The ThreatSpire Field Notes

Intelligence, written by analysts — for analysts.

Tradecraft, threat-landscape reads, and opinion from the ThreatSpire team. Plain language, evidence-first, no vendor noise.

Jason Faulhefer Jul 31, 2026 9 min read

Intelligence-Driven Tabletop Exercises for Water Utilities

Most water utility tabletops rehearse a generic ransomware story. Here is how to build exercises from real intelligence about your own plant, your own vendors, and your own remote access paths.

Water SectorICS/OTThreat IntelligenceIncident Response

Read the post

All posts

Jason Faulhefer Jul 30, 2026 9 min read

Water Sector Supply Chain Intelligence: Integrators, Vendors, and Chemical Suppliers

Water utilities are reached through the integrators, panel builders, instrument techs, and chemical suppliers who touch the plant. Here is how to inventory that network, write intelligence requirements against it, and push the findings into contracts.

WaterSupply ChainCTI

Jason Faulhefer Jul 29, 2026 9 min read

CTI for Small Water Systems: A Program Two People Can Run

Most water systems have no SOC and no analyst. Here is a threat intelligence practice sized for a two person shop: three requirements, five sources, two artifacts, and one rehearsed manual fallback.

Water SectorICS/OTIntelligence Requirements

Jason Faulhefer Jul 28, 2026 7 min read

Remote Access at Water Utilities: Who Can Touch the Plant Tonight?

Yesterday we looked at building intelligence around treatment and distribution. The follow up question is narrower and harder: at this exact moment, who or what can reach the plant from outside the fence, and would you know if they did?

Water/WastewaterICS/OTRemote Access

Jason Faulhefer Jul 28, 2026 8 min read

CTI for Water Utilities: Building Intelligence Around Treatment and Distribution

Water and wastewater systems run lean, span hundreds of unmanned sites, and lean heavily on remote access. Generic threat feeds do not help them. Here is what a working intelligence program looks like for a utility that treats and moves water.

Water/WastewaterICS/OTCTI

Jason Faulhefer Jul 24, 2026 7 min read

What a Modbus and IEC-104 Honeypot Fleet Actually Teaches You

Deploying vendor-authentic Modbus/TCP and IEC 60870-5-104 decoys is only the start. The real value comes from what the traffic tells you about scanning campaigns, targeted operators, and pre-attack reconnaissance against grid and manufacturing assets.

HoneypotsICS/OTThreat Intel

Jason Faulhefer Jul 23, 2026 6 min read

PIRs for OT: Writing Intelligence Requirements That Actually Fit a Plant

Most PIR templates were written for enterprise IT. When you drop them into a plant or a substation program, they either go unanswered or produce reports no operations leader will read.

PIRsICS/OTProgram

Jason Faulhefer Jul 22, 2026 7 min read

Evidence Timeline for OT Incidents: What to Capture Before You Lose It

OT environments overwrite the evidence you need faster than IT ones do. A disciplined evidence timeline captured in the first hours is worth more than any post incident forensic effort.

Incident ResponseICS/OTEvidence

Jason Faulhefer Jul 21, 2026 6 min read

Grid Signal: What Cross Sensor Correlation Actually Reveals

A single honeypot tells you what one attacker did in one place. A correlated fleet tells you which campaigns are hunting your sector, which are opportunistic, and which are quietly trying not to be seen.

HoneypotsICS/OTAnalytics

Jason Faulhefer Jul 20, 2026 8 min read

Protocol Aware Detections: Practical Rules for Modbus, DNP3, IEC-104, and MMS

Generic network detections miss the behaviors that actually matter on a control network. A small set of protocol aware rules per protocol will catch more real activity than a thousand IT signatures ever will.

DetectionICS/OTProtocols

Jason Faulhefer Jul 14, 2026 6 min read

Remote Access Is Still the Front Door to OT

Nearly every publicly reported OT intrusion of the last five years touched remote access at some point. Treating that pathway as a first class collection target is one of the highest leverage moves a CTI program can make.

AccessICS/OTThird Party

Jason Faulhefer Jul 14, 2026 5 min read

Vendor Advisories Are Not Intelligence Yet

A vendor advisory is raw material. Turning it into intelligence for an ICS/OT environment takes exposure mapping, exploitability assessment, and a clear tie to a decision.

CTIICS/OTVulnerabilities

Jason Faulhefer Jul 14, 2026 7 min read

NERC CIP and CTI: Turning Compliance Controls Into Detection Value

Most CIP programs treat compliance and threat intelligence as separate universes. The controls that CIP already requires are, with small additions, one of the richest detection surfaces a utility can build.

NERC CIPICS/OTProgram

Jason Faulhefer Jul 14, 2026 8 min read

Actor Tracking for ICS Groups: How to Follow VOLTZITE, ELECTRUM, and Peers Without Losing the Signal

ICS focused groups do not behave like ransomware crews. Tracking them requires a different cadence, different collection sources, and a different bar for attribution.

