Uploaded August 2026 | Updated September 2026, 21 minutes ago
Eli Woodward (Team Cymru, US)
Organizations routinely rely on annual IR and threat‑intelligence reports to guide strategy and prioritize security investments. Yet across the industry, these reports frequently contradict one another on the top intrusion vectors, dominant attacker behaviors, and definitions of common categories such as credential misuse. These contradictions do not reflect attacker volatility; they stem from structural bias in each vendor’s data‑collection pipeline.
This session presents an empirical comparison of major public IR/TI reports, shows how intake pathways and telemetry footprints shape what each vendor “sees,” and offers a practical framework for interpreting vendor reports as partial lenses rather than authoritative truth. Attendees will learn how to normalize conflicting data, reduce mis‑prioritization in their IR programs, and push for shared taxonomies that improve collective situational awareness.
---
Eli Woodward is a Senior Threat Intelligence Advisor with 20+ years in law enforcement and private-sector security and a Master’s in Intelligence Studies. He helped build regional cyber intel reporting at Maricopa County and spent four years with Zelle. He is active in the Phoenix security community supporting CactusCon.
Eli Woodward (Team Cymru, US)
Organizations routinely rely on annual IR and threat‑intelligence reports to guide strategy and prioritize security investments. Yet across the industry, these reports frequently contradict one another on the top intrusion vectors, dominant attacker behaviors, and definitions of common categories such as credential misuse. These contradictions do not reflect attacker volatility; they stem from structural bias in each vendor’s data‑collection pipeline.
This session presents an empirical comparison of major public IR/TI reports, shows how intake pathways and telemetry footprints shape what each vendor “sees,” and offers a practical framework for interpreting vendor reports as partial lenses rather than authoritative truth. Attendees will learn how to normalize conflicting data, reduce mis‑prioritization in their IR programs, and push for shared taxonomies that improve collective situational awareness.
---
Eli Woodward is a Senior Threat Intelligence Advisor with 20+ years in law enforcement and private-sector security and a Master’s in Intelligence Studies. He helped build regional cyber intel reporting at Maricopa County and spent four years with Zelle. He is active in the Phoenix security community supporting CactusCon.
