Intelligence Tradecraft - Sharpen your analytic edge

Join us on “Intelligence Tradecraft”, where we explore the adoption of intelligence tradecraft in the private sector. Hosted by an intelligence and cyber threat intelligence professional, each episode features interviews with top researchers, authors, and practitioners offering practical insights for experts and beginners alike. Whether you’re a seasoned intelligence analyst or just starting your journey, this videocast provides the tools, techniques, and inspiration to elevate your craft and sharpen your analytic advantage. Join our community and master intelligence tradecraft.

Intelligence Tradecraft - Sharpen your analytic edge is a education podcast hosted by Freddy Murre, with 18 episodes on record and a Required Pod Score of 80.

Freddy Murre hosts Intelligence Tradecraft - Sharpen your analytic edge, a education show with 18 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #4

  Bringing CTI to the Executive Table - Interview with Jan Henrik Schou Straumsheim S3E4

  Sep 30, 20261h 31mS3

  Jan Henrik Schou Straumsheim, a partner in PwC's cyber advisory practice, sits down with host Freddy Murre to talk about the real work behind cyber threat intelligence. His interest in the field traces back to getting his hands on his father's old 386 computer and a book his mother gave him on the history of codes, and later took shape during years as a reserve infantry officer in Norway's armed forces, where he trained at the Defense Intelligence School and eventually became his unit's intelligence officer (S-2). From there, his career moved through a summer internship at Accenture, a part-time job in the security operations center at mnemonic, a pivot into consulting, and almost a decade now at PwC. The conversation explores what actually separates CTI from cybersecurity, and why so much of what gets sold as intelligence is really just unfiltered data dumps. Jan Henrik and Freddy debate how analysts should weigh sources, including the tricky question of trusting personas on dark web forums, then turn to how private-sector teams train and retain analytical skill, and why Nordic organizations still lag in treating CTI as more than a detection add-on. Jan Henrik shares a real client case, where a board commissioned a foresight report on AI risk, showing what it looks like when CTI actually reaches the boardroom. The conversation then shifts to AI's role in intelligence work: how Jan Henrik uses large language models every day, why he still insists on a human checking every output before his name goes on it, and where the line sits between AI as a sparring partner and AI replacing analytical judgment altogether. They close on a reminder that opportunity often comes from someone else opening a door, and why passing that on matters. This episode with Jan Henrik is a grounded, occasionally blunt conversation about what good intelligence work actually requires, well worth a listen for anyone trying to make CTI matter to the business it's meant to serve. RESOURCES simon singh the code book - https://www.amazon.com/dp/0385495323 Mnemonic Internships - https://www.mnemonic.io/no/careers/internships/ Hatlebrekke The Problem of Secret Intelligence - https://www.amazon.com/dp/0748691839 Freddy's SANS CTI Summit presentationFrom Gut to Gold Standard: The Admiralty System in CTI - https://youtu.be/y-CSDxMMXb0?t=5 Freddy's SANS posts on Admiralty Scale - https://www.sans.org/profiles/freddy-murstad#resources SANS Cybercrime Investigations - https://www.sans.org/cyber-security-courses/cybercrime-investigations Washington D.C. police gaming crime statistics - https://www.washingtonpost.com/dc-md-va/2026/05/08/dc-police-crime-statistics-internal-investigation-findings/ Research article Non-Determinism of “Deterministic” LLM System Settings in Hosted Environments - https://aclanthology.org/2025.eval4nlp-1.12/ Research article Cognitive offloading, critical thinking and attitudes towards artificial intelligence https://pubmed.ncbi.nlm.nih.gov/42377671/ Freddy's LinkedIn Profile -https://www.linkedin.com/in/fmurre/ CHAPTERS 0:00 Early path into cybersecurity 2:12 From mnemonic's SOC to PwC 8:27 Building PwC's global CTI arm 10:38 CTI versus cybersecurity defined 11:45 Military intelligence background 18:40 What actually counts as intelligence 20:05 Separating good intel from bad 26:19 Training and upskilling analysts 32:57 CTI maturity across the Nordics 41:20 Linking CTI to enterprise risk 50:28 Building a successful CTI function 56:30 Measuring CTI's real value 1:03:12 AI's rapid rise in CTI 1:14:51 AI risks and human oversight 1:26:01 Career-defining opportunities and mentorship

  ListenShow Notes
• 

  Episode #3

  Breaking In, Proving Value, and Staying Ahead in CTI - Interview with Rebecca Ford S3E3

