Cybersecurity expert questions industry’s reliance on basic threat indicators
cybernewschronicle.com · post 60746 · 2026-06-25
Martin Lee, writing in the latest Threat Source newsletter, has thrown a pointed question at the cybersecurity industry: what happens after you block the known bad stuff? His answer, published Thursday from London, is that the industry’s current fixation on indicators of compromise — the IP addresses, file hashes, and domain names that get fed into firewalls and SIEMs — only scratches the surface. Lee argues that artificial intelligence, if aimed higher up the intelligence lifecycle, could do far more than automate the blocking of yesterday’s attacks.
The stakes are concrete. Right now, organizations dump millions of IOCs into databases.
They block what they can. But they remain blind to the bigger picture — who is attacking, how they operate, what infrastructure they favor, and what they actually want. That blind spot is where real damage happens.
A blocked hash stops a known malware variant. It does nothing to predict the next one, or to surface the strategic intent behind an intrusion campaign.
Lee opened the newsletter by noting that the AI-in-cybersecurity debate is often framed as a binary: AI as a force multiplier for attackers versus AI that renders human defenders obsolete. He called that framing too simple. AI does give attackers some advantage.
But it also gives defenders one, provided they use it on the right problem. The right problem, in his view, is not churning out more IOCs faster. The industry already excels at that.
These atomic indicators fit neatly into key-value stores. Their value can be enhanced with context structured in STIX or MISP format.
That is the tactical layer. It is useful. It is also shallow.
“Ultimately, we want the consumers of threat intelligence reports to develop their knowledge and to build a…” — the published text cuts off there in the available source material. But the trajectory is clear.
Knowledge, not just blocking rules. Understanding adversary behavior, not just cataloging artifacts. AI, Lee contends, is better suited to indexing the broader intelligence picture.
Making sense of it. Deriving value from it. That is a fundamentally different job than matching a hash against a blocklist.
It is the difference between knowing a specific phishing email used a specific PDF and knowing that a Russian-speaking group is shifting its targeting from energy to finance. The newsletter did not name specific threat groups, recent attacks, or preferred AI tools.
It did not need to. The argument stands on its own terms: the industry has built a massive IOC machine. That machine is not wrong.
It is just incomplete. What is at risk is the gap between tactical blocking and strategic understanding.
Organizations that fill that gap with AI could see attacker tradecraft, not just attacker artifacts. Those that do not will keep reacting to each new IOC as if it were a surprise, even when the pattern behind it was visible all along. Lee’s piece lands as the cybersecurity community continues to wrestle with how to integrate AI without over-relying on it.
The danger, his argument suggests, is not that AI will replace analysts. It is that AI will be wasted on the wrong job — and the industry will stay stuck at the tactical layer, blocking what it already knows, while missing what it needs to learn.
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “Cybersecurity expert questions industry’s reliance on basic threat indicators”, “description”: “Martin Lee, writing in the latest Threat Source newsletter, has thrown a pointed question at the cybersecurity industry: what happens after you block the known…”, “datePublished”: “2026-06-25T17:43:00+00:00T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Dmitry Volkov”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}}