Lessons from a Former US Navy Collector - Joe Slowik on intelligence tradecraft and AI in CTI (S02E06)

In this episode of Intelligence Tradecraft, host Freddy Murre sits down with Joe Slowik, a threat intelligence veteran whose career spans the US Navy, Los Alamos National Laboratory, MITRE, and the vendor world (Dragos, DomainTools, Gigamon, Huntress, and now DataMinr).

In the conversation, Joe makes the case that intelligence is fundamentally about decision support, not raw data feeds or research written for other analysts. He and Freddy dig into what separates good reporting from bad, why stakeholder alignment and rigor (ICD 203, clear separation of fact vs. assessment) matter, and when a "flash report" beats a polished deep-dive.

They also tackle the attribution debate — how-centric vs. who-centric attribution, the mess of overlapping naming schemas (APT10 vs. APT31, the Visma case), and why "trust us, we're Microsoft" isn't tradecraft. Joe explains the thinking behind his Applied Threat Intelligence training and the gap it was built to fill.

The back half turns to AI: where LLMs genuinely help (research, scripting), where they're dangerous (cognitive offloading, model decay, drying up the junior-to-senior pipeline), who's accountable for AI-generated output, and how threat actors are using these tools, from better phishing to voice cloning.

Joe's bottom line for newcomers: critical thinking, communication, and curiosity come before any prompt-engineering skill.

Resources

Joe Slowik's LinkedIn - https://www.linkedin.com/in/joe-slowik/

Joe Slowik's Blog and Courses - https://paralus.co/

Freddy' Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications

Los Alamos National Laboratory - https://www.lanl.gov/

NIST Cyber Threat Intelligence definition - https://csrc.nist.gov/glossary/term/cyber_threat_intelligence

CTI used in books (Google Search) - https://books.google.com

APT 1 Report - https://services.google.com/fh/files/misc/mandiant-apt1-report.pdf

Moonligh Maze on Wikipedia - https://en.wikipedia.org/wiki/Moonlight_Maze

SANS FOR578 CTI - https://www.sans.org/cyber-security-courses/cyber-threat-intelligence

ICD 203 - https://www.dni.gov/files/documents/ICD/ICD-203.pdf

MLitt in Terrorism and Political Violence - https://cstpv.wp.st-andrews.ac.uk/masters-in-terrorism-and-political-violence/

Routledge Handbook of Terrorism Research - https://www.routledge.com/The-Routledge-Handbook-of-Terrorism-Research/Schmid/p/book/9780415520997

APT Groups and Operations Rosetta Stone (not mine) - https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/edit?pli=1&gid=1864660085#gid=1864660085

Structured Analytic Techniques (SAT) Training - https://inteltradecraft.com/sat-certifications

Tradecraft Primer: SATs - https://www.cia.gov/resources/csi/static/Tradecraft-Primer-apr09.pdf

An Illustrated Book of Bad Arguments - https://bookofbadarguments.com/

Weston's Rulebook for Arguments - https://hackettpublishing.com/philosophy/logic-mathematics/critical-thinking/a-rulebook-for-arguments-group

Joe's Critique of Practical Threat Intelligence - https://pylos.co/2026/05/03/a-brief-critique-of-practical-threat-intelligence/

Cognitive Offloading - https://sistemasi.ftik.unisi.ac.id/index.php/stmsi/article/view/6180

OpenAI Research - https://openai.com/research/index/

Chapters

00:00 Intro and Joe's career path

06:11 The Evolution of Cyber Threat Intelligence and intelligence

15:05 Rigor, reporting, & attribution

29:50 The Relevance of Intelligence in Incident Response and CTI

47:09 Building & measuring a CTI function

01:00:13 Training teams (and why it doesn't stick)

01:07:37 Integrating LLMs in Intelligence Work

01:19:50 Skills for the Future of CTI