"Threat intelligence only delivers value when it changes decisions. Too often, there’s a disconnect between what analysts uncover and what senior leaders need to prioritise risk and act with confidence," said Geoff Brown, CEO of Silobreaker.
Silobreaker and the SANS Institute launch a study at Infosecurity Europe 2026
Silobreaker and the SANS Institute on June 2 launched a joint paper titled Bridging the Gap Between Threat Intelligence and Business Risk at Infosecurity Europe 2026. The research examines how threat intelligence teams and other parts of the business differ in their understanding of security risks and how to combat them. Silobreaker will present practical steps from the paper at Infosecurity Europe between June 2 and June 4; the organisation is located at booth #F49 and the SANS Institute at booth #F130. The SANS Institute is also running on-site workshops for cybersecurity leaders on June 2 and 3.
The intelligence–stakeholder gap and the risks it creates
The report identifies an "intelligence–stakeholder gap" in which threat intelligence work can be misunderstood or go unnoticed by business leaders. Even when a threat intelligence team produces information that is relevant to the organisation, the paper warns, that information "might fly under the radar or be misunderstood by business leaders." Without visibility or acknowledgement, intelligence teams struggle to secure approvals for additional people, processes or technology, which the study says could leave organisations vulnerable to cyber threats.
Designing briefings for senior leadership
According to the paper, threat intelligence outputs must be designed to meet what senior leadership and risk management "most urgently need to hear about." Key elements listed include:
- Clarity on enterprise exposure — informing relevant stakeholders what the main cyber risks to the organisation's mission are.
- A forward-looking risk posture — briefings that enable leaders to report on risks, adjust the organisation’s risk profile and make informed business-wide decisions.
- Early risk warning — insights that provide time to respond effectively to potential threats or vulnerabilities.
- Speed of delivery and explanation — recognising that leaders may have limited time to absorb information, so intelligence must be both timely and succinct.
The paper emphasises that these features help translate intelligence into actionable decisions rather than static reports.
Feedback as a force multiplier
The study stresses regular stakeholder feedback as central to closing the gap. "Continuous feedback allows for constant refinement of your threat intelligence program. The more you listen to your stakeholders, the stronger every aspect of your program will be," said the report. That feedback, the authors argue, not only improves alignment and usefulness but also helps assure senior leaders that their investment in the programme rests on "sound and well-adopted frameworks."
What this means for threat intelligence teams, senior leaders, and procurement holders
- Threat intelligence teams: The paper urges teams to map and understand their stakeholders, tailor communications, and produce the types of outputs that lead to "meaningful and positive" response — including forward-looking warnings and concise briefings suited to limited executive time.
- Senior leaders and risk managers: Leaders are encouraged to demand clarity on enterprise exposure and forward-looking risk posture so they can prioritise and adjust business decisions where necessary.
- Procurement and budget holders: The study highlights a practical barrier — intelligence teams frequently struggle to expand services or obtain approvals for additional people, processes or technology when their work lacks visibility or clear linkage to business risk.
The Silobreaker–SANS paper frames the problem as organisational as much as technical: threat intelligence "only delivers value when it changes decisions," and that requires translation, timing and ongoing dialogue between analysts and decision-makers. Silobreaker says it will share practical ways to align intelligence with business risk at Infosecurity Europe between June 2 and June 4; SANS will run workshops on June 2 and 3 aimed at cybersecurity leaders.
For organisations that hold threat intelligence teams, the immediate choice is operational: close the communication loop with executives, speed the movement from detection to decision, and use stakeholder feedback to make investments defensible. Whether executives and budget holders will prioritise those changes now remains a matter the paper leaves for the attending sessions to address in detail.
Original story: https://www.infosecurity-magazine.com/news/business-leaders-struggle-threat/
