The Agentic Cyber Threat Intelligence Framework (ACTIF).

Cyber Threat Intelligence (CTI) analysis faces significant scalability challenges due to the manual nature of human analytical tradecraft and the vast volume of threat data. While Artificial Intelligence (AI) and Large Language Models (LLMs) offer rapid processing, relying on basic LLM prompts introduces key risks, including potential hallucinations, lack of organisational context, and absent analytical tradecraft. This post proposes the Agentic Cyber Threat Intelligence Framework (ACTIF) to address these limitations. By deploying specialised AI agents equipped with standardised Agent Skills across six core CTI categories: Collection, Integrations, Topical Knowledge, Institutional Knowledge, Tradecraft, and Production, ACTIF enables automated, structured, and scalable threat analysis. Coupled with robust guardrails such as source grounding and forced adversarial reviews, the framework reduces operational risks while ensuring actionable, high-quality intelligence across complex workflows in near-real-time.

The Problem

Cyber Threat Intelligence Analysts can only do one analysis at a time. While many tasks can and are automated as part of Threat Intelligence workflows, the actual analytical tradecraft is something that does not scale.

The job description of a Threat Intelligence Analyst is multi-disciplinary by nature. We expect them to have a thorough technical background: they need to be able to understand most threat types, the tactics and techniques used by adversaries, and apply pivoting skills to be able to map out campaigns, infrastructure and capabilities.

At the same time, we expect our analysts to be trained in and able to employ Structured Analytic Techniques (SATs). The diamond model, kill chains, Analysis of Competing Hypotheses (ACH) are just a few examples. Awareness and the ability to avoid biases, like confirmation bias, is expected, as well as doing a key assumption check, speak and write in proper confidence and likelihood language, and track, grade and apply source reliability and data accuracy.

Then, these skills need to be applied within a context. For most Threat Intelligence Analysts, that context is the organisation they work for and the stakeholders receiving their intelligence products. That means they need, first of all, to thoroughly understand the assets, supply chain, processes, controls, frameworks and structure of their organisation. But they also need to understand the roles and responsibilities of their stakeholders well enough to be able to create actionable products. Then they need to be able to prioritise the right information, understand how it applies within their organisational context, then, after analysis, make sure the intelligence becomes available in a format or formats the stakeholder(s) can use, and do all that fast enough for it to still be relevant.

All that, then, needs to be applied under enormous pressure of a firehose of noise and signal, and of the potential impact of 'getting it wrong'. There is a constant barrage of cyber news, new vulnerabilities and data breaches, new techniques and threat types. Analysts simply cannot apply all their skills and tradecraft to every new threat and event that comes out.

Assumptions and Parameters

While human analytical tradecraft doesn't scale, Artificial Intelligence (AI) and Large Language Models (LLMs) don't offer an immediate solution to the problem either. We can't simply 'ask ChatGPT' to do our analysis for us. One of the most obvious reasons for this is that it doesn't know the inner workings of the organisations we work for, so it is limited in its ability to contextualise any new information that comes in, or even assess it for relevance. It will also be hard-pressed to apply structured analytical techniques, or leverage any of the tools analysts use in their day-to-day work.

Because of those limitations, and because of the risk of hallucination, we can't trust what a simple LLM-prompt would give back to us. On top of the absent knowledge of our organisation and the lack of use of tradecraft, we simply wouldn't be able to use what comes back, because the risk of a hallucinated response is too great.

That risk is what is preventing us from leveraging Artificial Intelligence to overcome the problems with scale and complexity of human Cyber Threat Intelligence Analysis. If we are able to reduce that risk to a level that would make us comfortable using it, then analysts would be able to scale and apply their tradecraft on not just the one investigation they have time for, but across all signal and noise, every report, in near-real-time, and always actionable.

Today's coding agents provide harnesses that can help us leverage agentic models in a way that addresses those limitations. Claude Code, Codex and Cursor are examples of coding agent harnesses that allow for AI-agents to work together in an orchestrated fashion, while deploying specific Skills for specific steps of a particular task.

Agents and skills

Any session with an LLM takes place within a finite context window. The input and output tokens all contribute to that context window, and once it is full (or even when it is close to getting full), that session will not be able to properly work anymore. That means you can't just drop hundreds of reports and instructions into a single session, because the context window will fill up long before you get around to asking specific questions.

That's why agents exist: an agent is, at its core, just an empty context window. You can use it to do a specific thing that doesn't require it to have access to or knowledge of the rest of the workflow it's a part of.

