The Practice of Cyber-Threat Intelligence in Organizations: A Socio-Technical Case Study of a Mature Financial Organization

Abstract

This socio-technical case study examines the operationalization of cyber-threat intelligence in a large regulated financial institution. Our findings reveal a fundamental inversion of established intelligence doctrine - rather than strategic requirements flowing downward from leadership to drive intelligence operations, our case organization generates requirements within technology operations silos, pushing intelligence outward and upward to operational, tactical, and strategic levels. This constitutes a reversal of intelligence norms established in military practice, revealing the unique challenges modern civilian organizations face in operationalizing CTI within complex business environmen..