The Threat Lifecycle : How much do you actually know about the threats sitting inside your business right now? For many leaders, that is not an easy question to answer. The challenge is not a lack of attention, but the way intelligence is often gathered and reported. In many organisations, the focus remains on what is already visible and measurable, while emerging signals receive far less attention.   One of the most common misconceptions about risk is that serious incidents appear suddenly. Threats tend to follow a lifecycle. They begin as small indicators, isolated vulnerabilities, behavioural changes or external developments that may seem insignificant on their own. Over time, these signals accumulate, interact, and evolve. What appears to be a crisis is often the final stage of a process that has been unfolding for weeks, months, or even years.  There is a pattern that emerges repeatedly across both the public and private sectors. By the time a risk reaches the agenda, it has often progressed through several stages of development. The information existed somewhere within the organisation, or just outside it, but it was never connected, contextualised or escalated.   AI-enabled adversaries increased by 89% over the past year, accelerating the speed and scale at which intelligence can be gathered and exploited. As threat lifecycles continue to compress, organisations have less time to identify risks, understand their significance and take meaningful action. The warning signs are often there long before the incident itself; the challenge is recognising them early enough to intervene. The six stages that change everything Julie Nel’s approach at B4 Secure is built around a six-stage threat intelligence lifecycle, a continuous process designed to transform raw threat data into something a business can act on.   The goal is intelligence that answers the question every leader genuinely needs answered: what does this mean for us, right now?  Here is a detailed explanation for the threat intelligence lifecycle:  01: Horizon Scanning Working with business stakeholders to define what the threat intelligence programme is trying to protect. This means identifying critical assets, understanding what disruption to those assets would cost the business, and setting clear priorities before any data is collected. 02: Data Refining and Corroboration Gathering raw threat data from internal security logs, open-source intelligence, and deep and dark web monitoring. The breadth of collection matters enormously here, as threats that live in the unindexed corners of the internet are completely invisible to organisations that only monitor the surface. 03: Advance Analysis and Assessment Sorting, decrypting, and formatting the raw data to remove false positives and redundancies. This is the stage that separates background noise from signals worth paying attention to, and it requires both technology and human judgement working together rather than either one in isolation.  04: Strategic Threat Assessment Investigating processed data to identify patterns, anomalies, and active threats. This is where context is applied, understanding not just what a piece of intelligence says, but what it means for a specific organisation, its people and its supplier network in practical terms.  05: Dissemination Strategy Distributing finalised, contextualised intelligence to the right audience at the right time. Whether that is a technical team needing granular detail or a leadership team needing a clear picture of organisational risk, the format and language has to match the people receiving it.  06: Decision-Making and Response Evaluating what intelligence delivered, where gaps existed and what needs to change in the next cycle. This is what makes the lifecycle continuous rather than a one-off exercise, and it improves with every iteration, staying aligned with how the threat landscape is shifting around the business.  “We need to move beyond security echo chambers. Resilience is not something that lives in the IT department. It belongs to every part of a business, from HR to procurement to the boardroom.” –  Julie Nel, Founder and CEO, B4 Secure  The organisations best placed to manage risk are not necessarily those with the strongest response capabilities once things go wrong. They are the ones that understand what a threat looks like before it reaches its final stage, because by the time it does, the lifecycle has already run its course.  It does not wait for a business to be ready. The question is never whether the signals were there? Is it whether anyone was looking? That is what B4 Secure is built to do.  B4 Secure combines advanced technology with human intelligence to help organisations stay ahead of threats before they become incidents. Find out how the team can support your business. 

