Intelligence Led Security: What It Actually Means for Business
Why businesses need to connect the dots before security problems become incidents
September feels unusually significant for me. I am now in the final stages of my military career, which is coming to a close after more than two decades in the RAF Police. It has made me reflect on what I have learned, what I have seen work, and where I believe businesses are missing an opportunity to protect themselves more effectively.
I do not intend to bring military terminology into business for the sake of it. That would be unhelpful. However, I do want to bring across some of the thinking that helped us understand insider risk, make decisions and intervene early. Intelligence led security is at the centre of that. In my view, it is one of the most misunderstood and underused capabilities in the civilian security environment.
The point where intelligence clicked for me
In 2012, after almost eight years as a frontline RAF Police officer, I was posted to the RAF Police Force Intelligence Bureau, known as FIB. Until then, I had worked across security and law enforcement, dealing with security incidents, criminal matters, witnesses, victims, suspects and a great deal of information. I understood the operational side of the job. I knew that information mattered. What I had not properly understood was what happened when that information was professionally developed, assessed and brought together.
Within a couple of weeks, it genuinely felt as though a light had switched on in my head. Intelligence was a different world and I fell in love with it immediately. It showed how seemingly small observations could become meaningful when placed alongside other reports, records, patterns and wider context - much like a jigsaw puzzle. It gave our commanders a clearer view of the threats they faced, rather than simply a list of individual incidents.
If I am being honest, it was a difficult realisation for me. I had spent eight years in frontline law enforcement before I really understood the benefits of intelligence. I do not say that to criticise the people I worked with. Far from it. It simply showed me that even in an organisation where intelligence was an established function, the value of it was not always visible or fully understood at every level. We could have been better at helping frontline people see why the report they submitted mattered, what it might connect to and how it could prevent harm.
This has stayed with me. It is also why I believe businesses need to have a much more open conversation about how human intelligence ties into their overall security strategy.
What intelligence led security actually means
In plain English, intelligence led security means using information to make better security decisions before something serious happens. It is not a dashboard full of alerts, collecting every possible piece of data about employees, or treating every concern as evidence of malicious intent.
It is the disciplined process of taking the small things that are normally scattered across an organisation and asking whether they tell a bigger story. That might include a report from a member of staff, an unusual access request, a repeated security shortcut, a welfare concern, an HR issue, a physical security breach, a suspicious call to a service desk, a change in behaviour or a recurring problem at one site.
Any one of those things may be completely innocent. Most will be. A single unusual request may be a genuine mistake. A policy breach may be poor understanding rather than deliberate wrongdoing. A report may be based on a misunderstanding, a personal disagreement, a lost access card or, occasionally, a malicious allegation. That is precisely why information cannot simply be accepted at face value.
But when several credible pieces of information point in the same direction, the picture can change. A suspicious call that seems insignificant to one employee may take on a different meaning when other staff report similar approaches. A recurring security breach may be a training problem, a poorly designed process or a sign that somebody has found a way around a control. An employee under genuine personal pressure may need support, not suspicion, but their situation may still alter the organisation’s risk picture if their role gives them trusted access to valuable information or systems.
That is the difference between holding information and using intelligence.
Information is not intelligence
Information is the raw material. Intelligence is information that has been checked, placed in context and assessed for a clear purpose. It should help a leader decide what to do next, what risk to prioritise, what needs more investigation and what does not.
The process is often described as an intelligence cycle. In simple terms, an organisation identifies what it needs to understand, gathers relevant information, evaluates it, analyses it, then gives the resulting assessment to the people who can act. The answer may be a change to policy, targeted training, a welfare intervention, an access review, a technical control, a management decision or no further action at all. The point is that the response is based on a reasoned assessment, rather than fear or guesswork.
This is also where specialist capability matters. Analysts do not simply collect reports and pass them on - or shouldnt be. They assess the reliability of the source, the credibility of the information and the confidence that can reasonably be placed in the assessment. They look for corroboration, gaps, alternative explanations and any evidence that challenges their initial view.
That grading process may sound technical, but it is a vital safeguard. Without it, an organisation can overreact to a false flag, damage trust and unfairly label an innocent person as a problem. Equally, without proper analysis, it can dismiss the early signs of a real threat because no single report appears serious enough on its own.
Good intelligence work holds both possibilities in view. It is careful, proportionate and honest about what is known, what is not known and what needs to happen next.
Cyber threat intelligence is important, but it is not the whole picture
Cyber threat intelligence is already well understood in many larger organisations. It helps cyber teams understand relevant threat actors, vulnerabilities, the infrastructure attackers use, attacker techniques and wider developments that may affect the organisation. This is essential work. A capable cyber threat intelligence function can inform detection, hardening, threat hunting and incident response.
However, cyber threat intelligence is only one part of a wider security picture. It is principally designed to understand external adversaries, technical weaknesses and the methods used to compromise systems. It may identify insider relevant indicators, but it does not on its own explain what is happening around people, trust, behaviour, access and organisational culture.
Human focused threat intelligence, which is the term I use for this wider discipline, asks different questions. Where is trusted access creating opportunity? Are employees being manipulated, coerced, exploited or placed under unusual pressure? Are reporting routes trusted? Is a team normalising poor practice? Has a change in leadership, workload, restructuring, grievance, redundancy or supplier arrangement created a new vulnerability? Are physical and cyber controls being bypassed through normal working behaviour?
This is not an argument for turning workplaces into surveillance environments or treating employees as suspects. It is the opposite. A mature approach should recognise that people can be an organisation’s strongest line of defence when they are supported, trained and given a safe way to raise concerns. It should be fair, lawful and proportionate, with clear governance around what information is used, why it is used and who is allowed to see it.
