In 2022, the median time it took an attacker to hand off network access to a second threat group was over 8 hours. By 2025, that number had collapsed to 22 seconds. According to Mandiant's M-Trends 2026 report, an attack can now move to its next stage in roughly the time it takes a SOC analyst to read the alert that flagged it.
And this isn't just about speed. CrowdStrike's 2026 Global Threat Report found that 82% of detected attacks now involve no malware at all — meaning the classic "find the malicious file hash and block it" playbook simply doesn't apply to most modern intrusions anymore.
So why do the IP address and domain blacklists we've relied on for years no longer cut it? Because these indicators are the easiest thing for an attacker to change — block one domain, and a new one appears tomorrow. The real question isn't "which IP should we block?" It's: "how does this attacker actually behave, and how do we recognize and stop that behavior?"
This post looks at why simple Indicator of Compromise (IOC) lists are losing their edge, how David Bianco's Pyramid of Pain explains this shift, how the MITRE ATT&CK framework turns behavioral intelligence into something teams can actually act on, and how a modern CTI platform ties these principles together into a proactive defense system.
The Problem: Why IOCs Are Dying
For over a decade, the standard threat intelligence workflow looked like this: subscribe to a feed, pull in a list of malicious IP addresses, domains, and file hashes, and push them straight into your firewall, SIEM, or EDR. It was simple, automatable, and gave teams the comforting feeling of "doing something" about threats.
The problem is that Indicators of Compromise (IOCs) were never designed to be a long-term defense strategy — they're a snapshot of a single moment in an attack that has often already happened.
Three structural weaknesses make IOC-only defense fail today:
- They're disposable. A malicious IP address can be rotated in minutes. A domain can be re-registered under a new name for a few dollars. Even a file hash — supposedly a unique fingerprint of malware — becomes worthless the moment an attacker recompiles the same code with one line changed.
- They're reactive by nature. An indicator only exists in a feed because someone, somewhere, already got hit and the artifact was documented afterward. You're always defending against yesterday's attack, not today's.
- They lack context. An IOC feed tells you "this IP is bad." It doesn't tell you which threat actor is behind it, what they're after, or what they'll do next inside your network if the block fails.
This is where a modern Cyber Threat Intelligence (CTI) platform changes the equation. Instead of treating IOCs as isolated artifacts, it enriches them with threat actor attribution, campaign context, malware relationships, confidence scores, and behavioral patterns. The result is intelligence that explains not only what was observed, but also why it matters and how defenders should respond.
The numbers back this up. CrowdStrike's 2026 Global Threat Report found that 82% of detected attacks now involve no malware file at all — attackers are increasingly using legitimate tools already present on the system (a technique known as "living off the land"), voice-based social engineering, and stolen credentials instead of dropping a payload you could hash and blacklist. There's simply nothing static left to block.
This is why security teams are shifting focus from "what did the attacker use?" to "how does the attacker operate?" — and that shift has a name: the Pyramid of Pain.
The Pyramid of Pain: Not All Indicators Are Created Equal
In 2013, security researcher David Bianco — then working incident response during Mandiant's APT1 investigations — noticed something: analysts were drowning in indicators, but not all indicators actually hurt an attacker when blocked. Some could be swapped out in seconds. Others forced an adversary to rebuild their entire operation from scratch.
He mapped this out as the Pyramid of Pain — a six-layer model ranking indicators by how much pain it causes an attacker when defenders deny them:
- Hash Values (trivial pain) — a unique file fingerprint. Recompile the malware, change one byte, and the hash is useless.
- IP Addresses (trivial pain) — attackers can rotate infrastructure in minutes, often through bulletproof hosting or compromised servers.
- Domain Names (mild pain) — slightly more costly to replace than an IP, but still cheap — a new domain can be registered for a few dollars in minutes.
- Network/Host Artifacts (annoying) — patterns like a specific User-Agent string, a registry key, or a URI structure. Harder to fake convincingly, but still changeable.
