Running CTI at a cyber insurance carrier and across more than tens of thousands of companies forces a triage discipline most programs never need to build. Alex Bovicelli, Senior Director of Threat Intelligence at Tokio Marine HCC, describes how his team scaled by narrowing focus to one thing: the initial access vectors threat actors are actually using right now: not CVSS scores, not spray-and-pray alerts, but underground forum activity, access broker behavior, and credential exposure from info stealer logs that most SMBs have zero visibility into. When a detection fires, his team doesn't just notify, they walk the customer through remediation and confirm the issue is closed, because for a company relying on an MSP with no internal security staff, an alert without support is just noise.

The more pointed conversation is about what's not making headlines: thousands of SMBs are getting hit by ransomware every year, and groups like Akira have built a business model specifically around it; high volume, low ransom, staying below the threshold that triggers serious law enforcement attention. Alex explains how those attacks succeed not through sophisticated tradecraft but through SSL VPN brute forcing tools left running unattended, returning thousands of valid credentials against organizations that have no account lockout policies, no MFA on remote access, and no way to know their credentials are already in a log collector somewhere.

Topics discussed:

Building intelligence-led CTI programs at scale by anchoring detection on initial access vectors, access broker activity, and credential exposure
Using underground forum proximity and info stealer log correlation to identify compromised credentials across thousands of organizations
Operationalizing pre-claim threat intelligence within cyber insurance to eradicate initial access before events generate claims
Closing the alert-to-remediation loop for SMBs by delivering detection, support, and mitigation confirmation as a single workflow
How Akira and similar ransomware groups deliberately target SMBs with high-volume, sub-threshold attacks
Rethinking CVSS-based patching prioritization by incorporating criminal exploitability and at-scale attack frequency into triage
Separating AI as an intelligence producer from AI as a report summarizer, where automation could realistically drive patching priority
Why most external threat feeds leave CTI teams in a retroactive posture, and how incident response data from insurance claims changes that

Key Takeaways:

Anchor your CTI program on initial access vectors rather than trying to cover every vulnerability class across your environment.
Monitor access broker activity and underground forums to understand which threat actors are actively buying and selling against your industry or infrastructure.
Integrate info stealer log analysis into your detection pipeline to identify compromised credentials before threat actors use them for lateral movement or ransomware deployment.
Shift your patching prioritization model away from CVSS scores and toward criminal exploitability.
Design alerts for smaller IT teams to be remediation-ready on receipt because an alert without a clear next step will not get acted on.
Close the loop on every detection by confirming mitigation was completed, not just that the alert was acknowledged.
Enforce account lockout policies and MFA on all SSL VPN and remote access entry points as a baseline control.
Assess AI tooling for your CTI program on whether it can produce intelligence rather than just consume it through report summarization.
Use incident response data from post-claim analysis to validate your pre-claim detection signals.

Listen to more episodes: