Operational Efficiency in CTI: A Blueprint for SME's Using Open-Source AI and Cognitive Automation

Operational Efficiency in CTI: A Blueprint for SME's Using Open-Source AI and Cognitive Automation

Speakers: Omar Saenz (Security Specialist, Google), Raquel Guzman (Cloud Security Engineer, Google)

Conference: FIRST CTI Conference

YouTube: https://www.youtube.com/watch?v=EwExNVbiph4

Overview

In the rapidly evolving landscape of cyber threats, small and medium enterprises (SMEs) face an increasingly challenging paradox: they confront the same sophisticated attacks as large corporations but lack the extensive resources, specialized personnel, and substantial budgets to mount an adequate defense. This critical disparity leaves a significant portion of the global economic backbone vulnerable. In their compelling talk at the FIRST CTI Conference, Omar Saenz and Raquel Guzman from Google presented a groundbreaking blueprint designed to bridge this gap, focusing on achieving operational efficiency in Cyber Threat Intelligence (CTI) for SMEs through the strategic application of open-source AI and cognitive automation.

The core of their presentation introduced a novel cognitive system architecture named Threat Body. This system moves beyond traditional CTI toolsets by acting as an "apprentice," capable of absorbing much of the low-level cognitive load typically handled by human analysts. By leveraging accessible, low-cost, and open-source components, including a 12-billion parameter AI model (Gemma), the blueprint aims to empower SMEs with robust threat intelligence capabilities, enabling them to transform raw data into actionable insights and proactively defend against cyber adversaries. Saenz, drawing on his background in cybernetics, emphasized the adaptive nature required for effective defense, while Guzman detailed the ingenious engineering decisions that make this architecture both powerful and economically viable for resource-constrained organizations.

Background

▶ Watch: AI disconnect: SMEs lack human analysts, not tools (2:40)

The prevailing industry narrative over the past two years has heavily promoted AI as the panacea for all threat intelligence challenges. However, Saenz and Guzman identified a significant disconnect: while AI excels at building better tools to accelerate analyst workflows, it fails to address the fundamental problem faced by SMEs – the critical absence of human analysts. Many small companies simply do not have the personnel to operate these advanced tools, rendering the technology ineffective. The problem, they contend, is not a lack of software, but rather a lack of cognitive support for threat intelligence activities.

Statistical evidence underscores this predicament. A study of European SMEs revealed that 43% experienced a cyber attack in the last 24 months. Their inability to defend themselves stems from a severe resource deficit: 46% cannot hire cybersecurity experts, and 31% are blocked by a lack of funds. Furthermore, while the SANS 2025 report indicates that 9% of organizations collect external threat data and 64% utilize it, the speakers highlighted that organizations are "drowning in data," with intelligence often remaining "trapped" and not effectively processed into actionable activities. This points to a systemic failure to convert raw data into meaningful, proactive defense strategies.

To conceptualize a solution, the speakers turned to cybernetics, specifically Ashby's law of requisite variety. This principle states that for a system to control another, it must possess at least as much variety or adaptability as the system it controls. In the context of cybersecurity, attackers operate with adaptive, "closed-loop" feedback mechanisms, constantly evolving their tactics. Conversely, many SME defenses are characterized by linear pipelines: data ingestion, storage, and minimal processing, lacking the crucial stages of planning, decision-making, and adaptive action. The proposed cognitive defense system architecture aims to introduce this requisite variety, enabling SMEs to adapt and respond more effectively.

The vision for this architecture moves beyond seeing a CTI platform as merely a "standard database." Instead, it embodies the concept of an "apprentice" – a system capable of absorbing significant low-level cognitive load. Drawing inspiration from a recent Google DeepMind article on cognitive capabilities for Artificial General Intelligence (AGI), the speakers focused on two key capabilities reliably integrated into their architecture: perception and memory. Perception involves ingesting new threat feeds and reports, while memory encompasses the structured storage and retrieval of intelligence. The ultimate goal is to build a system that not only processes data but also develops an "understanding" of relationships between threat actors, vulnerabilities, and malware, thus building genuine awareness.

Key Findings

▶ Watch: Open-source AI architecture: N8N, LangChain, Gemma, OpenCTI flow (10:00)

The central contribution of this talk is the blueprint for the Threat Body cognitive system architecture, a pragmatic and cost-effective solution designed to empower resource-constrained SMEs in their CTI efforts. This architecture stands out by addressing the critical gap of human analyst scarcity, effectively acting as a virtual "apprentice" team for organizations lacking dedicated cybersecurity personnel.

A key finding is the system's ability to transform unstructured threat intelligence – such as PDF incident reports or blog posts – into machine-readable STIX bundles and knowledge graphs of threat actors, vulnerabilities, and malware. This automated structuring of data is crucial for generating actionable intelligence, overcoming the challenge of being "drowning in data" without the means to process it.

The architecture leverages local, low-cost, and open-source components, making advanced CTI capabilities accessible to SMEs. Specifically, it utilizes Gemma, a 12-billion parameter open-weight model, for its core extraction engine. This choice, combined with strategic cloud infrastructure decisions, demonstrates a significant finding in balancing powerful AI capabilities with stringent cost constraints.

A critical design principle and key finding is the emphasis on cost-efficiency through intelligent cloud resource management. The use of Cloud Run's "scale-to-zero" functionality and request-based billing for the Gemma model, especially when running on expensive Nvidia L4 GPUs, dramatically reduces operational costs from potentially hundreds of dollars per month to just a few. This makes advanced AI processing economically viable for even the smallest enterprises.

Furthermore, the system integrates a human-in-the-loop validation process. Although largely automated, generated STIX drafts are routed to a draft workspace in OpenCTI for analyst review. This crucial step acknowledges the potential for AI hallucinations and ensures the trustworthiness and accuracy of the intelligence before it is committed to the knowledge base and fed into defensive tools. This hybrid approach of automation and human oversight is a vital finding for building reliable AI-driven CTI.

Finally, the speakers highlighted that while the current system excels at perception and memory, the future direction lies in expanding its cognitive capabilities to include planning, reasoning, and execution. This forward-looking finding suggests an evolution towards more autonomous and adaptive defense mechanisms, moving beyond mere data processing to proactive strategic responses, aligning with the cybernetics principle of requisite variety.

Technical Deep Dive

▶ Watch: Cost-efficient AI: Gemma scales to zero on Cloud Run (16:00)

The Threat Body architecture is a sophisticated yet accessible cognitive system designed with six primary components: Ingestion, Extraction, OpenCTI, Storage/Persistence, External Surface, and Human-in-the-Loop. This blueprint integrates a suite of open-source tools and cloud services, primarily within Google Cloud Platform (GCP), to create a highly efficient and cost-effective CTI pipeline.

The process begins with Ingestion, which is human-triggered. When an analyst identifies a relevant piece of unstructured threat intelligence—such as an incident report in PDF format, a blog post, or a technical article—it initiates the workflow. This content is pushed via a webhook to N8N, a self-hosted workflow orchestration and automation tool, analogous to Zapier but tailored for technical teams. N8N serves as the entry point, receiving the input and orchestrating its subsequent processing.

From N8N, the data is pushed to a LangChain service, which is deployed on a GKE Autopilot cluster within GCP. LangChain acts as the processing and extraction engine. It constructs specific prompts tailored for the AI model and then calls Gemma, Google's open-weight, lightweight 12-billion parameter model (specifically Gemma 3 at the time of the talk, with Gemma 4 being a newer release). Gemma is strategically run on Cloud Run, GCP's serverless compute platform. This is where the "magic" of transformation occurs: Gemma performs structured inference, converting the unstructured content into a STIX bundle draft.

The choice of Cloud Run for Gemma is a critical architectural decision driven by cost-efficiency. While other components run on Kubernetes (GKE), running Gemma on Cloud Run allows it to scale to zero. This means that when the model is not actively processing requests, the compute instance, which utilizes expensive Nvidia L4 GPUs, is shut down. This functionality dramatically reduces costs; the speakers cited test usage costing approximately $2-3 per month with scaling to zero, compared to an estimated $500-700 per month if the compute instance were always active. Additionally, Cloud Run employs request-based billing, where users pay only for 100 milliseconds of compute time, rather than full hours, further optimizing expenses. To enhance efficiency, Gemma's model weights are stored in a Cloud Storage bucket and mounted directly onto the container using GCS fuse, allowing the bucket to be treated as a local directory during cold starts.

Once Gemma generates the STIX bundle draft, it is sent from the LangChain service to the OpenCTI core API. OpenCTI, an open-source threat intelligence platform, is a central component for managing and visualizing CTI. Within OpenCTI, the intelligence is routed via RabbitMQ, processed by Python workers, and finally indexed using Elasticsearch.

The architecture also includes dedicated Storage and Persistence layers: Redis for caching and event streaming, Elasticsearch for efficient indexing of intelligence data, and MinIO for object storage of files. The entire infrastructure, including OpenCTI components, LangChain, and N8N, is provisioned via Terraform. Configuration changes are managed using Helm and Helmfile, and continuous integration/continuous deployment (CI/CD) is handled by GitHub Actions across three distinct pipelines (Terraform deployments, Helm configurations, and application deployments), adhering to a GitOps model where the repository serves as the single source of truth.

A crucial aspect of the Threat Body is the Human-in-the-Loop component. The STIX bundle generated by Gemma is not immediately committed to the knowledge base. Instead, it is pushed to a draft workspace within OpenCTI. This allows a human analyst to review the automatically generated intelligence, validate its accuracy, and check for potential hallucinations or incomplete relationships (SROs). This validation step is critical for maintaining trust in the AI-generated intelligence. To ensure the integrity of the output, a Pydantic schema is applied. This schema restricts and constrains the information, enforcing the correct STIX structure and preventing the model from generating malformed or invalid data before it can modify the schema. This proactive validation helps mitigate the risks associated with LLM outputs.

Finally, the validated and committed STIX bundle from OpenCTI feeds into external security tools, such as a SIEM (Security Information and Event Management) or EDR (Endpoint Detection and Response) system. This integration ensures that the newly acquired, structured threat intelligence can be immediately leveraged for proactive defense, detection, and response actions, completing the intelligence lifecycle for the SME.

Demo / Proof of Concept

▶ Watch: Future CTI: Planning is the missing cognitive capability (23:20)

While the presentation did not feature a live, interactive demonstration of the Threat Body system in action, it thoroughly detailed the architectural flow and showcased the results of its operation. The speakers walked the audience through the conceptual journey of an unstructured threat report being transformed into actionable intelligence.

Specifically, the "Demo / Proof of Concept" aspect was primarily conveyed through a detailed explanation of the system's pipeline and the resulting output. The presentation included a visual representation and discussion of the draft workspace capability within OpenCTI. This workspace is where the AI-generated STIX bundle draft lands after processing by Gemma and LangChain. The speakers described how this draft, containing structured information about threat actors, vulnerabilities, and relationships, is presented for human review.

The emphasis was on the functionality of this draft workspace: allowing an analyst to validate the AI's output, check for accuracy, and ensure there are no hallucinations before committing the intelligence to OpenCTI's primary knowledge base. This clearly illustrated the system's ability to produce structured CTI from raw inputs and the critical role of human oversight in the process. Although a real-time, click-by-click demonstration was not part of the talk, the detailed architectural breakdown and the explanation of the OpenCTI draft output effectively served as a conceptual proof of concept for the system's capabilities and its intended operational flow.

Defensive Implications

▶ Watch: Q&A: STIX normalization and preventing AI hallucinations (29:50)

The Threat Body blueprint offers profound defensive implications, particularly for small and medium enterprises grappling with limited resources. Its primary impact is the democratization of advanced CTI capabilities, enabling SMEs to build a robust defense posture previously accessible only to large organizations.

Firstly, the system provides automated threat intelligence processing. By transforming unstructured data (PDFs, blog posts) into machine-readable STIX bundles and knowledge graphs, it drastically reduces the manual effort and specialized expertise required to extract actionable intelligence. This is critical for SMEs that lack dedicated CTI analysts, effectively providing an "apprentice" that handles the cognitive load of data parsing and structuring. This automation allows for a faster and more consistent ingestion of external threat data, enhancing situational awareness.