- Tools (challenging) — the actual malware, scripts, or utilities the attacker built or customized. Losing a tool means investing real time to rebuild or find a replacement with similar capability.
- TTPs — Tactics, Techniques, and Procedures (top of the pyramid) — the attacker's actual behavior: how they gain initial access, move laterally, escalate privileges. This is the hardest thing to change, because it's tied to the attacker's skillset, training, and operational habits — not just their infrastructure.
The core insight: the further up the pyramid you detect and block, the more expensive it becomes for the attacker to keep operating. Blocking an IP costs them nothing. Forcing them to abandon a signature behavior — say, a specific privilege escalation technique — can cost them weeks of retraining and retooling.
This is exactly why IOC feeds sit at the bottom of the pyramid. They're the easiest data to collect and automate, but also the least painful for an adversary to lose. A modern CTI platform's real value isn't in how many hashes and IPs it can ingest — it's in how effectively it helps a team climb toward the top of the pyramid, where detection actually disrupts an attacker's operation instead of just inconveniencing it for a few minutes.
For CTI teams, the Pyramid of Pain is more than a theoretical model — it helps prioritize where intelligence efforts should focus. Rather than collecting the largest possible number of indicators, mature CTI platforms emphasize behavioral intelligence that enables long-term detection and resilience against evolving adversaries.
That's also where MITRE ATT&CK comes in — because "TTPs" sounds great in theory, but security teams need a shared, structured way to actually describe, track, and detect them. That's what we'll look at next.
MITRE ATT&CK: Turning "Behavior" Into Something You Can Actually Detect
Saying "focus on TTPs, not IOCs" is easy advice to give and hard advice to follow. Behavior is abstract. Two analysts describing the same attack in their own words might use completely different terminology — which makes it nearly impossible to compare notes, build consistent detections, or share intelligence across teams.
This is the exact gap MITRE ATT&CK was built to close.
First introduced in 2013 out of MITRE's Fort Meade Experiment and made public in 2015, ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a free, globally maintained knowledge base that catalogs real-world adversary behavior in a structured, common language. As of the latest release (v18), ATT&CK for Enterprise documents 14 tactics, 216 techniques, and 475 sub-techniques — and it keeps growing as new adversary behavior is observed in the wild.
The framework breaks attacker behavior into two layers:
- Tactics — the why. What is the attacker trying to accomplish right now? (e.g., Initial Access, Privilege Escalation, Lateral Movement, Exfiltration)
- Techniques (and sub-techniques) — the how. The specific method used to achieve that goal (e.g., "Phishing," or more specifically, "Spearphishing Attachment")
This structure gives security teams a shared vocabulary. Instead of a vague note like "attacker used some kind of credential theft," a team can point to a specific, documented technique — T1003, OS Credential Dumping — and immediately know what to look for, what tools commonly perform it, and what mitigations exist.
In practice, security teams use ATT&CK for four main things:
- Gap analysis — mapping current detection coverage against the full matrix to see exactly where blind spots exist (e.g., "we detect Initial Access well, but have almost no visibility into Lateral Movement")
- Threat modeling — simulating how a specific threat actor known to target your industry would likely operate, based on their documented technique history
- Adversary emulation & red teaming — testing whether your defenses actually catch known techniques, not just known indicators
- Incident response — mapping an active or past intrusion onto ATT&CK to communicate clearly with stakeholders and identify what to fix
Importantly, MITRE itself is upfront about ATT&CK's limits: it's a reference knowledge base, not a live monitoring system, and it only documents observed behavior — meaning it can't cover techniques that haven't been publicly reported yet. It also has real depth: 216+ techniques is a lot to operationalize, and MITRE explicitly advises against chasing "100% coverage" — the goal is prioritizing the tactics and techniques most relevant to your actual threat landscape.