Agents can hold specific information, interact with specific tools, run on a schedule or a trigger, can be spawned multiple times in parallel and orchestrated and, crucially, be front-loaded with very specific 'Skills' to execute their tasks.

This is the core of this framework. By:

• effectively leveraging agents;
• loaded with the appropriate agentic skills;
• harnessed in effective workflows, and;
• using appropriate guardrails

we can reduce the risks to comfortable levels, allowing us to reap the benefits of scale, speed and actionability.

Agent Skills

An Agent Skill is a set of instructions to give an agent capabilities and expertise. Originally developed by Anthropic, there is now an open, standardised format for Agent Skills. An agent can have multiple skills at its disposal, that it may or may not load and use, depending on the need. When an agent is first loaded, it will read the names and descriptions of the skills available to it, so that it knows when to use them. Then, when the agent decides a skill should be used, it reads the initial instructions on how that skill should be used, and, as a third step, follows the instructions and optionally executes code or loads referenced files as it does so.

Agent Skills have the following format:

The SKILL.md file is the only required part of any skill, contains the most important information and consists of 'front matter' and the initial instructions. Front matter is metadata with the name and description of the skill, but can also contain additional information. In a small Skill, the instructions can be self-contained, but they could also contain information on how to leverage the files in the sub-folders of the skill. For example: when and how to use a particular piece of code in the /scripts folder, or when to read a document with more in-depth information in the /references folder.

Categories of Agent Skills for CTI

In Cyber Threat Intelligence, we can define six distinct categories of Agent Skills:

• Collection
• Integrations
• Topical Knowledge
• Institutional Knowledge
• Tradecraft
• Production

Collection Skills

Collection Skills teach an agent how to extract information from a particular source. For example: how to identify named Threat Actors and malware from a news article, or how to extract MITRE ATT&CK techniques described (but perhaps not named) from a report. To do the latter, an agent would require detailed information on the MITRE ATT&CK framework, the T-codes, names, descriptions of all 600+ techniques and sub-techniques. This Skill could, for example, have instructions in its SKILL.md file on when to use the skill to extract ATT&CK techniques, and reference the entire framework, which would be stored in the /references folder of the skill.

Integration Skills

To effectively work with tools and platforms analysts use for enrichment and technical analysis, skills can be leveraged to interact effectively with them. For example: by leveraging skills for working with VirusTotal, URLscan, Shodan, OTX, et cetera, agents can quickly take a single Indicator of Compromise (IOC) from a report or incident and enrich it with more, relevant information. This is not limited to external tools, but could also apply to internally hosted Threat Intelligence Platforms (TIPs), and SIEM and SOAR technology. One prerequisite for this is that those tools expose an API for the agents to use. One significant upside of using well-trained agents for using those tools is that they can be used to the fullest extent of their capabilities. One doesn't have to comprehend all the intricacies and capabilities of VirusTotal, for example, because the agent now knows.

Topical Knowledge Skills

Topical Knowledge skills are similar to Intelligence Requirements, and are essentially knowledge databases on a particular threat topic. They can range from threat types like Infostealers or Exploit Kits, to concepts like 'Cyber Espionage from Russia'. They can hold all the reports and documentation you have on a particular subject in the /references folder, and those can be 'pointed to' (referenced) in the instructions in SKILL.md. For example, in a Topical Knowledge Skill on 'Cyber Threats from Iran', the instructions could include that if the user asks about the structure of the Islamic Revolutionary Guard Corps (IRGC), a specific set of reports should be considered relevant and loaded into context.

Institutional Knowledge Skills

Where Topical Knowledge Skills contain information about specific threats, Institutional Knowledge Skills are loaded with information about the organisation. Think of asset lists, third parties, contractors and suppliers, security controls and attack surface. One could also load names, roles and interests of stakeholders into these skills. It helps contextualise and prioritise every new threat event that comes in. For organisations with more than one distinct Business Unit (BU), but also for Managed Security Service Providers (MSSPs), having an Institutional Knowledge Skill for each BU or customer, allows for Threat Intelligence to go beyond generic reporting that's not particularly relevant to any specific stakeholder, to tailored Intelligence Products that are targeted, relevant and actionable for each recipient.

Tradecraft Skills

Tradecraft skills are the things that human expert analysts have learned to apply when they perform structured analysis. Those techniques exist because humans, like AI-agents, are fallible and subject to biases. These structured techniques allow us to apply rigour and a certain level of objectivity to our work, explore all angles and avoid those biases. Tradecraft also includes review techniques and source evaluation, necessary to make sure quality and accuracy is maintained.

