Building and Operationalising an Empowered CTI Team

This interview with Canva’s CTI leaders outlines practical strategies for building and maturing a cyber threat intelligence function: establish a strong detection and response foundation, define focused intelligence requirements, curate high-fidelity observables via a tiered approach, and automate integrations with blue team workflows. They highlight developing targeted deliverables (e.g., hunting packages with YARA/TTPs), supply chain monitoring, and metrics that measure fidelity and outcomes rather than volume. The piece emphasizes aligning CTI with stakeholder needs, reducing noise, and demonstrating value through actionable, integrated intelligence, with examples of leveraging Recorded Future for collections and workflow automation.