This is exactly where a modern CTI platform delivers value. Rather than presenting analysts with the full ATT&CK matrix, it continuously maps incoming intelligence to relevant tactics and techniques, correlates activity across campaigns, and highlights the behaviors most likely to impact the organization. This allows SOC teams to focus on the threats that matter instead of manually filtering thousands of unrelated events.
That prioritization doesn't happen by accident, though — it comes from running a structured, repeatable process behind the scenes: the Threat Intelligence Lifecycle.
The Threat Intelligence Lifecycle: How a Modern CTI Platform Actually Operates
Pyramid of Pain tells you what to prioritize. MITRE ATT&CK gives you a shared language to describe it. But neither one tells you how to actually run a threat intelligence program day to day — how raw data turns into something a SOC analyst can act on before lunch. That's the job of the Threat Intelligence Lifecycle, a six-phase process borrowed from traditional intelligence methodology used by government and military agencies for decades.
1. Direction (Planning) Everything starts by defining what questions intelligence actually needs to answer — often called Priority Intelligence Requirements (PIRs). Not "collect everything about ransomware," but something specific: "which threat actors are exploiting VPN vulnerabilities in our sector, and how would we recognize their access in our logs?" This phase is consistently the most under-invested — and the one that determines whether the other five phases produce anything useful at all.
2. Collection Data is gathered from a mix of sources: commercial threat feeds, internal SIEM/EDR telemetry, OSINT, government advisories (like CISA or NCSC), dark web monitoring, and ISAC sector-sharing communities. The trap here is collecting everything available instead of what actually answers your PIRs — a feed pushing a million indicators a day is worthless if 990,000 never touch your environment.
3. Processing Raw data gets normalized, deduplicated, and enriched into a consistent, machine-readable format — turning a bare IP address into an IP tagged with the threat actor using it, the campaign it belongs to, and a confidence score. This is largely mechanical work, and it's exactly where automation inside a CTI platform pays off — freeing analysts from manual triage.
4. Analysis This is where processed data actually becomes intelligence — human and machine techniques combine to correlate indicators, profile threat actors, and map observed activity onto frameworks like MITRE ATT&CK. This phase is also where most teams bottleneck: it's easy to subscribe to feeds, but turning 2,000 daily alerts into the 3 that actually matter takes real analytical capacity.
5. Dissemination Different audiences need different outputs. A SOC analyst needs specific technical indicators and detection rules. An incident responder needs context on an active campaign. A CISO or board needs a strategic summary tied to business risk. A mature CTI platform automatically routes the right level of detail to the right team — instead of sending everyone the same 40-page PDF.
6. Feedback This is the phase most programs skip — and the one that turns a straight line into an actual cycle. Stakeholders assess whether the intelligence they received was timely, relevant, and useful, and that feedback loops back into Phase 1 to sharpen the next round of requirements. Without this step, a CTI program never improves — it just repeats the same motions indefinitely.
Why this matters for a modern platform: the lifecycle is the operational engine that makes everything else in this post possible. Pyramid of Pain tells you TTPs matter most; ATT&CK gives you the vocabulary to describe them — but it's the lifecycle, running continuously and largely automated, that actually delivers prioritized, actor-specific, ATT&CK-mapped intelligence to the right team before an attacker completes their next move.
What to Look for in a Modern CTI Platform
Not every threat intelligence platform delivers the same level of value. While many solutions focus primarily on collecting large volumes of Indicators of Compromise (IOCs), a modern Cyber Threat Intelligence (CTI) platform should help security teams understand the context behind those indicators and transform raw data into actionable intelligence.
A mature CTI platform should automatically enrich IOCs with contextual information such as associated threat actors, malware families, campaigns, confidence levels, and observed Tactics, Techniques, and Procedures (TTPs). This additional context allows analysts to quickly determine not only whether an indicator is malicious, but also how it relates to broader adversary activity.