The distinction between cyber threat intelligence and human focused threat intelligence deserves an article of its own, and I will come back to it. Businesses need both. Neither replaces the other.
Why the civilian environment often misses the picture
Defence and policing are not perfect. No organisation gets intelligence right all of the time. But they recognise something that many businesses still do not: individual reports are rarely valuable because of the single event they describe. Their value often lies in what they connect to.
In a business, different teams will usually hold a small part of the picture. HR may see a welfare issue, conduct concern or grievance. Physical security may see repeated access problems. IT may see unusual activity or an attempted policy bypass. A manager may notice a change in behaviour. Legal and compliance may see an emerging regulatory challenge. Finance or procurement may identify a pattern that does not make commercial sense. A member of staff may be approached for information or see something that simply does not feel right.
Each team may deal with its own issue sensibly and professionally. The difficulty arises when no one has the remit, analyst capability or governance to compare those fragments. The organisation can become data rich but intelligence poor. It has the information it needs, but no mechanism to turn it into a meaningful assessment.
This is one reason insider risk is missed so often. The warning signs do not always arrive as a clear confession, a major cyber alert or an obvious crime. They appear as disconnected details, often spread over weeks or months, as I explored in our assessment of the JLR cyber attack. Someone needs to connect the dots, test whether they matter and give leaders a clear view of the risk.
That does not mean businesses should copy a police or military model line for line. They have different legal powers, cultures, responsibilities and threat environments. But the core discipline transfers well: direct collection towards a clear requirement, assess information fairly, bring relevant strands together, make proportionate recommendations and check whether the action taken has reduced the risk.
Why this cannot be left to a tool or an inbox
Technology can support the process. It can make it easier to record information, spot trends, manage cases and share relevant assessments securely. It is not, however, a substitute for professional judgement.
A reporting inbox may receive concerns but it cannot decide whether a source is reliable, whether a pattern is emerging, whether there is an innocent explanation or whether intervention would be fair and proportionate. A monitoring tool may generate a useful alert, but it cannot understand a team’s culture, a personal welfare issue, a management dispute or the operational context behind the behaviour it has identified.
This is why intelligence led security requires trained people. Analysts need the ability to ask the right questions, test their own assumptions and challenge the obvious explanation. They must be able to distinguish an indicator from evidence, assess risk without turning suspicion into fact and explain their confidence clearly to decision makers.
The ethical point is just as important. Poorly handled information can harm people and organisations. An allegation that has not been assessed should not become a label. A behavioural concern should not automatically become a disciplinary case. Sensitive information should not be shared more widely than necessary. Good governance, legal controls and clear escalation processes protect the individual as much as they protect the organisation.
This is not bureaucracy for its own sake. It is how an organisation avoids both complacency and overreaction.
The bigger picture leaders need to see
The real value of intelligence is not simply understanding what has already happened. It is giving the C suite, security leaders and those responsible for investment a clear, factual picture of the risks the organisation is carrying. They cannot set the right priorities if relevant information remains split between HR, IT, physical security, compliance, finance and operational teams. Once those strands are assessed together, leaders can see what is changing, where the pressure points are and which risks genuinely deserve attention.
During my time at FIB, it was not long before every commander wanted an analyst. We were not there to produce reports for their own sake. An analyst could take security and crime data from the previous 12 to 18 months, combine it with current reporting and present it in plain English. This is what has happened. This is where it has happened. This is what is recurring. This is the risk we are likely to carry if nothing changes. That gave commanders a sound basis to set strategic priorities, direct resources and make informed investment decisions based on real data.
The business case often followed naturally. It is easy to dismiss a request that says a team would like a new control, more training or another member of staff. It is much harder to dismiss a clear assessment that shows repeated loss, persistent vulnerability, rising demand, a site at greater risk or a gap with serious operational, financial or reputational consequences. When the facts are presented properly, a business case can almost write itself.
This is why the collection, analysis and presentation of intelligence are equally important. Intelligence that sits in a system, dashboard or analyst’s folder has limited value. Leaders need concise, plain English assessments that explain what is known, what has changed, what is uncertain, the options available and the recommendation. The purpose is not to overwhelm them with data. It is to give them an honest basis for action.
It also allows an organisation to look ahead. Intelligence is not fortune telling and cannot guarantee an event will happen. It can, however, identify conditions, patterns and vulnerabilities that make a problem more likely if nothing changes. That gives leaders time to support people, correct a weakness, adjust a control or invest before an issue becomes a crisis.
For a CISO, this should be one of the most valuable capabilities available. It turns fragmented security information into a decision ready picture of business risk. In my opinion, good intelligence analysis is a CISO’s best friend.
My view
I believe many businesses have already invested in valuable cyber, physical and compliance controls. The gap is often not the absence of information. It is the absence of a disciplined way to make sense of it across the organisation.
They do not necessarily need a large internal intelligence bureau. The model should be proportionate to their size, sector, resources and risk. But every organisation should know what security information matters, how staff can report it, who assesses it, how it is graded, where it is brought together and how decisions are made from it.
That is the standard I want to help bring from Defence and policing into the civilian environment. Not to make businesses more secretive or suspicious, but to make them more aware, more joined up and more able to protect their people, information and reputation.
Collecting information is not enough. Someone needs to connect the dots.
At Insider Threat Limited®, we help organisations turn separate security, people and reporting information into decision ready intelligence. If you would like to discuss what an intelligence led security approach could look like in your organisation, please get in touch.
Comments