What does it take to build and run a cyber threat intelligence function, and how can you tell whether the intelligence you’re producing is any good? In this episode, host Freddy Murre sits down with Sherman Chu, who at the time of the interview worked at BlackRock, for a conversation about lessons learned on the job, tradecraft and AI.
Sherman recounts his path from Army intelligence support through grad school and a vendor role at Flashpoint, then to end-user teams in financial services, building New York City’s CTI program from the ground up, and a stint at Deloitte. He explains what changes when you move from serving a broad customer base to serving specific stakeholders, and why end-user teams must also collect internally.
Freddy and Sherman cover team-building: finding buy-in, keeping collection minimal, justifying budgets, evaluating vendors, and why training so often fails to change how a team works. Sherman shares the courses and books he considers foundational, including The Diamond Model of Intrusion Analysis and Heuer’s Psychology of Intelligence Analysis.
A key question that comes up is what separates intelligence from data and information. Sherman offers his own definition, then breaks down what bad intelligence looks like, from marketing dressed up as analysis to context-free indicator sharing. He also explains how inconsistent terminology holds the field back.
Over the last couple of years, Sherman’s view of AI has shifted from early skepticism to cautious adoption. He shares how he pairs deterministic code with LLMs to extract adversary procedures from reports, where models still hallucinate, and why analysis remains the hardest step to automate.
Their advice for newcomers is to stay curious, build a pet project, and stay humble. If you lead a CTI team, want to join one, or are weighing where AI belongs in your workflow, this episode is well worth your time.
RESOURCES
Flashpoint - https://flashpoint.io/
Columbia University MA program - https://www.sipa.columbia.edu/sipa-education/masters-programs/concentrations/international-security-and-diplomacy
SANS FOR578 CTI -https://www.sans.org/cyber-security-courses/cyber-threat-intelligence
Sergio's course "Diamond Model of Intrusion Analysis" -https://school.threatintel.academy/courses/diamond/
Joe Slowik's Training - https://paralus.co/training/ Pherson's
Structured Analytic Techniques (SAT) - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/
Richards J. Heuer, Jr. The Psychology of Intelligence Analysis -https://www.ialeia.org/docs/Psychology_of_Intelligence_Analysis.pdf
Scott J. Roberts & Rebekah Brown's book "Intelligence-Driven Incident Response - https://www.amazon.com/Intelligence-Driven-Incident-Response-Outwitting-Adversary/dp/109812068X/
VISMA and APT Attribution discussion - https://therecord.media/norway-says-chinese-group-apt31-is-behind-catastrophic-2018-government-hack
CHAPTERS
00:00 Introduction and Career Overview
02:09 From Army Intelligence to Academia
06:05 Vendor Versus End User Intelligence
13:54 Building a Government CTI Program
17:17 Training, Certifications, and Key Books
25:14 Building a CTI Function
37:46 Budgets, Tools, and Training Value
47:28 What Counts as Intelligence
52:49 What Makes Intelligence Bad
01:00:06 Shared Language and Industry Maturity
01:07:38 AI Across the Intel Cycle
01:13:13 Hybrid LLM and Code Workflows
01:16:22 AI Limits, Risks, and Democratization
01:22:44 Traits for Aspiring Analysts
01:25:01 Neurodivergence and Staying Humble