Just like humans need to apply those skills and techniques, we can force AI-agents to leverage them in the same way, but with one critical difference: where human analysts realistically don't have time to apply all their tradecraft to every analysis, agents, with their ability to scale, can apply all the rigour to every single piece of information, analysis and intelligence they process, at every step.

Production Skills

Intelligence products are ultimately only valuable if they reach someone (a stakeholder) who can use that information to either do something differently than they otherwise would have done, or with more confidence that they are doing the right thing. This can be in the form of reports (for humans), technical data in a format machines and tools can read (like STIX, KQL or YARA), or prompts for other agents.

To write quality reports, agents need to know about things like 'Bottom Line Up Front' (BLUF) and confidence and likelihood language, and how to apply them. To write quality detection rules, agents need Skills that teach them how to structure them, or how your tables and indexes are named and structured (for Splunk queries for example). They also need to be made aware of where that information should go, in cases where they are allowed to push detection rules directly to your technology stack.

Workflows and use cases

Together, those skills can be used by agents to perform complex workflows. For example, an analyst could set up a workflow that focuses on reading multiple RSS feeds. With every new article or report, an agent could load a skill to extract IOCs and MITRE ATT&CK Techniques. Then, a check could be performed to determine whether the described threat is relevant to the organisation, and if so, a STIX bundle could be generated, sent to a MISP instance, and a message on Slack could be sent to the relevant stakeholders.

Another workflow could focus on updating the topical knowledge skills. With every new report or article that comes out, an orchestrating agent could determine the topic of the threat that is being described. Potentially relevant topical knowledge skills are loaded to help contextualise the report. At the same time, a skill for assessing the quality of the reporting and the novelty of the information determines whether the new information is valuable and trustworthy enough to be included in the Topical Knowledge Skill itself. If it is, it is loaded into the /references folder and labelled in SKILL.md with the relevant tags, thus self-updating the skill.

Every time a new product is created for a security appliance, like a SIEM, SOAR, or TIP, that product is usually created by a specialised Production Skill. That product then needs to reach the appliance, which happens through an Integration Skill.

Creating a workflow from beginning to end could, for example, look like this:

1. Pull the last 20 events from MISP.
2. Search for overlap with the Diamond Model, which correlates adversary, victim, infrastructure, and capability.
3. Rank the top clusters by relevance to your organisation and by cluster size.
4. Enrich the IOCs through URLscan and export them as a CSV.
5. Formulate at least 3 hypotheses and run an analysis of competing hypotheses (ACH) to determine the most likely one, and the least likely one, and explain why.
6. Create a STIX bundle and write a report on the MITRE ATT&CK techniques used and their relevance to Acme Aviation.
7. Use the devil's advocate and adversarial review technique with a second and third agent.

Put together, that workflow looks like this, with the category of skill the agent loads at each of the seven steps:

Guardrails

As discussed, AI-agents make mistakes when asked to perform Intelligence Analysis tasks. However, this is not a new problem, unique to agents: human analysts are trained to apply structured techniques and be aware of biases and fallacies throughout their analysis process, in order to prevent similar mistakes. Many biases that apply to humans, similarly apply to agents. Confirmation bias is a great example: the tendency to only accept evidence that confirms the hypothesis you already believe to be true: agents display the same behaviour. By applying the same rigour through skills to agents as we would with humans, as well as 3 other techniques, we can reduce that risk to acceptable levels.

Four distinct techniques can be combined to provide guardrails within this framework:

• Force grounding in source material. Assessments must be based on facts, and those facts must come from the source data. Agents are not allowed to 'invent' additional content.
• Use topical knowledge skills for fact-checking. New reporting is evaluated using the topical knowledge skills to determine if the information is accurate, novel and/or likely to be true.
• Apply analytical rigour and bias skills. Skills forbid the agent from stating an assessment as fact, rate the quality of the source and the data, require a confidence level, and require justified logic, which leaves an audit trail. They go through a structured process of analysing data, formulating hypotheses, weighing and presenting them.
• Force adversarial review. Technically also a structured technique: multiple agents running stronger models than the original agent review the entire analytical process, from source to final report. Reviewers who disagree discuss the result or present the disagreement.

Where to find CTI Skills

Liberty91 maintains an open-source community project where CTI-specific skills are developed, shared and peer-reviewed. These skills are publicly available for everyone and CTI practitioners are encouraged to explore and contribute to the project. Details can be found here: liberty91.com/cti-skills.