Threat ActorsICS/OTCTI

Jason Faulhefer Jul 14, 2026 6 min read

IOCs in OT: Why Hashes and IPs Fail in the Substation

The IT playbook of hash and IP indicators breaks down inside a substation or plant. Effective OT indicators look more like protocol behavior, engineering workstation drift, and unexpected point writes.

IOCsICS/OTDetection

Jason Faulhefer Jun 25, 2026 8 min read

Purple Team Intelligence: Red Team Findings as a Controlled Collection Source

Red team engagements are usually treated as audits. Treat them as a controlled collection source instead and your CTI program gains ground truth that no feed can match.

purple teamred teamcti collection

Jason Faulhefer Jun 24, 2026 8 min read

Writing Intelligence Assessments That Executives Actually Read

Most CTI reports lose the executive in the first paragraph. Apply the Pyramid Principle and you will get read, understood, and acted on.

intelligence writingexecutive communicationcti

Jason Faulhefer Jun 24, 2026 10 min read

CTI Program Maturity: Why Requirements Beat Feeds Every Time

Mature CTI programs are smaller, quieter, and more useful than the feed-led factories they replace. Here is why requirements — not feeds — are the architectural decision that separates a noise machine from a decision-support function, and how to move up the maturity curve.

CTIIntelligence RequirementsProgram Maturity

Jason Faulhefer Jun 23, 2026 7 min read

The SOC and CTI Feedback Loop: How Threat Intel Earns Its Seat in the SOC

CTI teams complain that the SOC ignores their reports. SOC teams complain that CTI is theoretical. The fix is a small set of feedback rituals.

soc operationsctioperational intelligence

Jason Faulhefer Jun 22, 2026 8 min read

Dark Web Monitoring for CTI: Collection Tradecraft for Underground Markets

Dark web monitoring is the most oversold capability in CTI. Done right, it is also one of the most useful. Here is the collection tradecraft that separates the two.

dark webcti collectiontradecraft

Jason Faulhefer Jun 19, 2026 8 min read

Threat Hunting with Intelligence Requirements: Hypothesis-Driven Sweeps That Actually Find Things

Most hunts are searches for the things you already know how to detect. A PIR driven hunting program asks the questions your detections cannot answer.

threat huntingctipirs

Jason Faulhefer Jun 18, 2026 8 min read

Ransomware Negotiation Leaks: Using Leak Site Data to Model the Adversary's Business

Leak site posts and negotiation transcripts are public, abundant, and underused. Read them like a business analyst and you can predict pricing, dwell, and exfiltration behavior.

ransomwarectileak site analysis

Jason Faulhefer Jun 17, 2026 7 min read

Supply Chain Intelligence: Vendor Risk Through an Intelligence Lens

Vendor risk programs ask the wrong questions and get the wrong answers. Here is how to apply a CTI lens to the suppliers most likely to bring an adversary into your network.

supply chainthird party riskcti

Jason Faulhefer Jun 16, 2026 7 min read

Nation-State Attribution: Communicating Uncertainty Without Diluting Impact

Attribution is a probabilistic claim, not a verdict. Here is how to communicate confidence honestly without producing a report that no one can act on.

attributionctiintelligence writing

Jason Faulhefer Jun 15, 2026 7 min read

The Half-Life of an IOC: Operationalizing Decay and Confidence Scoring

An IOC is not a fact. It is a perishable claim. Treat indicators like radioactive isotopes with a half-life and your blocklists, hunts, and reports get a lot more honest.

indicators of compromisectidetection engineering

Jason Faulhefer Jun 12, 2026 8 min read

From ATT&CK Mapping to Detection Logic: Closing the SIEM Handoff Gap

Mapping a report to MITRE ATT&CK is not the same as detecting the behavior. Here is how to translate technique IDs into SIEM and SOAR logic your SOC can actually run.

mitre attackdetection engineeringctisoc

Jason Faulhefer Jun 11, 2026 10 min read

Intelligence Requirements Management: Tracking, Reviewing, and Retiring PIRs

Creating Priority Intelligence Requirements is only half the battle. The other half is managing them over time: tracking progress, reviewing relevance, and knowing when to retire a requirement that has served its purpose or outlived its usefulness.

CTIPIR ManagementIntelligence Lifecycle

Jason Faulhefer Jun 10, 2026 11 min read

The CTI Intelligence Collection Plan: Turning PIRs into Daily Analyst Work

A practical guide to building a CTI collection plan that converts approved PIRs into the daily analyst rhythm - source assignments, frequencies, named owners, gap registers, and weekly reviews that keep the plan alive.

CTICollection PlanIntelligence Requirements

Jason Faulhefer Jun 8, 2026 7 min read

Cyber Threat Intelligence Requirements: Translating Business Risk into Collection Tasks

How to turn vague executive worries about cyber risk into specific, assignable intelligence collection tasks - with a five-part requirement template and a 30-day starter plan.