A Decade of Intelligence: What Ten Years of B4 Secure Has Taught Us About Organisational Resilience When B4 Secure was founded in 2016, the world was already changing but few could have predicted quite how fast, how connected, and how unforgiving the next decade would become. Ten years ago, many organisations still viewed security, intelligence and resilience as separate disciplines. Security protected assets. Intelligence informed decisions. Resilience sat somewhere in the business continuity plan, often reviewed annually and tested occasionally. Risk registers were important, but frequently static. Threat assessments were commissioned around a specific event, location, person, journey or concern. Cyber was often treated as a technical problem. Supply chains were largely assessed through cost, efficiency and delivery. Then the world reminded us that risk does not respect organisational charts and dashboards. Over the last decade, leaders have had to navigate Brexit, regulatory transformation, terrorist attacks, cyber escalation, geopolitical instability, COVID-19, war in Ukraine, sanctions, supply-chain disruption, energy insecurity, economic volatility, protest activity, disinformation, deepfakes, AI-enabled threats and a growing expectation that organisations must not only respond to harm, but anticipate it. The lesson is clear: resilience is no longer about whether an organisation can recover from disruption. It is about whether it can understand the environment early enough to make better decisions before disruption becomes crisis. That is where intelligence matters. From information to intelligence One of the most significant shifts over the last ten years has been the sheer volume of information available to organisations. Leaders are not short of news, alerts, dashboards, notifications, data feeds or reports. In many cases, they are overwhelmed by them. But information is not intelligence. Information tells us something has happened. Alerts tell us something has changed. Intelligence tells us why it matters, who it affects, what may happen next and what decisions should follow. That distinction has shaped B4 Secure’s work from the beginning. Our focus has never been simply to collect information. It has been to interpret it. To assess it. To challenge it. To ask the question that sits at the heart of good intelligence practice: so what? So what for the organisation? So what for the board? So what for employees, operations, reputation, supply chains, clients, assets, events, travel, executives or vulnerable individuals? So what needs to happen now? The last decade has shown that the organisations best able to withstand disruption are not always those with the largest budgets or the most complex systems. They are often the ones with the clearest view of the threat environment and the confidence to act early. The decade that changed organisational risk The period from 2016 to 2026 has been a decade of compounding risk. Brexit changed the political, regulatory and trading environment for UK organisations and their international partners. Between the referendum in 2016 and exit in 2020, it forced businesses to think differently about borders, supply chains, labour, legal frameworks, customs, contracts and operational dependencies. The terrorist attack at Manchester Arena in 2017, and the Inquiry that followed, also changed the national conversation around protective security. One of the enduring lessons was not simply that organisations need security plans. It was that they need credible, current and event-specific assessments of threat, vulnerability and mitigation. Generic risk assessments, assumptions, box-ticking and passive awareness are not enough when the threat environment is dynamic. The Manchester Arena Inquiry highlighted the importance of risk assessment, hostile reconnaissance awareness, security perimeters, CCTV, patrols, communication and clear responsibility. For those of us working in intelligence and protective security, the lesson was stark: assessment is not paperwork. It is a discipline. It is the process through which threat becomes understood, vulnerability becomes visible and action becomes possible. The arrival of GDPR and the Data Protection Act 2018 changed how organisations thought about personal data, privacy, accountability and digital responsibility. Data was no longer simply an asset; it became a regulated responsibility. For intelligence and investigative work, this reinforced the importance of lawful, ethical and proportionate collection, assessment and reporting. The COVID-19 pandemic then transformed resilience from a boardroom concept into a lived operational reality. Almost overnight, organisations had to understand exposure, workforce safety, continuity, supply-chain fragility, online working, fraud risk, misinformation, travel restrictions and fast-changing public policy. It exposed a difficult truth: many organisations had plans, but not all had resilience. The blockage of the Suez Canal in 2021 gave the world a visible lesson in supply-chain dependency. One vessel, one waterway, and global trade felt the impact. It was a reminder that resilience is not only about what happens inside an organisation. It is also about the invisible networks on which that organisation depends. Russia’s full-scale invasion of Ukraine in 2022 changed the European security landscape and brought geopolitics back into the centre of corporate risk. Sanctions, energy markets, food security, cyber activity, protest, disinformation, physical security and reputational exposure all became board-level concerns. For many organisations, geopolitics stopped being something discussed by foreign policy specialists and became something that affected procurement, investment, operations and people. From 2023 onwards, the Israel-Gaza conflict and Houthi attacks in the Red Sea reinforced the vulnerability of maritime trade and critical routes. Shipping diversions, insurance costs, delays and uncertainty created further pressure on global supply chains. For businesses, the lesson was not simply that supply chains can be disrupted. It was that regional conflict, maritime security, political intent and commercial exposure can become operational problems very quickly. By 2026, the Iran, US and Israel crisis, and the severe disruption around the Strait of Hormuz, provided another powerful reminder of chokepoint risk. A strategic waterway thousands of miles away can influence energy prices, shipping routes, insurance, manufacturing, logistics, inflationary pressure and board-level decision-making. This is why geopolitical intelligence can no longer be treated as background context. It is increasingly central to organisational resilience. At the same time, cyber risk matured from an IT issue into an organisational resilience issue. Ransomware, supply-chain compromise, credential theft, hostile state activity and attacks on critical infrastructure demonstrated that digital incidents can rapidly

