Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Why CTI Must Recommend, Not Just Report

In traditional intel roles, analysts avoid making direct recommendations. But Scott Scher explains why that doesn’t work in the business world. CTI teams can’t just present options, they need to say what should happen next. Scott breaks down why effective CTI must go beyond context and offer clear, actionable guidance for defenders. Hidden Truths: Traditional intel avoids giving direct recommendations Business leaders and defenders want clear next steps CTI teams must say.

CTI as Cover: The Justification Behind Every Security Decision

CTI isn’t just about detecting threats, it’s about helping defenders justify the decisions they make. Scott Scher explains why cyber threat intelligence should be seen as cover, not an excuse. It should be seen as a way to prioritize and explain security actions with confidence. Scott lays out how CTI can give defenders clarity, accountability, and the ability to say.

Threat Actor Profile: Interlock Ransomware

A relatively new ransomware group, Interlock, has gained traction in 2025 as an opportunistic ransomware operator that leverages compromised websites and multi-stage social engineering techniques to deliver their payloads. First observed in September 2024, Interlock departs from the traditional Ransomware-as-a-Service (RaaS) model, operating without affiliates or public advertisements.

When AI Agents Go Awry

When your AI agents go awry, rewind those changes easily with Agent Rewind from Rubrik. As AI agents gain autonomy and optimize for outcomes, unintended errors can lead to business downtime. Agent Rewind will enable organizations to undo mistakes made by agentic AI by providing visibility into agents' actions and enabling enterprises to rewind those changes to applications and data. We’ve integrated Predibase's advanced AI infrastructure with Rubrik's recovery capabilities to enable enterprises to embrace agentic AI confidently.

The "So What?" Problem in Threat Intelligence

Defense teams and many others across the organization don’t always understand what intelligence is or how to use it. Scott Scher explains why that second part, how to use it, is what CTI teams often miss. Scott shares why intelligence must go beyond reports and clearly communicate what matters and what to do next. Key Points: Most teams don’t know how to apply raw intelligence CTI must embed the “so what” and “what now” Reports alone are not enough Actionability is what makes intel valuable.

Breaking the Intelligence-Defense Divide with Scott Scher

Cyber threat intelligence is often misunderstood, seen as a niche reporting function instead of the connective tissue that links defenders, leaders, and strategy. In this episode of Data Security Decoded, join Caleb Tolin as he sits down with Scott Scher, a cyber threat intelligence (CTI) expert with an unconventional backstory, to explore how his off‑grid years shaped his view on resilience, why CTI should be seen as “counter‑threat intelligence,” and how intelligence defenders, and policy teams can work as one to turn raw data into actionable security decisions.

Defending Against SCATTERED SPIDER with Falcon Next-Gen SIEM

SCATTERED SPIDER is a prolific eCrime adversary that has conducted a range of financially motivated activities beginning in early 2022. Since surfacing, this adversary continues to compromise organizations around the world, deploying ransomware and exfiltrating sensitive files.

Scattered Spider's New Telegram Channel: A Rapid Fire of Leaks, Claims and the Return of Cloud-era Data Thefts

In early August 2025 a new Telegram channel emerged presenting itself as an amalgam of three well-known cybercriminal labels Scattered Spider, ShinyHunters and LAPSUS$. Within 24 hours the channel published a steady stream of claims, partial data dumps and screenshots tied to a wide range of incidents, including retail and luxury brands, government entities, and cloud-platform related breaches. The channel’s activity revived public attention on several overlapping trends.