Behavioral intelligence is equally important. By mapping observed activity to the MITRE ATT&CK framework and correlating indicators across campaigns, a CTI platform enables defenders to identify recurring attacker behaviors rather than relying solely on static artifacts that can be easily replaced.
Prioritization is another key capability. Instead of overwhelming analysts with thousands of alerts, an effective platform should evaluate the relevance and confidence of incoming intelligence, helping security teams focus on the threats that pose the greatest risk to their environment.
Integration also plays a critical role in operationalizing threat intelligence. A modern CTI platform should work seamlessly with existing security technologies such as SIEM, SOAR, and EDR solutions, allowing intelligence to support detection, threat hunting, incident response, and automated security workflows.
Finally, intelligence should be tailored to its audience. While SOC analysts require technical indicators and behavioral details, security managers and executives need concise, risk-focused reporting that supports informed decision-making. A mature CTI platform bridges this gap by delivering actionable intelligence in formats appropriate for both technical and strategic stakeholders.
Ultimately, the value of a CTI platform should not be measured by the number of indicators it collects, but by its ability to provide context, prioritize threats, and enable faster, more informed defensive decisions.
Conclusion: The Shift to Proactive Defense
The math has changed. When the median handoff between an initial access broker and a ransomware affiliate has collapsed from 8 hours to 22 seconds, and 82% of attacks never touch a malicious file at all, an intelligence program built solely around IOC feeds isn't just less effective — it's structurally unable to keep up.
The path forward isn't complicated to describe, even if it takes real work to build:
- Stop measuring your CTI program by how many indicators it ingests. Start measuring it by how far up the Pyramid of Pain your detections actually reach.
- Use MITRE ATT&CK as a common language, not a checklist — prioritize the tactics and techniques most relevant to your sector and threat actors, rather than chasing full matrix coverage.
- Run the Threat Intelligence Lifecycle as an actual cycle, not a one-way pipeline — the feedback phase most teams skip is often the single biggest lever for improvement.
- Invest in the phases that don't scale by subscription alone — analysis and dissemination — because collection is the easy part every vendor can sell you, but turning noise into a handful of decisions your team can act on is where the real value sits.
None of this replaces IOCs entirely — hash values and IP blocks still buy you time against opportunistic, low-effort attacks. But they can no longer be the foundation of a defense strategy against adversaries who rotate infrastructure faster than most teams can update a blocklist.
A modern CTI platform's job is to connect all four pieces covered in this post — indicator context, behavioral prioritization, a shared framework, and a continuously improving intelligence process — into a system that tells your team not just what happened, but who's likely coming next, and how they'll try to get in. That's the actual definition of proactive defense: not reacting faster, but knowing enough in advance that there's less to react to.
At Cypho, we believe threat intelligence should reduce uncertainty rather than increase alert volume. By combining contextual enrichment, behavioral analysis, and continuous intelligence workflows, organizations can shift from reacting to yesterday's indicators to anticipating tomorrow's adversary behaviors.
Related reading from Cypho:
- The Art of Threat Hunting
- Artificial Intelligence in Cybersecurity
- APT29 – Cozy Bear: Russia's Ghost in Every Network
- OSINT and Internet Scanning Platforms: A Practical Look at Popular Tools
- API Security
- Stealer Logs in 2025: Anatomy of a Silent Data Heist
References:
- The Pyramid of Pain — SANS
- Pyramid of Pain — AttackIQ
- MITRE ATT&CK
- MITRE ATT&CK Techniques for Enterprise
- MITRE ATT&CK Resources
- M-Trends 2026 — Google Cloud
- M-Trends Executive Edition — Google Cloud
- Faster Attacks and Recovery: Denial, Ransomware Reshape Threat Landscape — CSO Online
- Global Threat Report — CrowdStrike
- Threat Intelligence Lifecycle Phases — Recorded Future
- What Is the Threat Intelligence Life Cycle — Palo Alto Networks