Why Intelligence Matters More Than Ever in the Computer says Yes world! Why Intelligence Matters More Than Ever in the Computer says Yes world! There’s no shortage of information in the world anymore.If anything, we are overwhelmed by it.As technology continues to advance at extraordinary speed, with AI now capable of generating reports, summaries, analysis, forecasts, and commentary within seconds, the volume of information surrounding us has become almost relentless. Every day we are presented with breaking news alerts, dashboards, feeds, AI-generated summaries, commentary, opinion, analysis, speculation, and endless streams of content competing for attention. And somewhere amongst all of that noise, organisations are still trying to answer some very simple questions: What does this actually mean for us?  What matters most?  What do we need to pay attention to?  What decisions do we need to make differently? That’s because information and intelligence are not the same thing. And after spending decades working across military, law enforcement, intelligence, and corporate environments, this distinction is something I care deeply about.I am incredibly proud to call myself an intelligence professional. For me, intelligence has never been about collecting the most information. It has always been about creating clarity. It is about context, assessment, judgement, and helping decision-makers understand risk in a meaningful and usable way. Good intelligence should reduce uncertainty.  It should support resilience.  It should answer “so what?” If it doesn’t do that, then in my view, it risks becoming noise. One of the greatest modern business risks might actually be people mistaking information for intelligence. Or worse… mistaking AI confidence for accuracy. Because just because something arrives in a beautifully designed dashboard with graphs, summaries, trend lines, and a confidence score attached to it, does not automatically make it right. Sometimes it simply means the machine has become extremely committed to being wrong. Over the years at B4 Secure, my team and I have supported global corporates, government organisations, SMEs, and individuals operating in increasingly complex environments. Across all of those engagements, one issue appears again and again: people are overloaded with information but under-supported with genuine intelligence. That became one of the driving reasons behind the creation of S.C.O.P.E. S.C.O.P.E — Strategic Continuous Open-Source Protection & Evaluation — has been designed to make high-quality, contextualised intelligence more accessible across different levels of need, budget, and experience. But importantly, this is not about pushing out raw feeds or simply repackaging headlines. It is about assessed intelligence. It is about combining experienced analysts, intelligence professionals, investigators, and technical specialists with evolving technology to deliver something genuinely useful. Because while technology is advancing rapidly, I firmly believe the future of intelligence is not human OR machine. It is human expertise enhanced by technology. And that distinction matters. Because despite the incredible pace of AI advancement, there are still significant risks in relying on technology without experienced human oversight. One of the challenges we increasingly see within AI-supported analysis is the appearance of confidence without contextual understanding. Large language models can generate remarkably convincing outputs, structured reporting, assessments, and recommendations — but that does not automatically make them accurate. In one internal test scenario, an AI system confidently assessed that all commercial shipping transiting through the Strait of Hormuz was now subject to a substantial new toll structure legally being enforced by the US and Iran in some form of peace negotiated partnership agreement ( don’t get me wrong I saw how it got to this conclusion but that not the point) It then proceeded to build layers of reporting, implications, and projected impacts around an entirely incorrect premise. Even when challenged repeatedly, it continued attempting to justify the original assessment rather than stepping back and reassessing the underlying assumption. It was a typical example of an AI hallucination – it was generating false, misleading, or completely made-up information, while confidently presenting it as factual! ( we’ve all heard ‘fake it till you make it’ well this is basically AI’s default mantra) For me, it perfectly captures both the extraordinary strengths and the very real limitations of AI within intelligence environments. The technology is powerful. The speed is transformative. The opportunities are enormous. But without context, professional judgement, validation, and experienced analytical oversight, there is still significant potential for misinformation, false confidence, and poor decision-making. That is precisely why as intelligence professionals, we must remain so passionate about maintaining the human layer within intelligence analysis. Technology should support intelligence professionals, not replace critical thinking. That belief is also one of the reasons behind the creation of AI Synthesis, a sister company to B4 Secure