Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CTI as Cover: The Justification Behind Every Security Decision

CTI isn’t just about detecting threats, it’s about helping defenders justify the decisions they make. Scott Scher explains why cyber threat intelligence should be seen as cover, not an excuse. It should be seen as a way to prioritize and explain security actions with confidence. Scott lays out how CTI can give defenders clarity, accountability, and the ability to say.

Threat Actor Profile: Interlock Ransomware

A relatively new ransomware group, Interlock, has gained traction in 2025 as an opportunistic ransomware operator that leverages compromised websites and multi-stage social engineering techniques to deliver their payloads. First observed in September 2024, Interlock departs from the traditional Ransomware-as-a-Service (RaaS) model, operating without affiliates or public advertisements.

Defending Against SCATTERED SPIDER with Falcon Next-Gen SIEM

SCATTERED SPIDER is a prolific eCrime adversary that has conducted a range of financially motivated activities beginning in early 2022. Since surfacing, this adversary continues to compromise organizations around the world, deploying ransomware and exfiltrating sensitive files.

When AI Agents Go Awry

When your AI agents go awry, rewind those changes easily with Agent Rewind from Rubrik. As AI agents gain autonomy and optimize for outcomes, unintended errors can lead to business downtime. Agent Rewind will enable organizations to undo mistakes made by agentic AI by providing visibility into agents' actions and enabling enterprises to rewind those changes to applications and data. We’ve integrated Predibase's advanced AI infrastructure with Rubrik's recovery capabilities to enable enterprises to embrace agentic AI confidently.

The "So What?" Problem in Threat Intelligence

Defense teams and many others across the organization don’t always understand what intelligence is or how to use it. Scott Scher explains why that second part, how to use it, is what CTI teams often miss. Scott shares why intelligence must go beyond reports and clearly communicate what matters and what to do next. Key Points: Most teams don’t know how to apply raw intelligence CTI must embed the “so what” and “what now” Reports alone are not enough Actionability is what makes intel valuable.

Breaking the Intelligence-Defense Divide with Scott Scher

Cyber threat intelligence is often misunderstood, seen as a niche reporting function instead of the connective tissue that links defenders, leaders, and strategy. In this episode of Data Security Decoded, join Caleb Tolin as he sits down with Scott Scher, a cyber threat intelligence (CTI) expert with an unconventional backstory, to explore how his off‑grid years shaped his view on resilience, why CTI should be seen as “counter‑threat intelligence,” and how intelligence defenders, and policy teams can work as one to turn raw data into actionable security decisions.

The New Guy (a.k.a. Agentic AI)

AI agents have already caused unintended record updates, broken workflows, and pushed flawed logic into production systems. These misfires often go unnoticed until forecasts stall, pipelines break, or sensitive data is affected. These aren’t hallucinations. They’re executed actions with real consequences. At Rubrik, we’ve spent years helping enterprises recover from ransomware, insider threats, and operational errors. The pattern is always the same: Damage happens fast. The root cause is murky. And visibility is fragmented.