Scaling CTI in the Age of AI

<span class="premium-content_chapter">INTRODUCTION</span>

AI-enabled crime is increasing the speed and scale CTI programs must contend with

Criminal adoption of artificial intelligence (AI) is rapidly accelerating, and it's no longer confined to isolated experiments. The first documented cases are showing how ransomware and extortion operations could move beyond AI assistance towards agentic technical execution.

In July 2026, security researchers at Sysdig documented what they assessed to be the first agentic ransomware operation: an AI agent autonomously drove reconnaissance, credential harvesting, lateral movement, privilege escalation, and destructive database extortion. It remains an early case and does not demonstrate a successful end-to-end ransomware operation, but it does show that autonomous technical execution is no longer theoretical. Separately, the wider ransomware ecosystem continues to commoditize through low-cost kits and services, lowering the barrier to entry for less sophisticated operators.

The broader threat ecosystem is compressing. Mandiant's M-Trends 2026 draws on more than 500,000 hours of frontline incident investigations conducted globally in 2025. It documents malware such as PROMPTFLUX and PROMPTSTEAL querying large language models (LLMs) mid-execution, alongside wider adversary use of AI. Separately, Mandiant found that the median time between initial access and hand-off to a secondary threat group fell from more than eight hours in 2022 to just 22 seconds in 2025, a sign of tighter coordination and pre-staging between criminal groups rather than evidence that AI caused the acceleration.

The criminal market around these tools is growing, too. Flashpoint's 2026 Global Threat Intelligence Report: Midyear Edition counted more than 22 million posts across the illicit sources it monitors discussing, sharing, or advertising AI toolkits for criminal deployment in the first half of 2026. That is a measure of discussion and promotion, not 22 million distinct tools or deployments, but it illustrates the scale of interest across criminal communities. Government assessments point the same way: the UK National Cyber Security Center (NCSC) assesses that AI will "almost certainly" increase the frequency and intensity of cyber threats through 2027.

CTI programs therefore need to improve their ability to operate at greater speed and scale, and many are using AI to automate high-volume work. The 2026 SANS Cyber Threat Intelligence Survey found broad institutional adoption of CTI, while most formal teams remain small. In its dedicated executive module, 91% of CISOs and CSOs rated CTI valuable or extremely valuable, but only 26% said it significantly influences their decisions.

CTI is an increasingly important part of how organizations anticipate, prioritize, and respond to cyber threats.

{{premium-content_chapter-divider}}

The challenges CTI teams are facing

Recognition for CTI has grown, but the responsibility hasn't gotten any easier to meet. Three key challenges define what it's like to run a CTI program today:

1. Staffing and scope have grown out of sync, with small teams asked to support a widening set of security functions.
2. Many analysts still reconcile data across multiple specialized tools and sources by hand, creating friction as the scope and speed of investigations increase.
3. For financially motivated threats, many CTI workflows still lack integrated visibility into financial infrastructure. That gap is particularly relevant to ransomware, fraud and scams, sanctions evasion, and other investigations where technical, identity, and financial intelligence can expose different parts of the same network.

<span class="premium-content_chapter">CHALLENGE 1</span>

More is being asked of small teams

CTI teams are being asked to cover more ground with small teams, against a threat landscape growing in scale and sophistication. Meanwhile, CTI increasingly supports security operations, incident response, threat hunting, vulnerability management, adversary emulation, risk management, and executive decision-making — a scope that can outpace the staffing and operating model built to support the function.

The SANS survey reflects the same structural pressure: respondents cite limited time, funding constraints, organizational silos, and analyst burnout among the barriers to building and operating effective CTI programs. Small, skilled teams are being asked to support a broad and expanding mandate without equivalent growth in time, tooling, or headcount.

<span class="premium-content_chapter">CHALLENGE 2</span>

The analyst has become the integration layer

Analysts still often have to pivot across multiple specialized tools and data sources, manually translating an intelligence requirement into different queries, enrichment steps, and confidence assessments. In TRM discovery conversations, CTI leaders consistently described the time cost of this cross-tool work as a material constraint on investigations.

Several CTI leaders in TRM discovery conversations described checking a single indicator — such as an IP address, domain, or hash — across numerous separate interfaces before they could assess it with confidence. They also described a second problem: once an investigation ends, validated relationships and reasoning are not always retained as persistent institutional knowledge, forcing analysts to rediscover parts of the same chain in later cases.

