11. Threat Intelligence, Attribution and Investigative Analytics

Introduction and Context

Cyber investigations increasingly depend on the ability to transform large quantities of technical observations into defensible intelligence. A malware hash, suspicious domain, unusual login, command-line string, or sequence of administrative actions may be useful as an indicator, but none is automatically evidence of who acted, why they acted, or whether the activity represents a serious threat. Threat intelligence provides the discipline for collecting, evaluating, contextualising, and applying such observations. Attribution and investigative analytics extend that discipline by examining relationships, behaviour, timing, infrastructure, and competing explanations.

This chapter addresses the analytical layer of cyber incident handling. Earlier investigative activities may establish how evidence is acquired and preserved; the present concern is how evidence is interpreted. The central challenge is to avoid both underreaction and overclaiming. Security teams must prioritise incidents, hunt for related activity, identify likely adversary behaviours, and support decisions while recognising uncertainty and the possibility of deception.

Threat intelligence is therefore not simply a list of indicators. It is decision-relevant knowledge about threats, expressed with sufficient context, confidence, and provenance to guide action. Investigative analytics supplies methods—such as timeline correlation, link analysis, graph analysis, and intrusion modelling—for deriving that knowledge from heterogeneous data.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish data, information, intelligence, indicators, behaviours, and TTPs.

2. Explain the intelligence cycle and assess the quality of intelligence products.

3. Apply MITRE ATT&CK, intrusion models, and kill-chain concepts to investigative analysis.

4. Correlate events across time, systems, identities, infrastructure, and artefacts.

5. Use link and graph analysis to discover relationships and investigative leads.

6. Evaluate attribution claims using evidence, confidence, alternative hypotheses, and deception awareness.

7. Prioritise incidents and threat-hunting activities according to risk and intelligence value.

8. Recognise legal, ethical, technical, and organisational limitations in intelligence work.

From Observations to Intelligence

A useful analytical distinction is the difference between an observation and an intelligence judgement. An observation is a recorded fact: an endpoint executed PowerShell, an account authenticated from two distant locations, or a domain resolved to a particular address. Information results when observations are organised and given basic meaning. Intelligence emerges when information is evaluated in relation to a defined decision or intelligence requirement.

For example, the statement “the file hash was observed on three hosts” is information. The statement “the hash is associated with a campaign that uses credential theft and lateral movement, and the affected hosts include a domain controller” is intelligence because it supports prioritisation and response. Intelligence is not necessarily certain. It should communicate confidence, evidence, assumptions, and gaps.

An intelligence requirement is a question that intelligence must answer. Examples include: Which systems are likely affected? Is the activity opportunistic or targeted? Which adversary behaviours should be hunted during the next twenty-four hours? Has a compromised credential been used outside its normal context? Requirements prevent analysts from collecting unlimited data without a decision purpose.

Important Concepts and Terminology

An indicator of compromise (IoC) is an observable artefact associated with suspicious or malicious activity, such as a hash, IP address, domain, URL, email address, registry key, or file path. Indicators are often useful for detection, but they may be changed, shared by unrelated actors, or become obsolete.

A behavioural indicator describes an action or pattern rather than a fixed artefact. Examples include disabling security tools, creating scheduled tasks, dumping credentials, or using legitimate remote administration software. Behavioural indicators generally remain useful longer than individual hashes or addresses, although legitimate administrators may perform similar actions.

Tactics, techniques, and procedures (TTPs) describe adversary behaviour at different levels. Tactics express the adversary’s objective, such as credential access or persistence. Techniques describe how that objective is pursued, such as password spraying or scheduled-task creation. Procedures are concrete implementations observed in a particular intrusion.

Threat actor is a broad term for an individual, group, criminal organisation, state-linked unit, insider, or other entity capable of conducting malicious activity. A campaign is a related set of operations, while an intrusion set is a cluster of activity assessed to share an origin or operational relationship. These terms should not be treated as proof of identity.

Confidence expresses the strength of an analytical judgement. It should be tied to evidence and may be represented qualitatively—low, moderate, or high—or through a documented scoring method. Provenance records where information came from, when it was obtained, how it was processed, and whether it has been independently corroborated.

The Intelligence Cycle as an Investigative Discipline

The intelligence cycle is commonly represented through planning and direction, collection, processing and exploitation, analysis and production, dissemination, and evaluation or feedback. In practice, the cycle is iterative rather than strictly linear.