focused on advancing our AI and technical capabilities to support the future of intelligence-led services and analysis. We have some incredibly exciting work happening behind the scenes at the moment, including collaborative innovation work that I look forward to speaking more about in the near future. For now, I’ll simply say that I believe we are entering a transformational period for intelligence development, OSINT capability, and risk analysis. But even as technology evolves, some principles should never change:  trust, credibility, validation, context, ethics, and professional judgement. That matters enormously to me.I also wanted S.C.O.P.E to become something more than simply a subscription service. I wanted it to become part of a wider intelligence community. One of the things I thoroughly enjoy is supporting early-career professionals, students, and those who are curious about intelligence but may never previously have had exposure to the profession in a meaningful way. Intelligence can open doors.  It teaches critical thinking.  It strengthens understanding.  It helps people interpret the world differently. And in a world increasingly shaped by misinformation, manipulation, geopolitical instability, cyber threat, and rapidly changing risk landscapes, those skills matter more than ever. Through S.C.O.P.E, I want people to not only access intelligence, but engage with it. I want subscribers to contribute ideas, publish articles, discuss emerging risks, challenge thinking, and become part of an evolving professional community that values thoughtful analysis and good practice. Once subscribed, users will have access not only

The Gap Between Information and Intelligence: And Why It’s Costing You If It Isn’t Answering ‘So What?’ Right now, I’m supporting clients to remain resilient in a noisy, fast-moving threat environment. That means continuously monitoring the events and conditions that will impact them — their threat landscape. But monitoring alone isn’t the job. And this is where a lot of intelligence provision goes wrong. Too often, ‘intelligence’ means a busy CRO, COO or Security Director receiving a daily or weekly information dump — a 1 or 20-page report of curated headlines — labelled ‘insights’ with a cheerful: “well, over to you guys, there’s your intel.” That. Is. Not. Intelligence. And it’s about as useful as that gym subscription you pay for every month and never actually use. You’ve watched Sky News. You already know there’s something kicking off. What you need to know is what it means for ‘you’ — specifically, right now. The ‘So What?’ Problem Take the Middle East. Many of our clients know things are escalating. They know it’s going to bite their operations. But the sheer volume of reporting and noise around it is sending stress levels through the roof — without answering anything useful. Ask yourself honestly — whether you’re the one giving or receiving intelligence — what is this reporting actually answering? What problem is it solving? What risk is it mitigating? What critical incident is it helping to prevent? What strategy is it informing? If you can’t answer those quickly and simply, you’re back to the gym membership. Why This Matters More Than Ever for Supply Chains Supply chain modelling is more imperative now than at any point in recent memory. But businesses cannot mitigate risk or build strategy if the intelligence informing their decisions is just repackaged news. Have you been receiving reporting on oil shortages, for example? Great — but what are you ‘doing’ with it? How are you turning information into intelligence? The difference between information and intelligence is the ‘so what’. And that ‘so what’ needs to be tailored to your organisation, your risks, your dependencies. Key Judgments: Your BLUF (Bottom Line Up Front) in Action Here’s an example. A recent client report we produced included a solid piece of general information about regional disruption — useful context, but on its own, just information. What turned it into intelligence was the analysis and assessment presented as Key Judgments (KJs) and recommendations: Key Judgement (KJ): Within two months, your supply of A, B, and C components will be critically reduced. Recommendations: Activate alternative routing plans immediately Review and secure war risk insurance Assess all Gulf-dependent supply chains Identify and onboard alternative suppliers Conduct a rapid review of critical dependencies Brief COO and Board After reading it laid out this way, the response is often: “That’s not rocket science.” And it’s not. It’s simple, clear intelligence. But before it was just noise and stress. Your intelligence provider should know your business. They should understand your risks. They should be able to give you your KJs and early recommendations quickly — and yes, you are your organisation’s expert who will add depth and nuance. But intelligence gives you a head start. The early warning, that almost certainly prevents loss — and, critically, it gives you advantage. Being Intelligence-Led: It’s Not Just for Sun Tzu Fans Since January, demand for quality intelligence has been spiraling upwards. Clients are hungry — not for information, but for intelligence. They want probability. They want modelling. They want to know the actual and forecasted impact on their operations – They want to be intelligence-led. There’s a reason The Art of War has been translated into business for centuries. It’s logical. Ignore it at your peril. General information i.e. OSINT scraping still has value. But only if the person handling it has the time and expertise to translate it into something meaningful for the organisation. If not — we’re back to noise. However, when it’s properly assessed, contextualised, and tailored — it becomes incredibly powerful. How to Present Intelligence That Actually Gets Used Details matter — always include them. But lead with Key Judgments. Use a probability yardstick so decision-makers can understand likelihood at a glance. Your KJs are your exec summary — your Bottom Line Up Front (BLUF). Make it one page.  