Connecting the Dots: Threat Intelligence, Cyber Incidents, and Materiality

### Overview Presented at RSAC 2024 by PwC threat intelligence leaders Allison Wyckoff and Sierra Stanczyk, this session examines the intersection of cyber threat intelligence (TI), incident response (IR), and materiality determinations. Spurred by the SEC cybersecurity disclosure rules that took effect in December 2023, the speakers explain how organizations can objectively evaluate incident impact and navigate reporting obligations. Even for entities not strictly governed by the SEC rule, integrating threat intelligence into incident response provides the vital business context needed to distinguish routine issues from critical, material events.

### Key Topics - **SEC Disclosure Ruling and Materiality:** The rule requires disclosing a cyber incident within four business days of determining that it is material (rather than four days from discovery or occurrence). Materiality hinges on whether an incident would be of significance to an investor (or board/clients) and whether newly uncovered facts alter the "total mix of information." Evaluating materiality requires balancing quantitative factors (data volume, loss of key credentials) with qualitative consequences (competitive harm, business valuation drops, and regulatory fines). - **Threat Intelligence Levels and Lifecycle:** Threat intelligence operates across tactical (indicators, discrete events), operational (campaigns, threat actor TTPs, targeting), and strategic (geopolitical trends, AI adoption, long-term threat landscape) tiers. Rather than working in isolation, TI serves as an iterative lifecycle that links facts, identifies analytical gaps, enriches incident data, and projects near- and long-term impacts. - **Materiality Case Studies:** The speakers presented five realistic scenarios to highlight how intelligence context shifts materiality evaluations: 1. *Targeted vs. Opportunistic Phishing:* An employee clicks a Ukrainian-themed phishing attachment leading to credential loss; determining materiality requires knowing employee roles, geographic business presence, and whether the campaign was widespread or targeted. 2. *State-Sponsored Intrusion Staging:* Exploitation of a public-facing application involving PowerShell, Mimikatz, and lateral movement attributed to an Iranian threat actor ("Yellow Dev 24"), raising questions of whether pre-ransomware staging or OT targeting constitutes a material incident. 3. *Deepfake Business Email Compromise (BEC):* An insider leaks an executive webcast, enabling attackers to generate an AI deepfake of the CFO for a video call with a client to alter billing invoices. 4. *Credential Re-exposure:* Corporate-linked credentials from a non-material 2022 incident resurface on high-profile dark web forums in 2024, driving social media breach rumors and investor scrutiny. 5. *Ransomware Affiliate Intrusion ("Whac-A-Mole"):* Disparate indicators (BloodHound, persistence tasks, RDP, Cobalt Strike) tied to a prolific ransomware affiliate dubbed "White Fellas" (operating across schemes like LockBit, Play, and Black Basta), illustrating how TI connects fragmented activity before deployment.

### Technical Details & Organizational Capabilities Building an effective internal threat intelligence capability requires five core pillars: - **Internal Remit & Mission:** Establishing clear program objectives, definitions, and defined requirements. - **Stakeholder Integration:** Embedding TI across incident response, vulnerability management, identity management, legal, compliance, and executive leadership. - **Internal Access:** Granting TI analysts sufficient visibility into internal environments, SIEM platforms, and threat intelligence platforms (TIPs) rather than isolating them without internal telemetry. - **Strategic Prioritization:** Aligning collection and monitoring to the organization's unique "crown jewels" and operational footprint. - **External Partnerships & Community Sharing:** Participating in ISACs, information-sharing groups, and working with external intelligence partners to complement internal visibility gaps.

### Takeaways Context is the foundation of incident severity and materiality assessments. Threat intelligence serves as a force multiplier and the connective tissue between technical response teams and executive decision-makers. Organizations must proactively document playbooks with clear decision trees for materiality, conduct realistic incident simulations, and treat TI and IR as collaborative, complementary disciplines. Finally, internal teams cannot cover all blind spots alone; maintaining trusted external intelligence partnerships is essential for timely threat verification.