Planning begins by identifying decisions and consumers. A chief information security officer may need a risk assessment, an incident responder may need immediate containment guidance, and a threat hunter may need hypotheses to test. The same raw data may be processed differently for each purpose.

Collection draws from endpoint telemetry, network traffic, identity systems, email security, cloud audit logs, malware analysis, vulnerability data, open sources, commercial feeds, information-sharing communities, and human reporting. Collection should be governed by relevance, legality, retention, privacy, and reliability. More data does not automatically produce better intelligence.

Processing includes normalisation, deduplication, parsing, enrichment, time synchronisation, and entity resolution. A domain may appear in different capitalisation or formats; an account may have several identifiers; and timestamps may use different time zones. Processing errors can create false relationships or conceal real ones.

Analysis converts processed data into explanations, hypotheses, assessments, and recommendations. Structured analytic techniques are valuable because they make assumptions visible. Analysts may compare competing hypotheses, examine indicators of deception, identify information gaps, and deliberately seek disconfirming evidence.

Dissemination must match the audience. A technical detection rule, an executive risk brief, and a law-enforcement referral require different levels of detail. Disseminated intelligence should preserve caveats and confidence rather than presenting uncertain judgements as facts. Feedback tests whether the intelligence supported a decision and identifies improvements for the next cycle.

MITRE ATT&CK and Intrusion Models

MITRE ATT&CK is a knowledge base and framework for describing adversary tactics and techniques based on observed behaviour. It supports a common vocabulary for detection engineering, threat hunting, incident reporting, control assessment, and adversary emulation. Analysts can map evidence to techniques, examine likely follow-on actions, and identify visibility gaps.

ATT&CK mapping requires discipline. A command that resembles a technique is not sufficient by itself; the surrounding context matters. Analysts should record the observed procedure, affected platform, source evidence, timestamp, and confidence. Mapping should not be used to imply that a particular named group conducted the intrusion unless the evidence supports that separate judgement.

Intrusion models provide a temporal or operational structure for analysis. The cyber kill chain describes stages such as reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. It is useful for communicating progression, but real intrusions may skip stages, repeat them, or operate in parallel.

The Diamond Model describes an event through four core features: adversary, capability, infrastructure, and victim. It encourages analysts to examine relationships rather than isolated indicators. For example, a phishing document is a capability, a command-and-control domain is infrastructure, and the targeted organisation is a victim. The model also supports pivoting: from a domain to certificates, from a certificate to other domains, or from a tool to other observed victims.

ATT&CK and intrusion models are complementary. The kill chain may indicate where an intrusion sits in its progression; ATT&CK may describe the specific behaviours; the Diamond Model may organise relationships among actors, tools, infrastructure, and victims. None of these models is a substitute for evidence.

Investigative Analytics: Time, Entities, and Relationships

Timeline Correlation

Timeline analysis reconstructs the sequence and interaction of events. A reliable timeline requires normalised timestamps, awareness of clock drift, preservation of original time values, and documentation of time zones and collection methods. Important time types include event time, log time, collection time, modification time, and analyst-observation time. These are not interchangeable.

Correlation should begin with a defined question. To investigate suspected credential theft, an analyst might correlate authentication events, process creation, browser access, privilege changes, and outbound connections. A timeline can reveal that a suspicious login occurred after a token was created, that a tool executed shortly after an email attachment was opened, or that data compression preceded an unusual transfer.

Temporal proximity is not causation. Events occurring close together may be unrelated, and delayed logging can distort apparent order. Analysts should seek causal links such as shared process identifiers, account use, network sessions, file paths, or cryptographic artefacts.

Entity Resolution and Link Analysis

Link analysis represents entities and relationships in order to expose connections that are difficult to see in tabular records. Entities may include users, devices, IP addresses, domains, certificates, files, malware families, cloud resources, organisations, and processes. Relationships may include “authenticated to,” “resolved to,” “downloaded,” “executed,” “shared certificate with,” or “communicated with.”

Entity resolution is a major source of error. Two records with the same name may refer to different entities, while one entity may have several names. An IP address may be dynamically reassigned; a domain may use shared hosting; and a malware family label may differ between vendors. Good analysis records the basis and confidence of each relationship.

