Lessons from a Former US Navy Collector - Joe Slowik on intelligence tradecraft and AI in CTI (S02E06)

In this episode of Intelligence Tradecraft, host Freddy Murre sits down with Joe Slowik, a threat intelligence veteran whose career spans the US Navy, Los Alamos National Laboratory, MITRE, and the vendor world (Dragos, DomainTools, Gigamon, Huntress, and now DataMinr).In the conversation, Joe makes the case that intelligence is fundamentally about decision support, not raw data feeds or research written for other analysts. He and Freddy dig into what separates good reporting from bad, why stakeholder alignment and rigor (ICD 203, clear separation of fact vs. assessment) matter, and when a "flash report" beats a polished deep-dive.They also tackle the attribution debate — how-centric vs. who-centric attribution, the mess of overlapping naming schemas (APT10 vs. APT31, the Visma case), and why "trust us, we're Microsoft" isn't tradecraft. Joe explains the thinking behind his Applied Threat Intelligence training and the gap it was built to fill.The back half turns to AI: where LLMs genuinely help (research, scripting), where they're dangerous (cognitive offloading, model decay, drying up the junior-to-senior pipeline), who's accountable for AI-generated output, and how threat actors are using these tools, from better phishing to voice cloning. Joe's bottom line for newcomers: critical thinking, communication, and curiosity come before any prompt-engineering skill.ResourcesJoe Slowik's LinkedIn - https://www.linkedin.com/in/joe-slowik/Joe Slowik's Blog and Courses - https://paralus.co/Freddy' Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications Los Alamos National Laboratory - https://www.lanl.gov/ NIST Cyber Threat Intelligence definition - https://csrc.nist.gov/glossary/term/cyber_threat_intelligenceCTI used in books (Google Search) - https://books.google.com APT 1 Report - https://services.google.com/fh/files/misc/mandiant-apt1-report.pdf Moonligh Maze on Wikipedia - https://en.wikipedia.org/wiki/Moonlight_MazeSANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence ICD 203 - https://www.dni.gov/files/documents/ICD/ICD-203.pdfMLitt in Terrorism and Political Violence - https://cstpv.wp.st-andrews.ac.uk/masters-in-terrorism-and-political-violence/ Routledge Handbook of Terrorism Research - https://www.routledge.com/The-Routledge-Handbook-of-Terrorism-Research/Schmid/p/book/9780415520997 APT Groups and Operations Rosetta Stone (not mine) - https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/edit?pli=1&gid=1864660085#gid=1864660085 Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications Tradecraft Primer: SATs - https://www.cia.gov/resources/csi/static/Tradecraft-Primer-apr09.pdf An Illustrated Book of Bad Arguments - https://bookofbadarguments.com/ Weston's Rulebook for Arguments - https://hackettpublishing.com/philosophy/logic-mathematics/critical-thinking/a-rulebook-for-arguments-group Joe's Critique of Practical Threat Intelligence - https://pylos.co/2026/05/03/a-brief-critique-of-practical-threat-intelligence/ Cognitive Offloading - https://sistemasi.ftik.unisi.ac.id/index.php/stmsi/article/view/6180 OpenAI Research - https://openai.com/research/index/Chapters00:00 Intro and Joe's career path06:11 The Evolution of Cyber Threat Intelligence and intelligence15:05 Rigor, reporting, & attribution29:50 The Relevance of Intelligence in Incident Response and CTI47:09 Building & measuring a CTI function01:00:13 Training teams (and why it doesn't stick)01:07:37 Integrating LLMs in Intelligence Work01:19:50 Skills for the Future of CTI