Staff Threat Intelligence Advisor Josh Darby MacLellan at Feedly kicks off season three by unpacking his path into CTI, what separates intelligence that gets used from intelligence that gets ignored, and why core skills like stakeholder communication may outlast technical specialties as AI reshapes the field. Josh started his career with childhood dreams of becoming a criminal lawyer, shifted through academic study of international relations and security, and unfolded into more than a decade of private-sector threat intelligence work across Canada, the US, and multiple specialties within CTI. Josh is blunt about where the field falls short. Good intelligence is connected to a decision and a decision-maker, versus reports written for other analysts that never get read. Josh and Freddy discuss team structure, and why CTI teams that skew small and heavily technical tend to miss the core skills of stakeholder conversation that keep a function relevant when budgets tighten. Josh argues communication is a trainable skill, the same way he trained himself to become a clearer public speaker despite two speech impediments and years of mumbling through bombed public talks.As for AI, Josh draws a clear line between what he'll delegate and what he won't. He uses LLMs for collection support, editing, and even as a stand-in second analyst to catch his own blind spots, but he won't hand over the analysis stage. Trusting an unreviewed AI process, he argues, is a bit like citing a source you've never actually read. Freddy pushes back with his own testing of LLMs on structured analytic techniques, and the two get into what's actually lost when a black box quietly decides what information matters.RESOURCES
NATO Intelligence Cycle - https://ac.nato.int/resources/uploads/2284/picture2-intel-8Wgsa2.png
Freddy's Intelligence Architecture Mind Map - https://github.com/Errum/IntelArchitectureMap/files/14615837/240315.-.Intelligence.Architecture.v0.7.42.pdf
Gert Jan's Measuring value of CTI - https://github.com/gertjanbruggink/metrics
Feedly - https://feedly.com/
Intel471's CU-GIRH - https://github.com/intel471/CU-GIR
Sherman Chu's Tyranny of Current Intelligence - https://www.youtube.com/watch?v=IETRHdMejaw
Sherman's slides - https://www.sans.org/presentations/were-in-now-now-the-tyranny-of-current-intelligence-and-how-to-manage-it
Intel Tradecraft Courses and Trainings - https://inteltradecraft.com/sat-certifications
IRM Workshop - https://www.intel471.com/lp/building-an-intel-workshop
SANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence
Josh Darby's SANS presentation "Can We Forecast Our Own Fate" - https://www.youtube.com/watch?v=B9TkeUbD1Mk
Josh's slide deck - https://www.sans.org/presentations/can-we-forecast-our-own-fate-mapping-the-future-of-the-cti-industry-with-sats
Feedly CTI Essentials - https://feedly.com/ti-essentials
Webinar: What CTI practitioners recommend you focus on in 2026 - https://feedly.com/ti-essentials/posts/what-cti-practitioners-recommend-you-focus-on-in-2026
Freddy and Josh Think smarter, not harder: Making SATs work in CTI - https://feedly.com/ti-essentials/posts/think-smarter-not-harder-making-sats-work-in-cti
Feedly AI - https://feedly.com/ai
MLitt in Terrorism Studies - https://www.st-andrews.ac.uk/subjects/international-relations/terrorism-mlitt/
CHAPTERS
0:00 Intro and Welcome
1:01 Josh's Path Into CTI
4:04 CTI Maturity Across Countries
8:08 Pivot to Protective Intelligence
12:12 Defining Intelligence and CTI
13:13 Good vs Bad Intelligence
16:16 The Intelligence Cycle
23:23 Engaging Stakeholders Directly
26:26 Core Skills and Job Security
33:33 Training and Certifications
40:40 Building Well-Rounded Teams
43:43 Mentoring and Giving Back
49:49 AI's Role in the Cycle
58:58 How Josh Uses AI
1:05:05 People Who Shaped His Career