Link analysis is especially useful for pivoting. Starting from a suspicious domain, an analyst may identify DNS history, certificate reuse, passive DNS associations, related URLs, hosting providers, email subjects, and endpoint observations. Each pivot should be evaluated for relevance; a connection is a lead, not necessarily proof of common control.

Graph Analysis

A graph consists of nodes and edges. In cyber investigations, nodes represent entities and edges represent relationships, often with timestamps, direction, confidence, and source provenance. Graphs may be directed, weighted, temporal, or multilayered. A temporal graph can show how infrastructure or accounts change over time; a multilayer graph can distinguish network, identity, file, and organisational relationships.

Useful graph measures include degree, which indicates the number of connections; centrality, which identifies influential or intermediary nodes; community structure, which may reveal clusters; and path analysis, which can identify possible relationships between entities. These measures are investigative aids, not automatic conclusions. A high-degree domain may simply belong to a hosting provider, and a central account may be a legitimate service account.

Graph analysis can support defensive prioritisation. A compromised identity connected to privileged systems, sensitive repositories, and multiple suspicious endpoints may deserve urgent investigation. Similarly, an infrastructure node linked to several confirmed malicious artefacts may have greater blocking or monitoring value than an isolated indicator.

Attribution: Testing Claims Rather Than Naming Enemies

Attribution asks who conducted an activity, or which actor or group is most consistent with the available evidence. It may operate at several levels: technical attribution to infrastructure or tools, operational attribution to a campaign, organisational attribution to a group, and strategic attribution to a state or sponsor. Confidence should normally decrease as the claim becomes broader and more politically consequential.

Attribution evidence may include infrastructure acquisition and reuse, malware development practices, operational habits, targeting patterns, language or time-zone clues, victimology, command-and-control procedures, and intelligence from trusted sources. However, many of these features can be copied, purchased, falsified, or intentionally planted.

A disciplined attribution assessment separates facts from inferences. A report might state that a domain was registered using a particular pattern, that its server communicated with a known sample, and that the activity targeted a defined sector. It should then explain why those facts support one hypothesis more than alternatives. It should not present a group label as an observed fact.

Competing-hypothesis analysis is valuable. Possible explanations might include a known criminal group, a copycat, an independent operator using a leaked tool, a compromised third party, or a false-flag operation. Analysts should identify what evidence would be expected under each hypothesis and whether that evidence is present. Absence of evidence may reduce confidence, but it does not always disprove a hypothesis because collection may be incomplete.

Attribution has operational and diplomatic consequences. Organisations should avoid public claims that exceed the evidence, particularly when naming individuals, criminal groups, or states. Internal response can often proceed without definitive attribution: containment, credential resets, hunting, and recovery depend primarily on observed behaviour and risk.

Prioritisation and Threat Hunting

Threat intelligence becomes operationally valuable when it changes action. Prioritisation should combine confidence in the finding with potential impact, exploitability, affected asset criticality, adversary progression, and uncertainty. A low-confidence indicator on a public test system may be less urgent than a moderate-confidence behavioural pattern involving a privileged account and a sensitive database.

Threat hunting is hypothesis-driven investigation conducted to identify malicious activity that automated controls may have missed. A useful hunt hypothesis is specific, testable, and linked to an adversary behaviour. For example: “If an attacker has established persistence through scheduled tasks, then recently created tasks on high-value servers will show unusual authorship, execution paths, or network activity.” The hunt should define data sources, query logic, expected benign explanations, escalation criteria, and stopping conditions.

ATT&CK can support coverage analysis. An organisation may map observed techniques against available controls and identify techniques with poor telemetry or detection. Coverage should be measured carefully: a control that generates alerts is not necessarily effective if it lacks context, produces excessive noise, or cannot support investigation.

Illustrative Case Study: The Northbridge Manufacturing Intrusion

Background

Northbridge Manufacturing, a fictional multinational organisation, operates a hybrid environment containing on-premises directory services, cloud email, engineering workstations, and production-support servers. Its security team receives an alert that a newly registered domain resembles the organisation’s supplier portal. An employee has opened a document from an external email, and the endpoint later generated unusual authentication and network events.

Situation and Problem

The initial evidence includes the email domain, a document hash, a PowerShell execution event, a new scheduled task, and a successful login to a file server from the employee’s account. A commercial intelligence feed associates the domain with a criminal group. Management asks whether the group is responsible and whether production systems are at risk.

