI Fits in Intel 1:13:15 Mentors, Advice & Closing Thoughts

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Spotify

5.0 / 5

4 ratings

Contact Intelligence Tradecraft - Sharpen your analytic edge

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.

Shows with a similar audience

• 

  Signals & Stories

• 

  Security Conversations

• 

  Microsoft Threat Intelligence Podcast

• 

  Click Here

• 

  Risky Business

• 

  Darknet Diaries