6 posts
CTEM is not new, the integration is genuinely valuable, and the 'CTEM platform' is mostly rebranded BAS/ASM/RBVM. Buy the operating model, not the acronym.
The de-skilling fear has a long track record, and it usually turns into upskilling. Whether AI does that for your SOC is a deployment choice, not fate.
MTTD and dwell time only exist after a breach and reward alert volume. Keep them as the board scoreboard; steer your program on leading indicators.
Most CTI programs measure IOCs ingested and reports published: activity, not effect. Here's what operationalized intelligence actually looks like.
MFA fatigue has a MITRE technique ID. SOC alert flooding doesn't. Same deliberate tactic, different target, and why your defenses keep failing.
ATT&CK coverage % looks good in board decks. Here's why it compounds into a ~6% actual catch rate, and what Threat Detection Coverage actually means.