Insights from Silobreaker’s latest report
Over the last few years, enormous shifts in the global geopolitical landscape have come to affect even the most insular cybersecurity teams, creating a mounting need for integrated intelligence strategies. Silobreaker’s latest report, “Falling Backwards Into It: The Influence of Geopolitics on Cyber Threat Intelligence Teams”, provides an in-depth exploration of how geopolitics is transforming the role of cyber threat intelligence (CTI) teams across industries.
Through interviews with private-sector practitioners in sectors ranging from finance to pharmaceuticals, the report sheds light on how CTI teams are navigating these challenges, balancing their core responsibilities with new demands for geopolitical insights.
The expanding role of CTI teams
Although the responsibilities of CTI have always varied from team to team, they have typically revolved around a core list of intelligence consumers – security operations centres, incident responders, CISOs, vulnerability managers, threat hunters and digital risk teams. However, a combination of both the growing recognition of CTI capabilities, as well as stakeholder interest in new rapidly developing risks, has enshrined a paradigm in which cybersecurity cannot exist in isolation from geopolitical developments. The Russian invasion of Ukraine served as one of the key catalysts for this cyber-geopolitical intelligence nexus.
What began as a greater diversity of requests for information concerning geopolitics has, in some organisations, evolved into proactive monitoring and intelligence-sharing practices across infosecurity and other risk-focused teams. Yet, the report notes that this shift has been uneven, with different models emerging across organisations:
- Unified teams: These teams integrate cyber, geopolitical and physical intelligence into a single framework, enabling comprehensive risk analysis.
- Collaborative structures: In this model, CTI teams collaborate with separate geopolitical risk units, providing specialised support from the perspective of strategic cyber threat without diluting their primary cyber focus.
- Reactive teams: Some teams are addressing geopolitical issues only when prompted by executive demands or urgent crises. They may have excellent analysts on staff with relevant background in, e.g., public sector intelligence, however, due to limited resources are unable to provide pro-active support.
Despite their varying approaches, one theme is clear: CTI teams are increasingly taking on more strategic roles within their organisations.
Balancing geopolitical intelligence with core duties
The report highlights a central tension for CTI teams: balancing their traditional cybersecurity responsibilities with the growing demand for geopolitical intelligence. This is most apparent during major crises, where executives often bypass formal channels to request immediate analysis. While these demands underscore the strategic importance of CTI, they can also strain resources, diverting attention away from core duties.
Many teams have adopted ad-hoc solutions to cope with these pressures, such as producing quick-response geopolitical briefings or collaborating with other units on shared intelligence projects. However, these reactive measures often lack the structure needed to sustain long-term value. Proactive approaches, such as scenario planning and strategic forecasting, remain limited to well-resourced teams in industries like banking and finance.
Resource constraints are another significant barrier. Most CTI teams lack the capacity for in-depth geopolitical analysis, particularly when it involves forecasting potential future scenarios. Smaller teams also struggle to justify dedicating time to long-term geopolitical risks when immediate cyber threats demand attention.
From information to intelligence
A recurring insight from the report is the distinction between information and actionable intelligence. CTI teams are not simply aggregating news or social media updates; they are connecting the dots to help stakeholders understand the business implications of global events. This requires analysts who can synthesise complex data into concise, impactful reports.
Teams with diverse skill sets – spanning international relations, security studies and intelligence analysis – are better equipped to meet these demands. Their ability to interpret geopolitical risks through a business lens is crucial for translating abstract threats into actionable recommendations. This human expertise complements technological tools, which are vital for managing and analysing vast amounts of data but cannot replicate the nuanced judgment of experienced analysts.
The value of proactive intelligence
One of the key findings from Silobreaker’s research is the importance of shifting from reactive to proactive intelligence. While most CTI teams remain primarily responsive, a few organisations have begun producing regular geopolitical briefings and scenario analyses. This proactive approach helps anticipate executive concerns, ensuring that intelligence products are both timely and relevant.
For example, a global financial services firm mentioned in the report has developed playbooks that link geopolitical indicators to predefined scenarios. These playbooks provide actionable steps for decision-makers, enabling faster responses to emerging crises. Such practices demonstrate the potential for intelligence teams to not only inform but also shape organisational strategy.
Risk quantification and communication
A growing trend among leading CTI teams is the use of risk quantification to enhance decision-making. By assigning baseline risk scores to countries or regions, teams can provide stakeholders with a clear, comparative understanding of geopolitical threats. Visualisation tools, such as dashboards and heatmaps, make these insights accessible, enabling leaders to grasp the implications quickly.
However, the report cautions that risk quantification should not replace qualitative analysis. Instead, it should serve as one of several tools used to contextualise threats and guide strategic planning. For many teams, integrating these methods requires additional resources and buy-in from senior leadership, which can be challenging in resource-constrained environments.
Adapting to the future
As geopolitical risks continue to rise, organisations must rethink their approach to intelligence. Silobreaker’s findings suggest several key steps for adapting to this new reality:
- Invest in diverse skill sets: Building teams with expertise in international relations, intelligence analysis and cybersecurity ensures a holistic approach to risk management.
- Leverage technology: Platforms like Silobreaker enhance data collection, analysis and dissemination, improving efficiency and enabling teams to deliver timely insights.
- Integrate intelligence functions: Breaking down silos between CTI and geopolitical intelligence fosters collaboration and ensures a coordinated response to emerging threats.
- Proactively engage stakeholders: Regular briefings and scenario analyses help CTI teams stay ahead of executive concerns, reinforcing their strategic value within the organisation.
The fusion of cyber and geopolitical intelligence is no longer a theoretical exercise—it’s a practical necessity for businesses navigating modern international affairs. Silobreaker’s report offers a roadmap for operating in this complex landscape, emphasising the importance of proactive strategies, collaborative tools and human expertise.
For organisations willing to invest in these capabilities, the payoff is clear: greater resilience, improved decision-making and a stronger ability to adapt to an unpredictable future.
Explore these insights in greater detail by downloading Silobreaker’s full report here.