Secondly, the architecture promotes proactive defense. Once validated, the structured intelligence can be seamlessly fed into existing SIEM or EDR tools. This integration allows for automated detection rules, enhanced correlation, and more informed incident response, moving SMEs beyond reactive defense to a more anticipatory security posture. It enables them to identify and block threats that align with known indicators of compromise or attack patterns described in the ingested intelligence.

Thirdly, the focus on cost-efficiency through open-source tools (OpenCTI, N8N, LangChain) and intelligent cloud resource management (Cloud Run's scale-to-zero, request-based billing) makes advanced CTI economically viable. This removes a significant barrier for SMEs, allowing them to allocate their limited budgets to other critical security areas while still benefiting from a sophisticated threat intelligence pipeline. The cost savings enable continuous operation and scalability without prohibitive expenses.

Fourthly, the human-in-the-loop validation process is a critical defensive measure against AI hallucinations and inaccuracies. By requiring an analyst to review and approve AI-generated STIX drafts in OpenCTI's draft workspace, the system builds trust and ensures the integrity of the intelligence. This hybrid approach mitigates the risks associated with fully autonomous AI, preventing the introduction of false positives or erroneous data that could lead to misconfigurations or ineffective defenses.

Finally, this blueprint represents a fundamental shift from linear, reactive defense pipelines to a more adaptive and cognitive security system. By incorporating principles from cybernetics, the Threat Body aims to evolve beyond mere perception and memory to include future capabilities for planning, reasoning, and execution. This long-term vision suggests a defensive system that can dynamically adapt to attacker tactics, generate strategic responses, and ultimately match the "requisite variety" needed to control a dynamic threat landscape. It offers SMEs not just a product, but a design pattern to build their own resilient CTI capabilities.

Key Takeaways

• Automated Intelligence is Essential, but Not Sufficient: While automation significantly reduces the toil of CTI analysts and is crucial for resource-constrained SMEs, true "intelligence" – encompassing planning, reasoning, and adaptive decision-making – remains an ongoing challenge that current AI models are still evolving to address comprehensively.
• Hybrid AI for Cost and Power Efficiency: The blueprint demonstrates the power of combining open-source tools with intelligent cloud architecture choices (e.g., Cloud Run's scale-to-zero and request-based billing for expensive GPU-backed models) to achieve a powerful CTI system that remains highly cost-effective and accessible for SMEs.
• Human-in-the-Loop is Non-Negotiable for Trust: Despite advanced automation, human validation of AI-generated threat intelligence (e.g., reviewing STIX drafts in OpenCTI's draft workspace) is critical to prevent hallucinations, ensure data accuracy, and build trust in the system, especially given that LLMs can be sources of attacks or payload injections.
• SMEs Need Design Patterns, Not Just Products: Instead of merely buying off-the-shelf security products, SMEs benefit immensely from adaptable, open-source blueprints and design patterns that allow them to build tailored CTI capabilities aligned with their specific needs and budget constraints, fostering self-sufficiency.
• The Future of CTI is Adaptive and Cognitive: Moving beyond linear data processing, the vision for CTI involves creating cognitive systems that can perceive, learn, remember, and, crucially, plan and reason. This adaptive capability, inspired by cybernetics, is necessary to counter the rapidly evolving and adaptive nature of cyber adversaries.
• Open-Source Empowers the Under-Resourced: Leveraging a wealth of open-source projects (OpenCTI, N8N, LangChain) and accessible AI models (Gemma) provides a viable pathway for small and medium organizations to establish sophisticated threat intelligence operations without requiring deep expertise or prohibitive financial investment.

About the Speaker(s)

Omar Saenz is a Security Specialist at Google. His foundational background is in cybernetics, which is the interdisciplinary study of how systems, machines, and humans interact and adapt to each other. This perspective heavily influences the cognitive system architecture he co-presented, emphasizing adaptive control and feedback loops in cybersecurity.

Raquel Guzman is a Cloud Security Engineer at Google. She specializes in scaling secure infrastructure. Her expertise was instrumental in engineering the cost-efficient and scalable cloud architecture underpinning the Threat Body system, particularly the strategic use of GCP services like Cloud Run and GKE Autopilot to balance performance with economic viability for SMEs.