The practice of cyber-threat intelligence in organizations: A socio-technical case study of a mature financial organization

1. AbstractThis socio-technical case study examines how organizations operationalize cyber-threat intelligence in complex business environments. Cyber-threat intelligence (CTI) is increasingly recognized as a critical decision-support function for organizations given an increasingly militarized cyber-threat environment. CTI promises to transform cyber defense from reactive and undirected responses to proactive, anticipatory and directed capabilities. Hence CTI enables organizations to anticipate the intent and capability of threat actors, thereby facilitating the development of defensive strategies to counter expected attack patterns.Yet despite cybersecurity being consistently ranked among top enterprise risks and the substantial organizational investment driven by strategic risk concerns, there is very little empirical evidence about how organizations actually implement and operationalize intelligence-led approaches in complex socio-technical environments. To understand how CTI can be operationalized in organizations, we draw on intelligence doctrine situated in the military context as theoretical underpinning, as this represents the most established approach to intelligence-led decision-making. Using the intelligence cycle as our theoretical lens we examine a mature CTI practice in a leading Australian financial organization. The empirical evidence we collect is framed as a stakeholder-activity process model that explains how CTI is practiced across Leadership, Business, and Technology Groups.Our findings reveal a fundamental inversion of established intelligence doctrine - rather than strategic requirements flowing downward from leadership to drive intelligence operations, our case organization generates requirements within technology operations silos, pushing intelligence outward and upward to operational, tactical, and strategic levels. This constitutes a reversal of intelligence norms established over seventy years of organizational practice in the military, revealing the unique challenges modern civilian organizations face in operationalizing CTI within complex business environments.Our study reveals a paradox where organizations invest heavily in CTI to address cyber-threats as a strategic priority yet simultaneously create barriers that prevent CTI from delivering strategic value. The root cause of this paradox is found in the positioning of the CTI function in the lowest level of the organizational structure, the profound knowledge gap between Business and IT Groups, and the prevalence of analytical products that lack the strategic relevance and analytical rigor that create decision value.Our stakeholder activity process model contributes to theory by providing the first systematic empirical explanation of CTI practice in organizations and by applying intelligence doctrine to the cyber context. From a practice perspective, the model serves as a diagnostic tool for understanding bottom-up operationalization of CTI practice. It enables organizations to map intelligence flows arising from key stakeholders, processes, and technology systems, and to redesign these flows to improve strategic coherence and relevance. Our findings challenge fundamental assumptions about intelligence-led security in civilian contexts and have significant implications for the organizations implementing CTI programs in the modern business environment.