How does AI improve threat intelligence compared with traditional methods?
Where AI beats the manual method, what evidence exists (and how much comes from vendors), the risks it adds and how to adopt it without losing control.
On this page
AI improves threat intelligence mainly in speed and volume: it normalises sources, summarises reports, correlates alerts and prioritises what matters in minutes rather than hours. It does not replace the analyst or the intelligence cycle, and it adds risks of its own, such as errors, data poisoning or prompt injection, that must be governed.
Where the traditional method gets stuck
Manual work follows a familiar pattern: an analyst reads bulletins and reports, extracts indicators and techniques by hand, checks them against the inventory and writes a note or a detection rule. It works, but it has four structural limits:
- Volume: sources grow faster than teams.
- Latency: hours or days pass between a report being published and its becoming a rule.
- Language and format: some of the useful information is in other languages or in unstructured text.
- Dependence on a few people: the knowledge lives in the analyst's head.
On the other side, attackers already automate. ENISA's 2025 report states that AI-supported phishing campaigns reportedly represented more than 80% of observed social engineering activity worldwide by early 2025 [1]. It is a reported estimate rather than the agency's own measurement, but it indicates that defence cannot rely on manual reading alone.
What changes, task by task
| Task | Traditional method | With AI | What still needs human judgement |
|---|---|---|---|
| Reading and summarising reports | Full read by an analyst | Summary and key-point extraction | Checking against the original source |
| Entity extraction (indicators, techniques) | Copy and paste or brittle scripts | Extraction from unstructured text and mapping to MITRE ATT&CK [2] | Validating the mapping and rejecting false links |
| Alert correlation and prioritisation | Static rules and severity ordering | Signal grouping and a proposed verdict with an explanation | Deciding the ambiguous or high-impact case |
| Translation and multilingual sources | Occasional translation | Continuous translation and normalisation | Reviewing technical nuance |
| Writing queries and rules | Knowing each tool's language | A draft from a natural-language hypothesis | Testing the rule before it goes to production |
| Attribution and judgement on intent | Analyst experience | Supporting hypotheses | All of it: it is judgement, not calculation |
The middle column describes capabilities; it does not promise specific results in your environment.
A day in an analyst's life, with and without AI (illustrative)
An illustrative scenario, not a real case or a measurement. An analyst on a small team starts the day with three vulnerability bulletins and a report on a phishing campaign.
Without AI: they read all four documents in full, copy indicators and techniques by hand, check them against the inventory and write a note. By the time they finish the morning is gone and the detection rule waits until the next day.
With AI: they receive summaries with techniques already mapped to MITRE ATT&CK and alerts grouped together, every claim linked to its source. They check what they will use against the original, discard a wrong link between two campaigns, test the draft rule the tool proposes and decide what to communicate. Attribution and priority remain theirs.
The difference lies in the time spent reading and copying, not in judgement. How much you gain on your team can only be known by measuring it.
What evidence exists, and how much to treat with caution
Public evidence with a method is scarce and should be read with its limits:
- A randomised controlled trial by Microsoft on its phishing triage agent reports that assisted analysts achieved up to 6.5 times as many true positives per analyst minute and a 77% improvement in verdict accuracy compared with the control group [3]. It is a preprint about Microsoft's own product (we could not confirm that it has been peer reviewed), covers a single task (user-reported emails) and does not justify extrapolating to all threat intelligence.
- Google SecOps' triage and investigation agent documentation describes how it works: each investigation returns a verdict (true or false positive), a confidence level, a summary, a timeline and suggested next steps; analysts review it and can give feedback to refine it [4]. This is product documentation: it explains the design, it does not measure performance.
Any improvement percentage a vendor quotes you should be reproducible with your data.
The risks AI adds
- Attacks on the model itself. NIST publishes a taxonomy of adversarial machine learning attacks, including data poisoning and evasion [5]. If the intelligence system feeds on manipulable sources, it can be manipulated.
- Prompt injection and excessive autonomy. The OWASP Top 10 for LLM Applications (2025 edition) lists prompt injection, data and model poisoning, and misinformation among its main risks [6].
- Overconfidence. A fluent summary can be wrong. Without traceability to the source, the analyst cannot check it.
How to adopt it without losing control
NIST's AI Risk Management Framework is voluntary and works as general guidance for managing these risks [7]. In practice:
- Human in the loop for any action with production impact.
- Traceability: every AI claim links to its original source.
- Evaluation on your data before trusting a vendor's figure.
- Explicit action limits: what the AI may do alone and what needs approval.
- Logging and periodic review of hits and misses.
At Hodeitek we work on this layer through AI security consulting, the AI governance and security solution and AI-driven security automation. If what you want is to operate with analysts supported by technology, see our managed SOC.
To understand the full framework, start with what threat intelligence is; and if you are interested in the next step, agents that act as well as recommend, read what an agentic SOC is. You can also see how we apply AI in the SOC in How AI Is Transforming Threat Detection in the SOC.
Frequently asked questions
Does AI replace threat intelligence analysts?
No. The public evidence available describes AI as a support layer that prioritises and summarises; judgement on attribution, intent and impact remains human. Microsoft's trial measures assisted analysts, not replaced analysts [3].
How does AI improve threat intelligence compared with traditional methods?
Speed and scale on repetitive tasks: summarising, extracting entities, correlating and prioritising. The real advantage in your organisation can only be known by measuring it with your own data.
What are the main risks of using AI in threat intelligence?
Manipulation of the sources or the model (poisoning, evasion) [5], prompt injection [6] and overconfidence in summaries without traceability.
Do attackers use AI too?
Yes. ENISA reports that AI-supported phishing campaigns represented more than 80% of observed social engineering activity by early 2025, according to its report [1].
Where do I start?
With a bounded use case (for example, summarising and prioritising vulnerability bulletins), prior measurement and human review. Then you widen it.
Next step
Do you want to assess where AI can help your threat intelligence without taking on unnecessary risk? Tell us about your case or get to know HodeiShield, our own AI-driven detection and analysis platform.
Sources
- ETL 2025: EU consistently targeted by diverse yet convergent threat groups. ENISA, 2025-10-01. https://www.enisa.europa.eu/news/etl-2025-eu-consistently-targeted-by-diverse-yet-convergent-threat-groups
- MITRE ATT&CK. MITRE. https://attack.mitre.org/
- Randomized Controlled Trials for Phishing Triage Agent (preprint). arXiv (J. Bono), 2025-11-17. https://arxiv.org/abs/2511.13860
- Use Triage and Investigation Agent to investigate alerts. Google Cloud documentation. https://docs.cloud.google.com/chronicle/docs/secops/triage-agent
- Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (AI 100-2 E2025). NIST, 2025-03-24. https://csrc.nist.gov/pubs/ai/100/2/e2025/final
- OWASP Top 10 for LLM Applications. OWASP GenAI Security Project. https://genai.owasp.org/llm-top-10/
- AI Risk Management Framework. NIST, 2023-01-26. https://www.nist.gov/itl/ai-risk-management-framework
Self-check your SOC's toil
Estimate how much repetitive SOC work you could automate with AI/orchestration, in 2 minutes.
Was this article useful?
Gorka Gonzalo
Founder & CEO
Founded Hodeitek in 2023 and runs the company, after more than 8 years in pentesting, Red Team, OT/ICS auditing, and SOC leadership. A cybersecurity and AI expert, he sets the technical and product direction of HodeiShield and personally leads the most critical engagements — from defense strategy to applying AI in threat detection. He is the client's direct point of contact: whoever scopes the work also answers for the result.