Analysis

The team first preserves the original email, attachment, endpoint logs, identity records, and relevant network data. Timestamps are converted to a common reference while original values are retained. The document is analysed in an isolated environment. Its macro downloads a script, but the team does not treat the script alone as proof of actor identity.

A timeline shows that the employee opened the document at 09:14, PowerShell executed at 09:15, a scheduled task was created at 09:18, and the account authenticated to a file server at 09:27. The file server then made an outbound connection to the suspicious domain. This sequence supports a hypothesis of initial access followed by persistence and lateral movement.

The team maps the observed behaviour to relevant ATT&CK techniques, while recording the actual procedures and evidence. Link analysis connects the domain to a certificate and two URLs, but one associated address belongs to shared hosting. Graph analysis therefore assigns high confidence to the relationship between the endpoint and the domain, moderate confidence to the certificate association, and low confidence to the shared-hosting connection.

For attribution, analysts compare three hypotheses: the named criminal group, a copycat using its publicly available tools, and an unrelated actor exploiting reused infrastructure. The domain pattern and malware similarity support the first hypothesis, but the evidence does not distinguish it conclusively from the second. The assessment is reported as “activity consistent with” the group, with moderate confidence, rather than as definitive attribution.

Approach and Response

The organisation disables the compromised account, revokes active sessions, isolates the endpoint, searches for the scheduled task across comparable systems, and reviews authentication from the account during the previous thirty days. It hunts for the observed behaviour rather than relying only on the document hash or domain. Production-support systems receive priority because of their operational importance.

The security team also contacts the hosting provider through appropriate channels, updates email controls, and shares carefully sanitised indicators with a trusted information-sharing community. Personal data unrelated to the investigation is minimised in reports.

Outcome

The hunt identifies two additional endpoints with the same scheduled-task pattern, but no evidence of access to production-control systems. One of the additional systems contains the document but never executed it. The organisation concludes that compromise is confirmed on one endpoint, probable on a second, and exposure without execution on a third. The actor attribution remains moderate-confidence and is not used as the basis for public accusation.

Learning Points

The case demonstrates why behaviour and sequence may be more valuable than a single indicator. It also shows the importance of distinguishing exposure from execution, using graph relationships cautiously, separating attribution from response, and communicating uncertainty explicitly.

Limitations, Risks, and Common Errors

False positives arise when benign tools, shared infrastructure, or administrative activity resembles malicious behaviour. False negatives arise from incomplete telemetry, log deletion, encrypted traffic, use of legitimate credentials, and adversary adaptation. Intelligence feeds may contain duplicated, stale, poorly sourced, or commercially biased information.

A common error is indicator absolutism—the assumption that an IP address, hash, or domain proves compromise or actor identity. Another is confirmation bias, in which analysts favour evidence supporting an initial attribution and discount contradictory facts. Automation can amplify both errors when machine-generated scores are treated as judgements.

Other risks include double counting correlated evidence, confusing temporal sequence with causation, failing to account for shared services, ignoring clock errors, and mapping every event to an ATT&CK technique without sufficient context. Analysts should also avoid excessive graph complexity. A visually impressive graph may obscure rather than clarify the relevant relationship.

Governance, Ethics, and Professional Practice

Threat intelligence must comply with applicable privacy, surveillance, data-protection, employment, and evidence-handling requirements. Collection should be proportionate to a legitimate security purpose. Access to identity, communications, and behavioural data should be restricted, logged, and reviewed.

Information sharing requires classification, handling rules, and removal of unnecessary personal information. Analysts must distinguish verified facts, assessed judgements, and third-party claims. Reports should preserve provenance and confidence so that recipients do not mistake an intelligence lead for adjudicated evidence.

Attribution carries ethical obligations. Naming an actor can affect individuals, organisations, and international relations. Professional practice requires cautious language, peer review for consequential claims, consideration of alternative explanations, and correction when new evidence changes the assessment.

Technology, Automation, and Emerging Developments

Security information and event management systems, endpoint detection platforms, security orchestration tools, malware sandboxes, graph databases, and case-management systems increasingly support investigative analytics. Natural-language processing can extract entities from reports, while machine-learning systems can identify unusual sequences or cluster infrastructure. These tools improve scale but do not remove the need for human validation.