CTIIntelligence RequirementsRisk Management

Jason Faulhefer Jun 4, 2026 12 min read

Building a Threat Intelligence Program Around Intelligence Requirements

Most threat intelligence programs start with a feed subscription and a wish. The ones that succeed start with a clear set of intelligence requirements that tie every collection decision, every analysis product, and every dissemination channel to a decision-maker's need.

CTIIntelligence RequirementsProgram Design

Grimm's Gadgets Jun 4, 2026 8 min read

Building an Evidence Timeline

Don't paste a pile of bullet points and call it an actor timeline. Record what was reported, where it came from, how good the source is, and what *you* concluded, all kept separate. Then it survives the "how do you know?" question.

CTIEEITLDR

Jason Faulhefer Jun 2, 2026 10 min read

The Intelligence Requirements Process: From Stakeholder Question to Evidence-Backed Answer

A step-by-step walkthrough of the Intelligence Requirements Process — the repeatable workflow that turns a stakeholder question into an evidence-backed answer that actually changes decisions.

CTIIntelligence RequirementsProcess

Jason Faulhefer Jun 1, 2026 9 min read

Intelligence Requirements Examples: 12 PIRs Mature CTI Teams Actually Use

Twelve real Priority Intelligence Requirements that mature CTI teams maintain — with the decisions they support, the consumers they serve, and the IRs and EEIs that flow out of each. Use them as templates for your own program.

CTIPIRIntelligence Requirements

Jason Faulhefer May 30, 2026 12 min read

How to Develop Priority Intelligence Requirements (Step-by-Step with Examples)

A practical, step-by-step process for developing Priority Intelligence Requirements that drive decisions instead of noise. Includes concrete examples, templates, and a checklist.

CTIPIRIntelligence Requirements

Jason Faulhefer May 29, 2026 8 min read

What Are Priority Intelligence Requirements? Definition, Examples, and How They Drive a CTI Program

Priority Intelligence Requirements are formal questions that connect threat intelligence to real decisions. Learn what PIRs are, see real-world examples, and discover how they transform a CTI program from reactive reporting into strategic security.

CTIPIRsIntelligence Requirements

Jason Faulhefer May 29, 2026 9 min read

Priority Intelligence Requirements (PIRs): A Practical Guide for CTI Teams

PIRs are the contract between CTI and the people who use it. A practical guide to writing, ranking, and operating Priority Intelligence Requirements without turning your program into a paperwork exercise.

CTIPIRsIntelligence Requirements

Grimm Gadgets May 4, 2026 4 min read

Do Not Rush

When advisories drop and Slack lights up, analysis fragments. A controlled approach — observed, assessed, unknown, next actions — keeps reasoning intact while everything else accelerates.

AnalysisTradecraft

Jason Faulhefer May 4, 2026 9 min read

The Double-Edged Sword of AI: Why Faster Development May Be Creating Bigger Cyber Risks

AI is making developers faster and analysts more efficient — but it is also shipping insecure code, exposed secrets, and unreviewed cloud infrastructure at machine speed. The result is a new class of invisible enterprise risk.

Artificial IntelligenceAppSecDevSecOps

Grimm Gadgets Apr 28, 2026 5 min read

AI Did Not Replace the Attacker. It Made the Attacker Faster.

The 2025 breach data tells a clear story: credential theft, phishing, and unpatched systems still dominate. AI did not invent new intrusion categories — it accelerated the ones attackers were already running.

Artificial IntelligenceThreat Landscape

Jason Faulhefer Apr 28, 2026 7 min read

Threat Intelligence Is Broken: Why Most Organizations Collect Feeds But Gain No Real Defense

Most enterprises have built an expensive repository of disconnected threat data that rarely yields measurable defensive outcomes. The fix is operational intelligence — relevance, exposure, exploitability, action.

CTIStrategySOC

Jason Faulhefer Apr 27, 2026 7 min read

Cybersecurity Has Entered the Autonomous Machine Defense Race

Anthropic Mythos, Google''s agentic SOC, Microsoft''s AI Zero Trust, and CrowdStrike''s AI runtime security — taken together, these are not isolated product launches. They signal an industry-wide control-plane shift.

StrategyArtificial IntelligenceSOC

Jason Faulhefer Apr 27, 2026 8 min read

Junior CTI Analysts Need to Learn How the Pieces Fit Together

Juniors can recognize the actor name, copy the IOCs, and map MITRE techniques. The harder part is figuring out whether any of it matters to the organization — and what someone should actually do next.

CTITradecraftTraining

Jason Faulhefer Apr 25, 2026 6 min read

Claude Mythos and the OT Threat Horizon: What Utility Operators Need to Know Now

Mythos is a frontier AI system capable of autonomously discovering zero-days in every major OS and browser — software underpinning the HMIs, engineering workstations, and remote access gateways in your control centers today.

OT/ICSNERC CIPArtificial Intelligence