ОТНОСТНО ТОЗИ ЕПИЗОД
In this episode of Intelligence Tradecraft, host Freddy Murre talks with Rebekah Brown, senior researcher at the University of Toronto's Citizen Lab, about what it actually takes to do intelligence work well, in government and in the private sector. Rebekah's background spans the field: she started as a Marine Corps cryptologic linguist and NSA analyst, later led threat intelligence at Nike, and worked the vendor side at Rapid7. Today, she co-authors the SANS FOR578 course and has co-written an incident response book with Scott Roberts.
The conversation traces how a clerical error sent her through Mandarin Chinese training instead of Korean, why private-sector CTI teams so often import government habits that don't fit the business they're protecting, and why translating between technical teams and leadership is often the real job description.
They spend real time on definitions: what separates intelligence from reporting, what makes intelligence good or bad, and why so much of what gets labeled cyber threat intelligence in the private sector is really just collected information without analysis behind it.
Rebekah and Freddy also trade stories about the growing pains of building a threat intelligence function inside a business that doesn't think in nation-state terms, and what it actually takes to make expensive training change how a team works day to day.
When it comes to AI, Rebekah explains where she believes LLMs can genuinely support brainstorming, coding, and research tasks, and where she draws a hard line at analysis itself. The two also debate how AI might reshape the size and shape of intelligence teams in the years ahead.
It's a grounded, experience-driven conversation for analysts, team leads, and anyone trying to prove the value of intelligence inside their organization.
RECOURCES
The Marine Corps Logo - https://www.war.gov/Multimedia/Photos/igphoto/2001789719/ Defense Language Institute
Foreign Language Center - https://www.dliflc.edu/
University of Toronto Citizen Lab - https://citizenlab.ca/
The Cuckoo's Egg - https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espionage/dp/1668048167/
Ghost Net Report - https://citizenlab.ca/research/tracking-ghostnet-investigating-a-cyber-espionage-network/
Intelligence-Driven Incident Response - https://www.amazon.com/Intelligence-Driven-Incident-Response-Outwitting-Adversary/dp/109812068X/
Scott Roberts LinkedIn - https://www.linkedin.com/in/scottroberts/
SANS FOR578 - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence
Rob M Lee LinkedIn - https://www.linkedin.com/in/robmichaellee/
CHAPTERS
00:00 Welcome and introductions
0:37 High school to the Marines
1:22 Becoming a Marine linguist
3:56 A lucky mix-up at NSA
5:45 Early training and mentors
9:44 What is intelligence?
14:17 Good intelligence versus bad
16:32 Leading and teaching Marines
20:37 Injury ends a military career
25:12 Standing up Nike's threat intel
31:28 Rapid7 and the CTI boom
38:19 Bridging techies and leadership
45:01 Writing the book and course
58:15 Measuring intelligence's real value
1:02:27 Where AI fits in intel
