SiliconANGLE theCUBE · Nov 3, 2026 · 38m · 30m saved
With Jeff Bardin, Founder and Chief Intelligence Officer of Treadstone 71
Photo via theCUBE
Most of what the cybersecurity industry sells as threat intelligence is the same indicator-matching technology of the 1990s and 2000s with an AI model added on top, Jeff Bardin, founder and chief intelligence officer of Treadstone 71, told theCUBE's Cybersecurity Bridge. The industry calls those data feeds intelligence. Jeff, who learned the trade in intelligence agencies, says intelligence is a prediction of what will happen, and a feed only reports what already did.
"I see the same technology software and they're just bolting on or building in an AI model over the top of it. But it's the same failed model." — Jeff Bardin
At 68, Jeff still runs Treadstone 71's training in intelligence analysis and once spent about two years impersonating Taliban spokesmen online to counter their message.
The full interview is covered here so you can skip it. 38 minutes of audio, 8 minutes of reading.
Here are the 8 arguments that matter.
Key Takeaways
Threat intelligence built on data feeds only describes attacks that already happened, Jeff says
Most security chiefs value threat intelligence, but only 20–25% actually use it
AI has pushed social engineering from about 17% of hacks to about 85%, citing industry analysis
Mandiant and CrowdStrike are the vendors big enough to change the industry's model
Some of Jeff's best analysts had library-science degrees, not technical ones
Jeff's advice on AI: harness it, because no one will control it
1. A False Term
Jon Oltsik, who hosts Cybersecurity Bridge on theCUBE, asked Jeff where threat intelligence stands today. Jeff's answer was that most of it is clean-up work under a new label.
Jeff says threat intelligence built on data feeds only looks backward
"Cyber threat intelligence to me is a false term because it's based on data feeds which is based on indicators of compromise which is based on something that's already happened." — Jeff Bardin
Indicators of compromise are the traces an attack leaves behind, such as a malicious file or IP address. Jeff splits intelligence into four layers: strategic, operational, tactical and technical. His own "cultural nexus framework" combines Hofstede's cultural dimensions with an expanded model of social, technical, economic, military, political, legislative, educational, security, psychological, religious and demographic factors. The aim is a business-level picture of an adversary rather than an engineer's feed of alerts.