  Sep 16, 20261h 18mS3

  In this episode of Intelligence Tradecraft, host Freddy Murre sits down with Rebecca Ford, a cyber threat intelligence analyst who started out on the government side with Army Cyber and DISA, focused heavily on North Korea and the Asia-Pacific region. From there, she moved into the private sector, where she's spent the better part of a decade helping grow a CTI function from an early-stage team into something far more mature. Rebecca traces her path into the field: an overheard conversation about true-crime shows that led an Army analyst to recruit her, on-the-job training in an era before cyber threat intelligence even had a name, and the 2014 Sony hack as the moment the discipline truly landed on the map. She and Freddy explore what separates useful intelligence from what she calls being reduced to "news reporters with a microphone." The difference lies in handing stakeholders a raw threat feed versus giving them analysis that actually drives a decision. Rebecca shares her working definition of intelligence, built around an adversary's intent, opportunity, and capability. They also get into the two very different audiences an analyst serves, senior leadership and network defenders, and why treating report counts as a success metric misses the point entirely. The conversation covers building real relationships with stakeholders, the argument for "fusion centers" that merge cyber, physical, travel, and financial-crime intelligence, and the considerable value of community and mentorship in a field where, as Rebecca puts it, your next opportunity usually comes from someone who already knows you. A large part of the discussion is about AI: where it genuinely speeds up research and helps an analyst get started, why Rebecca still verifies everything by hand before it goes out, and why she believes human judgment should stay in charge of the final call. Rebecca ends with a reminder that showing up and investing in the community, whether at conferences, in focus groups, or at vendor events, is part of the job for anyone hoping to build a career in the field. RESOURCES Sony Hack - https://www.bbc.com/news/world-asia-30573040 Gert Jan's Metrics - https://github.com/gertjanbruggink/metrics SANS CTI Summit 2026 Visual Summary - https://www.sans.org/blog/visual-summary-sans-cti-summit-2026 Rebecca's LinkedIn - https://www.linkedin.com/in/rebeccaford/ Freddy's Intelligence Architecture Mind Map - https://github.com/Errum/IntelArchitectureMap Reuters IKEA bets on remote interior design as AI changes sales strategy - https://www.reuters.com/technology/ikea-bets-remote-interior-design-ai-changes-sales-strategy-2023-06-13/ CHAPTERS 00:00 Welcome & Rebecca's Background 00:57 Breaking Into Cyber Threat Intel 02:58 Learning Cyber Intel From Scratch 04:30 The Sony Hack Turning Point 06:53 From Army Cyber to DISA 09:32 Adjusting to the Private Sector 12:29 Defining Intelligence and Stakeholders 15:16 Proving Value and Building Community 23:14 Good Intelligence vs. Bad Intelligence 26:20 Mentorship and Learning From Mistakes 34:01 Team Diversity and Fusion Centers 40:25 Misconceptions and Measuring Impact 47:00 Communicating With Stakeholders 55:07 Where AI Fits in Intel 1:13:15 Mentors, Advice & Closing Thoughts

  ListenShow Notes
• 

  Episode #2

  Intelligence Work Demands Honesty About Uncertainty - Interview with Rebekah Brown (S3E2)