Generative AI may assist with query construction, report summarisation, entity extraction, and hypothesis generation. It can also hallucinate relationships, reproduce source bias, expose sensitive data, or produce confident but unsupported attribution. AI-assisted analysis should therefore retain source links, human approval, audit logs, and explicit uncertainty.

Emerging practice is moving toward identity-centric detection, cloud and software-as-a-service telemetry, temporal graph analytics, privacy-preserving information sharing, and continuous validation of detection coverage. Defensive teams increasingly focus on adversary behaviours and attack paths rather than static lists of indicators. At the same time, attackers exploit legitimate cloud services, generative tools, stolen credentials, and supply-chain relationships, making context and provenance more important.

Best Practices for Advanced Investigative Analytics

1. Begin with a decision or intelligence requirement, not an indiscriminate data search.

2. Preserve original evidence, timestamps, source metadata, and processing history.

3. Combine indicators with behaviours, asset criticality, identity context, and sequence.

4. Use ATT&CK and other models as analytical vocabularies, not as proof of attribution.

5. Assign confidence to relationships and judgements, and explain the basis for each.

6. Test competing hypotheses and actively seek disconfirming evidence.

7. Treat shared infrastructure and legitimate tools as sources of ambiguity.

8. Prioritise response according to likely impact, not merely indicator severity.

9. Separate operational containment from the requirement to establish definitive attribution.

10. Apply privacy, access control, retention, peer review, and audit requirements throughout the intelligence cycle.

Chapter Summary

Threat intelligence transforms technical observations into contextual knowledge that supports decisions. Its quality depends on clearly defined intelligence requirements, reliable collection, careful processing, transparent analysis, suitable dissemination, and feedback. Indicators are useful but fragile; behaviours and TTPs often provide stronger investigative continuity.

MITRE ATT&CK supplies a common language for adversary behaviour, while the kill chain and Diamond Model organise progression and relationships. Timeline correlation reconstructs sequences, link analysis reveals investigative pivots, and graph analysis supports relationship discovery and prioritisation. Attribution must be treated as a hypothesis supported by graded evidence, tested against alternatives, and communicated with appropriate confidence.

Effective threat hunting is hypothesis-driven and risk-informed. Modern tools, automation, graph databases, and AI can improve scale, but they also introduce bias, opacity, and false confidence. Professional practice therefore depends on provenance, validation, ethical collection, privacy protection, and disciplined judgement.

Key Terms

Indicator of Compromise: An observable artefact associated with suspected malicious activity.

Behavioural Indicator: An action or pattern suggesting suspicious or malicious activity.

TTPs: Tactics, techniques, and procedures describing adversary goals, methods, and implementations.

Threat Intelligence: Evaluated and contextualised knowledge used to support security decisions.

Intelligence Requirement: A defined question or information need linked to a decision.

Provenance: The documented origin, processing history, and reliability context of information.

Confidence: An assessment of how strongly evidence supports a judgement.

Threat Actor: An individual or organised entity capable of conducting harmful cyber activity.

Campaign: A related set of operations associated with a common objective or activity pattern.

MITRE ATT&CK: A knowledge base organising observed adversary tactics and techniques.

Kill Chain: A model representing stages through which an intrusion may progress.

Diamond Model: A model relating adversary, capability, infrastructure, and victim.

Timeline Correlation: The comparison of time-ordered events to reconstruct activity and sequence.

Link Analysis: Analysis of entities and their relationships to identify investigative connections.

Graph Analysis: Mathematical and visual analysis of nodes, edges, clusters, paths, and centrality.

Entity Resolution: The process of determining whether records refer to the same real-world entity.

Attribution: The assessment of who conducted an activity or to which actor it is most consistent.

Threat Hunting: Proactive, hypothesis-driven investigation for activity missed by routine controls.

False Positive: A benign event incorrectly classified as malicious.

False Negative: Malicious activity that is not detected or correctly identified.

