By Jeremy Brown, VP of Threat Analysis, Trinity Cyber
A threat discovered by one security team should always give the next team a head start. Making that happen takes work: examining the evidence, deciding what can responsibly be shared, and putting someone else’s findings to use. That work becomes especially important as frontier AI capabilities find their way into attackers’ workflows.
That’s where our collaboration with the Cyber Threat Alliance (CTA) shines. Trinity Cyber has been a CTA member for over a year, contributing several thousand indicators of compromise (IOCs) each week while also consuming IOCs and pre-public release research from fellow members. Both sides of this exchange extend value in the fight against attackers.
At Trinity Cyber, our mission is to prevent cutting-edge threats before they can be weaponized against customers. This means deeply inspecting internet traffic, and tearing threats out at line speed. We study adversary behavior, tactics, and techniques to understand how attacks work and how to stop them. The challenge is to distill that complexity into shareable information. Sharing IOCs gives observations from our work a life beyond just the networks we protect.
Relevant and timely IOCs provide a solid starting point for hunting threat activity on networks. Participating in CTA’s IOC exchanges and Early Share program helps our team turn those starting points into deeper investigations. Likewise, our IOC contributions fuel other members’ hunting efforts; a cycle which is critical and important in stopping attackers before they succeed.
Sharing indicators offer plenty of leads, but the real value comes when another team connects a finding to its own observations or uses it to pursue a question. What was this infrastructure doing? What behavior accompanied it? Is there something here worth investigating further?
CTA’s Early Share program helps put those questions in context. Members share pre-release research as they can, giving fellow analysts time to examine the findings before publication. These posts provide context around the techniques adversaries use, giving background beyond just the IOCs shared. Together, the indicators and research give members more to work with.
For our team, that’s a chance to dig in. A research post can explain how an attack works, connect otherwise isolated details, or highlight a technique worth a closer look. Our team can assess what the evidence establishes and how it relates to the traffic under inspection. Sometimes the most useful contribution is a question that hadn’t occurred to our team yet.
AI adds urgency to this exchange. The UK’s National Cyber Security Centre [assesses that attackers are already using AI](https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027) to enhance reconnaissance, social engineering, malware generation, and other activities. As those capabilities help attackers scale their operations, defenders must make sound decisions about more activity, faster.
Shared intelligence helps focus that effort. Recipients still need to understand the evidence, its limits, and its relevance to their defenses. Faster sharing makes that judgment more consequential.
Our participation also extends to CTA’s Steering Committee, where Trinity Cyber stands alongside others, helping to guide CTA. It’s another way to contribute our operational perspective and keep collaboration useful to the teams doing the work.
As attacks scale, each discovery should benefit more defenders. Our commitment is to contribute consistently, protect those who are targeted by attackers, and make time to learn from our peers. The goal is practical: give the next team a better place to start.