  Sep 2, 20261h 23mS3

  In this episode of Intelligence Tradecraft, host Freddy Murre talks with Rebekah Brown, senior researcher at the University of Toronto's Citizen Lab, about what it actually takes to do intelligence work well, in government and in the private sector. Rebekah's background spans the field: she started as a Marine Corps cryptologic linguist and NSA analyst, later led threat intelligence at Nike, and worked the vendor side at Rapid7. Today, she co-authors the SANS FOR578 course and has co-written an incident response book with Scott Roberts. The conversation traces how a clerical error sent her through Mandarin Chinese training instead of Korean, why private-sector CTI teams so often import government habits that don't fit the business they're protecting, and why translating between technical teams and leadership is often the real job description. They spend real time on definitions: what separates intelligence from reporting, what makes intelligence good or bad, and why so much of what gets labeled cyber threat intelligence in the private sector is really just collected information without analysis behind it. Rebekah and Freddy also trade stories about the growing pains of building a threat intelligence function inside a business that doesn't think in nation-state terms, and what it actually takes to make expensive training change how a team works day to day. When it comes to AI, Rebekah explains where she believes LLMs can genuinely support brainstorming, coding, and research tasks, and where she draws a hard line at analysis itself. The two also debate how AI might reshape the size and shape of intelligence teams in the years ahead. It's a grounded, experience-driven conversation for analysts, team leads, and anyone trying to prove the value of intelligence inside their organization. RECOURCES The Marine Corps Logo - https://www.war.gov/Multimedia/Photos/igphoto/2001789719/ Defense Language Institute Foreign Language Center - https://www.dliflc.edu/ University of Toronto Citizen Lab - https://citizenlab.ca/ The Cuckoo's Egg - https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espionage/dp/1668048167/ Ghost Net Report - https://citizenlab.ca/research/tracking-ghostnet-investigating-a-cyber-espionage-network/ Intelligence-Driven Incident Response - https://www.amazon.com/Intelligence-Driven-Incident-Response-Outwitting-Adversary/dp/109812068X/ Scott Roberts LinkedIn - https://www.linkedin.com/in/scottroberts/ SANS FOR578 - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence Rob M Lee LinkedIn - https://www.linkedin.com/in/robmichaellee/ CHAPTERS 00:00 Welcome and introductions 0:37 High school to the Marines 1:22 Becoming a Marine linguist 3:56 A lucky mix-up at NSA 5:45 Early training and mentors 9:44 What is intelligence? 14:17 Good intelligence versus bad 16:32 Leading and teaching Marines 20:37 Injury ends a military career 25:12 Standing up Nike's threat intel 31:28 Rapid7 and the CTI boom 38:19 Bridging techies and leadership 45:01 Writing the book and course 58:15 Measuring intelligence's real value 1:02:27 Where AI fits in intel

  ListenShow Notes
• 

  Episode #1

  Good Intelligence vs Noise and the Skills AI Can't Replace - Interview with Josh D. MacLellan (S3E1)

  Aug 19, 20261h 13mS3

  Staff Threat Intelligence Advisor Josh Darby MacLellan at Feedly kicks off season three by unpacking his path into CTI, what separates intelligence that gets used from intelligence that gets ignored, and why core skills like stakeholder communication may outlast technical specialties as AI reshapes the field. Josh started his career with childhood dreams of becoming a criminal lawyer, shifted through academic study of international relations and security, and unfolded into more than a decade of private-sector threat intelligence work across Canada, the US, and multiple specialties within CTI. Josh is blunt about where the field falls short. Good intelligence is connected to a decision and a decision-maker, versus reports written for other analysts that never get read. Josh and Freddy discuss team structure, and why CTI teams that skew small and heavily technical tend to miss the core skills of stakeholder conversation that keep a function relevant when budgets tighten. Josh argues communication is a trainable skill, the same way he trained himself to become a clearer public speaker despite two speech impediments and years of mumbling through bombed public talks.As for AI, Josh draws a clear line between what he'll delegate and what he won't. He uses LLMs for collection support, editing, and even as a stand-in second analyst to catch his own blind spots, but he won't hand over the analysis stage. Trusting an unreviewed AI process, he argues, is a bit like citing a source you've never actually read. Freddy pushes back with his own testing of LLMs on structured analytic techniques, and the two get into what's actually lost when a black box quietly decides what information matters. RESOURCES NATO Intelligence Cycle - https://ac.nato.int/resources/uploads/2284/picture2-intel-8Wgsa2.png Freddy's Intelligence Architecture Mind Map - https://github.com/Errum/IntelArchitectureMap/files/14615837/240315.-.Intelligence.Architecture.v0.7.42.pdf Gert Jan's Measuring value of CTI - https://github.com/gertjanbruggink/metrics Feedly - https://feedly.com/ Intel471's CU-GIRH - https://github.com/intel471/CU-GIR Sherman Chu's Tyranny of Current Intelligence - https://www.youtube.com/watch?v=IETRHdMejaw Sherman's slides - https://www.sans.org/presentations/were-in-now-now-the-tyranny-of-current-intelligence-and-how-to-manage-it Intel Tradecraft Courses and Trainings - https://inteltradecraft.com/sat-certifications IRM Workshop - https://www.intel471.com/lp/building-an-intel-workshop SANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence Josh Darby's SANS presentation "Can We Forecast Our Own Fate" - https://www.youtube.com/watch?v=B9TkeUbD1Mk Josh's slide deck - https://www.sans.org/presentations/can-we-forecast-our-own-fate-mapping-the-future-of-the-cti-industry-with-sats Feedly CTI Essentials - https://feedly.com/ti-essentials Webinar: What CTI practitioners recommend you focus on in 2026 - https://feedly.com/ti-essentials/posts/what-cti-practitioners-recommend-you-focus-on-in-2026 Freddy and Josh Think smarter, not harder: Making SATs work in CTI - https://feedly.com/ti-essentials/posts/think-smarter-not-harder-making-sats-work-in-cti Feedly AI - https://feedly.com/ai MLitt in Terrorism Studies - https://www.st-andrews.ac.uk/subjects/international-relations/terrorism-mlitt/ CHAPTERS 0:00 Intro and Welcome 1:01 Josh's Path Into CTI 4:04 CTI Maturity Across Countries 8:08 Pivot to Protective Intelligence 12:12 Defining Intelligence and CTI 13:13 Good vs Bad Intelligence 16:16 The Intelligence Cycle 23:23 Engaging Stakeholders Directly 26:26 Core Skills and Job Security 33:33 Training and Certifications 40:40 Building Well-Rounded Teams 43:43 Mentoring and Giving Back 49:49 AI's Role in the Cycle 58:58 How Josh Uses AI 1:05:05 People Who Shaped His Career

