From Reactive Enrichment to Predictive Intelligence.

The Customer

The customer is a European cybersecurity software company building a platform for enterprise security operations teams. Their platform aggregates threat intelligence from multiple commercial and open-source feeds, correlates it with customer telemetry, and surfaces prioritised alerts and context for analyst investigation.

The platform had achieved strong product-market fit in its core correlation layer and had a growing customer base of enterprise security teams. The intelligence layer — the component that contextualises threat data and drives prioritisation — was the product's key differentiator, and the area where the team identified the greatest gap between their current capability and where they needed to be.

The Challenge

The platform ingested significant volumes of structured threat intelligence: indicator feeds, STIX bundles, MITRE ATT&CK mappings, and commercial intel subscriptions. The data existed. The problem was connection.

Actors, TTPs, tools, and IoCs existed in silos. A new IoC would arrive, be checked against known bad lists, and either matched or not. A new TTP would be tagged to an ATT&CK technique. But the platform could not answer the questions that actually drive response decisions:

• Who is likely behind this activity, given what we know about how this actor operates?
• Given this initial access technique, what is the likely next-stage behaviour?
• How do these IoCs connect to known campaigns and actor infrastructure?

The platform's customers — enterprise security operations teams — were doing this synthesis manually, using experienced analysts to connect the dots across the intelligence the platform surfaced. This was slow, dependent on analyst expertise, and did not scale.

The CTO's specific goal was to build the intelligence layer that would move the platform from reactive enrichment — "here is what we know about this indicator" — to predictive intelligence — "here is what is likely to happen next, and here is why."

AmonSul was engaged to provide the threat intelligence domain expertise, the analytical methodology, and the custom algorithm development capability that the platform's internal team lacked.

The Approach

The engagement was structured as a twelve-month programme with three core deliverables, built and iterated in sequence. Each deliverable informed the next.

Deliverable 1: Malware Galaxy — Connected Entity Map

The first phase focused on building the foundational data structure: a connected graph linking threat actors, malware families, tools, TTPs, and IoCs based on documented relationships from AmonSul's operational intelligence, VATRA threat intelligence platform data, open-source research, and the customer's existing feed data.

This was not a simple data normalisation exercise. The challenge was establishing relationship confidence — distinguishing between "this IoC has been associated with this actor in one report" (weak signal) and "this IoC appears consistently across multiple campaigns attributed to this actor with forensic evidence" (strong signal).

AmonSul developed a relationship confidence scoring model incorporating:

• Number of independent source attributions
• Temporal proximity of IoC use to documented actor campaigns
• Infrastructure overlap with previously confirmed actor assets
• TTP consistency with actor's documented tradecraft

The Malware Galaxy was built as a graph database — nodes representing entities (actors, tools, TTPs, IoCs, campaigns) and edges representing relationships with confidence scores. By the end of Phase 1, the graph contained over 12,000 entities and 47,000 relationships, with confidence scores calibrated against a test set of known-attribution historical cases.

Deliverable 2: Attack Prediction Algorithm

With the entity graph operational, the second phase addressed the core predictive capability: given a set of observed indicators or techniques, what is the most likely next-stage behaviour?

AmonSul designed the algorithm around the concept of attack chain probability paths — for each observed technique or indicator, the algorithm traverses the entity graph to identify which actors use this technique, what techniques those actors typically employ at the next stage of the kill chain, and with what frequency and in what sequence.

The algorithm produces a ranked list of predicted next-stage techniques with confidence scores, based on:

• Actor attribution probability (which actors are consistent with the observed activity)
• Historical attack chain patterns for those actors (what they do next, in what order)
• Campaign context (early-stage activity vs. post-persistence behaviour patterns)

The prediction model was validated against a held-out set of 34 historical campaign progressions. It predicted the correct next-stage technique in the top-3 results in 78% of test cases, compared to 31% for a naive frequency-based baseline.

Deliverable 3: Attack Chain Visualisation

The third phase translated the entity graph and prediction model into a human-readable interface layer: a visualisation of complete attack chains from initial access through to impact, with actor attribution, confidence scoring, and predicted continuation paths displayed in a format designed for analyst consumption.

The visualisation was designed to answer the specific questions an analyst asks when investigating an active incident or reviewing a threat intelligence report: not just "what happened" but "who did this," "how confident are we," and "what are they likely to do next."

AmonSul worked directly with the customer's product team on the visualisation design — the technical capability was only useful if analysts could understand and act on what they were seeing. Several iterations of the design were tested with analysts from the customer's existing enterprise customers before the final implementation.

Ongoing Intelligence Operations

In parallel with the three deliverables, AmonSul provided continuous intelligence operations support throughout the twelve-month engagement:

• IoC analysis: review and confidence-scoring of new indicators entering the platform's feeds
• Dark web monitoring: systematic monitoring of dark web sources for references to the customer's platform customers' infrastructure, brand, and personnel
• Malware analysis: technical analysis of new malware samples to extract TTPs, infrastructure characteristics, and actor-consistent behavioural patterns for incorporation into the Malware Galaxy

This operational work served two purposes: it kept the entity graph current during the build phase, and it validated the algorithm's predictions against live threat activity in near-real-time.

The Outcome

By the end of the twelve-month engagement, the platform's intelligence layer had been fundamentally transformed.

Attack prediction time — the time from observing initial indicators to producing a prioritised set of predicted next-stage techniques — was reduced by 50%, from an average of 4 hours of analyst time to under 2 hours, with the algorithm providing the foundational analysis that analysts then reviewed and refined rather than built from scratch.

Threat intelligence enrichment speed improved by 2×. The Malware Galaxy's confidence-scored entity graph meant that new IoCs and TTPs could be contextualised against known actors and campaigns automatically, with analyst review focused on exceptions and edge cases rather than baseline attribution.

The Attack Chain Visualisation was incorporated into the platform's analyst interface and received strong positive feedback in customer reviews — specifically for reducing the cognitive load of connecting disparate intelligence pieces during active investigations.

The engagement did not end at twelve months. AmonSul continues to work with the customer as an ongoing intelligence partner — evolving the Malware Galaxy as new actors and techniques emerge, refining the prediction algorithm against new campaign data, and providing operational intelligence support as the platform's customer base grows.

The customer's CTO has described the engagement as the point at which the platform's intelligence layer moved from a data aggregation capability to a genuine analytical tool — the transition from "we show you what we know" to "we show you what we know and what to expect next."