Extracting the How: Scaling Adversary Procedures Intelligence with AI

This report describes Tidal Cyber’s NARC AI engine and Threat-Led Defense approach, which convert unstructured CTI and incident narratives into structured, ATT&CK-mapped procedure objects for operational use. It outlines an AI-assisted, analyst-validated pipeline that extracts procedure-level details, correlates them to groups/software, and powers coverage mapping, detection engineering, and validation readiness. The platform aims to prioritize gaps, optimize defensive tooling, and align testing to real adversary behavior.