  ListenShow Notes
• 

  Episode #8

  The librarian who founded modern OSINT: Sources, tradecraft & AI - Interview with Arno Reuser (S2E8)

  Jul 1, 20261h 38mS2

  If you've ever read a text or sat in a briefing and quietly wondered what actually separates this "intelligence" from someone's hot take on LinkedIn, a journalist with a deadline, an analyst with a search bar, or an AI, this episode is for you. The host, Freddy Murre, sits down with Arno Reuser, the man who founded the Dutch Defence Intelligence Service's open-source intelligence (OSINT) capability in the early 1990s, before most of Europe had a word for it. What follows is less an interview than a working argument about how OSINT should actually be done, and where the field has gone soft. Arno doesn't mince words. He'll tell you the "information explosion" everyone complains about is just proof you skipped your stakeholder and requirement analysis. That most of what gets sold as OSINT is the word "OSINT" stapled to “everything”, such as tools. That he has, by deliberate choice, never written an analytical judgment in his life, and why that line between collection and analysis matters more than people think. For anyone who's argued about what counts as OSINT versus PAI (Publicly Available Information), or where collection ends and all-source begins, this is the debate you want to engage with. Along the way: the librarian's discipline, he says, underpins all good intelligence work, the collection plan he calls "worth gold," the classroom trick thousands of students have failed, and a run of war stories from his teachings, such as a prison break by email to a deepfake that fooled cyber experts who personally know him. The back half takes on two problems every practitioner is living with right now. How do you put a value on intelligence when the same report is priceless to one decision-maker and useless to the next? And what is AI actually good for? Arno uses LLMs daily and is genuinely amazed by them, but only for things he can verify. He and Freddy get specific on hallucinations, sycophancy, model collapse, and the difference between a real summary and a machine that just shortens the text and deletes the one sentence that mattered. RESOURCES Maersk Website - https://investor.maersk.com/news-releases/news-release-details/cyber-attack-update Dutch Police Data Breach - https://www.politie.nl/nieuws/2024/oktober/2/update-over-datalek-politie.html When does something go from a Google answer to Intelligence - https://www.linkedin.com/posts/fmurre_in-your-opinion-when-does-something-go-from-activity-7181221399561203712-mV-m/ LexisNexis Library - https://www.lexisnexis.com/en-us/products/digital-library.page Vague questions in OSINT - https://opensourceintelligence.biz/vague-osint-questions/ Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications Pherson Structured Analytic Techniques for Intelligence Analysis - https://www.amazon.com/Structured-Analytic-Techniques-Intelligence-Analysis/dp/150636893X/ Routledge Handbook of Terrorism Research - https://www.routledge.com/The-Routledge-Handbook-of-Terrorism-Research/Schmid/p/book/9780415520997 AI Model Collapse - https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=AI+model+collapse&btnG= CHAPTERS 00:00 From literature searcher to founding military OSINT 04:00 Becoming a librarian: the Kampen archive moment 08:00 Where OSINT stops and intelligence begins 11:00 Why "cyber" keeps getting OSINT wrong 15:00 What actually makes something "intelligence"? 24:00 The information explosion myth 32:00 The classroom trick: think before you type 36:00 The collection plan that's "worth gold" 42:00 The human factor cyber keeps ignoring 45:00 War stories: validation and getting fooled 51:00 Learning the craft: sources, sources, sources 55:00 Customers ask for what they think you can do 01:08:00 Can you measure the value of intelligence? 01:11:00 AI and LLMs: amazed but skeptical 01:32:00 Deepfakes, the NATO photo & "how likely is it?"

  ListenShow Notes

Recent guests on Intelligence Tradecraft - Sharpen your analytic edge. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.