Review Questions

Short Answer Questions

1. Distinguish an indicator of compromise from a behavioural indicator.

2. What is the purpose of an intelligence requirement?

3. Why must original timestamps be preserved during timeline analysis?

4. Name the four core features of the Diamond Model.

5. Why should attribution claims include confidence and alternative explanations?

Long Answer Questions

1. Explain the intelligence cycle and discuss how feedback improves investigative practice.

2. Compare the uses of MITRE ATT&CK, the cyber kill chain, and the Diamond Model.

3. Discuss how link analysis and graph analysis can support threat hunting and incident prioritisation.

4. Explain the principal sources of error in cyber attribution and propose methods for reducing them.

5. Examine the governance, privacy, and ethical issues involved in producing and sharing threat intelligence.

Analytical / Application Questions

1. A privileged account authenticates to a sensitive server shortly after a phishing attachment is opened. Design a timeline-correlation approach and identify the evidence needed before concluding that lateral movement occurred.

2. An IP address is linked to several malicious domains but is also used by a shared hosting provider. Explain how you would assess the relationship and decide whether blocking the address is justified.

3. A threat report identifies a known criminal group based on malware similarity and targeting. Construct at least three competing hypotheses and describe what additional evidence would increase or reduce confidence in the attribution.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes threat intelligence from raw security data?

A. Threat intelligence is always confidential, while raw data is public.

B. Threat intelligence is evaluated and contextualised for a security decision.

C. Threat intelligence consists only of malware hashes and IP addresses.

D. Threat intelligence is produced automatically without analyst judgement.

Correct Answer: B. Threat intelligence is evaluated and contextualised for a security decision.

Question 2

An analyst observes PowerShell execution, scheduled-task creation, and unusual authentication. Which approach provides the strongest initial investigative value?

A. Block every IP address seen in the logs.

B. Rely only on the file hash associated with the email.

C. Correlate the behaviours, identities, assets, and sequence in a timeline.

D. Attribute the activity immediately to the group named in a commercial feed.

Correct Answer: C. Correlate the behaviours, identities, assets, and sequence in a timeline.

Question 3

What is the primary purpose of mapping activity to MITRE ATT&CK?

A. To prove the legal identity of the attacker.

B. To provide a common vocabulary for observed adversary behaviour.

C. To replace the need for evidence preservation.

D. To determine the exact financial cost of an incident.

Correct Answer: B. To provide a common vocabulary for observed adversary behaviour.

Question 4

Which statement about temporal proximity is most accurate?

A. Events close in time necessarily have a causal relationship.

B. Temporal proximity is irrelevant in incident investigation.

C. Temporal proximity is useful but should be supported by causal or contextual links.

D. Temporal proximity proves that the earliest event caused all later events.

Correct Answer: C. Temporal proximity is useful but should be supported by causal or contextual links.

Question 5

In the Diamond Model, a command-and-control domain is primarily classified as which feature?

A. Victim

B. Capability

C. Infrastructure

D. Adversary objective

Correct Answer: C. Infrastructure

Question 6

Why is a high-degree node in a cyber graph not automatically malicious?

A. Graph analysis cannot represent legitimate systems.

B. High connectivity may result from shared hosting or common legitimate services.

C. Centrality measures always produce false negatives.

D. Nodes with many edges are excluded from attribution analysis.

Correct Answer: B. High connectivity may result from shared hosting or common legitimate services.

Question 7

Which attribution practice is most defensible?

A. Treating malware similarity as conclusive proof of actor identity.

B. Reporting observed facts separately from hypotheses and confidence judgements.

C. Ignoring alternative explanations once a group appears likely.

D. Using public attribution claims to justify containment without technical evidence.

Correct Answer: B. Reporting observed facts separately from hypotheses and confidence judgements.

Question 8

A threat hunt is most effective when it is based on which characteristic?

A. An unlimited search through every available log.

B. A specific, testable hypothesis linked to behaviour and defined data sources.

C. A single outdated indicator from an unverified source.

D. A requirement to find evidence supporting an initial attribution.

Correct Answer: B. A specific, testable hypothesis linked to behaviour and defined data sources.

Question 9

Which factor should most influence incident prioritisation?

A. The length of the alert description.

B. The popularity of the malware family name.

C. The combination of confidence, asset criticality, likely impact, and adversary progression.

D. Whether the indicator appears in a public report.

Correct Answer: C. The combination of confidence, asset criticality, likely impact, and adversary progression.

Question 10

What is a major governance risk when using generative AI for threat intelligence?

A. It cannot process any structured data.

B. It may invent relationships or produce confident unsupported conclusions.

C. It always prevents analysts from reviewing source material.

D. It makes privacy controls unnecessary.

Correct Answer: B. It may invent relationships or produce confident unsupported conclusions.