These lived experiences track with the tooling landscape CTI analysts are expected to master. An illustrative review of live CTI and threat intelligence analyst job postings found roles asking for fluency across multiple categories of tooling, including threat intelligence platforms (TIPs), open-source intelligence (OSINT) tools, dark web intelligence providers, and other specialist sources. The broader point is not that one platform must replace every specialist provider, but that analysts still spend significant time moving between them to complete an investigation.

Industry analysis reflects the same pattern from the vendor side: external threat intelligence providers tend to specialize across different data, use cases, and capabilities, so customers often combine multiple services to achieve the visibility they need. The result is a fragmented investigative workflow even when the underlying specialist data is strong.

<span class="premium-content_chapter">CHALLENGE 3</span>

Financial intelligence is often not integrated

For financially motivated threats, many CTI workflows still lack integrated visibility into financial infrastructure, even where that capability exists elsewhere in the organization or through specialist partners.

Traditional enterprise CTI programs tend to concentrate on TTPs, malware, vulnerabilities, and technical infrastructure. Financial intelligence is a different discipline built on different data, and it is often handled outside the core CTI workflow. Ransomware is a strong example: technical and financial intelligence can expose different parts of the same ecosystem and, when combined with other evidence, corroborate relationships between actors, infrastructure, wallets, services, and cash-out activity.

Operation Cronos, the February 2024 multi-agency law enforcement action against the LockBit ransomware group, illustrates how technical disruption, intelligence exploitation, arrests and charges, sanctions, and analysis of ransom-payment records can be combined against a ransomware ecosystem. Data seized from LockBit's infrastructure gave law enforcement insight into affiliates, negotiations, and payment activity. For CTI teams that cannot readily access and integrate financial intelligence, that dimension of an actor's footprint — and the disruption opportunities it can reveal — is harder to bring into the same investigation.

{{premium-content_chapter-divider}}

Closing the distance

A practical response is to design CTI around the team and resources actually available. Three approaches are becoming increasingly important.

CTI teams are turning to AI to scale their operations

In the SANS survey, 45% of respondents said their organizations use AI in CTI today, with another 32% planning to adopt it. Common uses include summarization, reporting, data processing, and workflow automation, allowing analysts to spend more time on higher-judgment work. Human analysts should remain responsible for consequential analytical judgments, source evaluation, confidence, and attribution.

CTI teams are building rigor around measuring outcomes

Measurement is part of closing the gap between CTI being valued and CTI influencing decisions. In SANS's executive module, 91% of CISOs and CSOs rated CTI valuable or extremely valuable, but only 26% said it significantly influences their decisions. That makes outcome measurement important: teams need to show not only what intelligence they produced, but what decisions, detections, mitigations, and investigations it changed.

Connecting intelligence across sources

A further opportunity is to consolidate cross-source pivots into fewer investigative workflows, reducing the manual translation between specialist tools while preserving the value of the underlying data providers. For financially motivated threats, that workflow can also bring financial intelligence alongside technical and identity data.

This matters because AI can automate or accelerate elements of reconnaissance, targeting, social engineering, vulnerability research, and infrastructure or content generation. Many of the CTI teams TRM has spoken with still describe substantial manual, tool-by-tool investigation work. TIPs remain valuable for aggregating, normalizing, enriching, and operationalizing threat intelligence, but cross-domain investigations can still require pivots into specialist data and tooling beyond the TIP. Knowing which sources to check, how to evaluate them, what confidence to place in a result, which alternative hypotheses remain, and where to pivot next is tradecraft.

Ardence, TRM Labs' AI investigations platform, helps analysts follow leads across integrated infrastructure, identity, dark web, and financial data in one investigative environment. Analysts can describe what they need in plain language and use Ardence to run supported pivots across those sources.

Ardence brings relationships into an investigative graph, with source references and provenance available for supported results. This makes specialist data and repeatable investigative workflows more accessible to analysts who may not have deep expertise in every discipline.

Ardence surfaces the connections; the analyst decides which ones hold. The aim is to reduce repetitive querying across separate tools so analysts can spend more time evaluating evidence, assessing confidence, and deciding where to investigate next.

Request a demo to see how Ardence can support your team's CTI investigations.

{{premium-content_chapter-divider}}

About TRM Labs

TRM Labs is the operating system for modern crimefighters, built to detect and disrupt the criminal networks that exploit frontier technologies, including cryptocurrency and AI. Combining proprietary intelligence, AI-native investigations software, and disruption network infrastructure, the platform is built for high-consequence environments where accuracy, auditability, and security are essential. TRM is trusted by 600+ government agencies and financial institutions across 75 countries to counter fraud, scams, cyber crime, child exploitation, money laundering, and sanctions evasion, among other illicit activities.

To learn more, visit www.trmlabs.com.