In this episode of Intelligence Tradecraft, host Freddy Murre sits down with Rebecca Ford, a cyber threat intelligence analyst who started out on the government side with Army Cyber and DISA, focused heavily on North Korea and the Asia-Pacific region. From there, she moved into the private sector, where she's spent the better part of a decade helping grow a CTI function from an early-stage team into something far more mature.
Rebecca traces her path into the field: an overheard conversation about true-crime shows that led an Army analyst to recruit her, on-the-job training in an era before cyber threat intelligence even had a name, and the 2014 Sony hack as the moment the discipline truly landed on the map.
She and Freddy explore what separates useful intelligence from what she calls being reduced to "news reporters with a microphone." The difference lies in handing stakeholders a raw threat feed versus giving them analysis that actually drives a decision. Rebecca shares her working definition of intelligence, built around an adversary's intent, opportunity, and capability. They also get into the two very different audiences an analyst serves, senior leadership and network defenders, and why treating report counts as a success metric misses the point entirely.
The conversation covers building real relationships with stakeholders, the argument for "fusion centers" that merge cyber, physical, travel, and financial-crime intelligence, and the considerable value of community and mentorship in a field where, as Rebecca puts it, your next opportunity usually comes from someone who already knows you.
A large part of the discussion is about AI: where it genuinely speeds up research and helps an analyst get started, why Rebecca still verifies everything by hand before it goes out, and why she believes human judgment should stay in charge of the final call.
Rebecca ends with a reminder that showing up and investing in the community, whether at conferences, in focus groups, or at vendor events, is part of the job for anyone hoping to build a career in the field.
RESOURCES
Sony Hack - https://www.bbc.com/news/world-asia-30573040
Gert Jan's Metrics - https://github.com/gertjanbruggink/metrics
SANS CTI Summit 2026 Visual Summary - https://www.sans.org/blog/visual-summary-sans-cti-summit-2026
Rebecca's LinkedIn - https://www.linkedin.com/in/rebeccaford/
Freddy's Intelligence Architecture Mind Map - https://github.com/Errum/IntelArchitectureMap
Reuters IKEA bets on remote interior design as AI changes sales strategy - https://www.reuters.com/technology/ikea-bets-remote-interior-design-ai-changes-sales-strategy-2023-06-13/
CHAPTERS
00:00 Welcome & Rebecca's Background
00:57 Breaking Into Cyber Threat Intel
02:58 Learning Cyber Intel From Scratch
04:30 The Sony Hack Turning Point
06:53 From Army Cyber to DISA
09:32 Adjusting to the Private Sector
12:29 Defining Intelligence and Stakeholders
15:16 Proving Value and Building Community
23:14 Good Intelligence vs. Bad Intelligence
26:20 Mentorship and Learning From Mistakes
34:01 Team Diversity and Fusion Centers
40:25 Misconceptions and Measuring Impact
47:00 Communicating With Stakeholders
55:07 Where AI Fits in Intel
1:13:15 Mentors, Advice & Closing Thoughts