Make it visual if needed. An infographic can work. The critical word is ‘bespoke’: tailored to them, easy to brief from, and easy to plug directly into their risk register and operational planning. So, Back to the Original Question… What have the intelligence team ever done for us? They give you: Clarity Early warning Better decisions Reduced risk Competitive advantages And perhaps most importantly… the answers to those absolute corkers of questions your CEO or Chair ambushes you with mid-meeting after hearing something alarming on the radio. This is exactly the thinking behind how we deliver S.C.O.P.E – our in-house threat monitoring platform subscription service. SCOPE, delivers intelligence supported by both advanced automation and expert human analysis. Not as a volume of reporting but as structured, decision-focused intelligence that answers the “so what?” clearly and consistently. We’ll be sharing more on this soon, so keep watching B4 Secure. Oh, and of course… don’t forget the wine – they gave us wine. 🍷 😉 The Gap Between Information and Intelligence: And Why It’s Costing You If It Isn’t Answering ‘So What?’ Right now, I’m supporting clients to remain resilient in a noisy, fast-moving threat environment. That means continuously monitoring the events and conditions that will impact them — their threat landscape. But monitoring alone isn’t the job. And this is where a lot of intelligence provision goes wrong. Too often, ‘intelligence’ means a busy CRO, COO or Security Director receiving a daily or weekly information dump — a 1 or 20-page report of curated headlines — labelled ‘insights’ with a cheerful: “well, over to you guys, there’s your intel.” That. Is. Not. Intelligence. And it’s about as useful as that gym subscription you pay for every month and never actually use. You’ve watched Sky News. You already know there’s something kicking off. What you need to know is

Cyber Essentials Plus Renewed B4 Secure has successfully renewed its Cyber Essentials Plus certification for another year.  We work with high-value and high-profile clients, often in sensitive environments where trust matters. How we manage our systems, control access to information and maintain internal processes all contribute to the overall integrity of our business.  Cyber Essentials Plus, backed by the National Cyber Security Centre, provides independent technical verification that essential security controls are working effectively. It tests whether our core measures such as secure configuration, access management, and regular software updates are properly maintained.   This assessment matters to us every year because it provides evidence of our ability to maintain secure, resilient systems.  For SMEs, this is particularly relevant. Smaller organisations are often targeted because they sit within broader ecosystems. Cyber Essentials Plus is not simply a defensive measure; it is a signal of maturity, credibility and readiness to operate within higher-value networks. It provides a structured and accessible framework that strengthens protection while supporting business growth.  We encourage other SMEs to consider this step and if you would like to understand the process or what it involves in practical terms, we are always open to sharing our experience. 

*Source: National Cyber Security Centre* Cyber Essentials Supply Chain Playbook by the National Cyber Security Centre Supply chains are increasingly where organisational assurance is tested. According to the National Cyber Security Centre, only 14% of firms are on top of the potential risks faced by their immediate suppliers, a gap that becomes harder to manage as supply chains grow larger and more complex.   The Cyber Essentials Supply Chain Playbook is a practical response to this challenge. It sets out clear, actionable steps organisations can use to understand their supplier landscape, define proportionate requirements, and apply them consistently. Tools such as the IASME Supplier Check and the Playbook’s communication guidance help organisations turn intent into practical action.  Cyber Essentials sits at the centre of this approach. From our own experience achieving and renewing Cyber Essentials Plus, its value lies in the practical measures it introduces across an organisation. The controls are clear, proportionate, and focused on getting the fundamentals right, giving organisations and their suppliers a shared baseline.  The NCSC guide brings this together in a way that is both actionable and accessible. By focusing on supplier profiling and ongoing visibility rather than one-off checks, it gives organisations a clear framework they can return to as their supply chains evolve, supporting clearer decisions, expectations, and assurance. 

The Supply Chain Security Webinar 2025 A fantastic discussion at The Supply Chain Security Webinar 2025! Our founder Julie Nel MA, CSyP, FSyI teamed up with Hayley Elvins CSyP FSyI, and Richard Mackintosh to bring their expertise and honesty to the table. From tackling unseen supplier risks to building real resilience through collaboration, the insights shared were eye-opening. A special thanks to Jules Parke-Robinson for brilliantly moderating the session and keeping the conversation flowing.

Our Founder Julie Nel recognised for her contribution to the industry at the 2025 Women in Security Awards Over the last 37 years that she has dedicated to the industry, Julie has always gone beyond her own professional commitments to support and develop the security sector. Whether it is her role as the Chair of The Security Institute, her efforts in empowering female leaders through London Chamber of Commerce and Industry’s Women in Business Advisory Board, or mentoring upcoming talents – Julie inspires us all to do more for our community. 

CSSC Charity Dinner 2025 We took some of our team and guests to the CSSC Charity Dinner— the energy, the people, the cause — everything was incredible! Our table was a popular one with our OSINT Specialist, Dan McNulty, winning a raffle prize, one of our guests taking home a hamper, and another making a successful bid in the auction! What made the evening particularly meaningful was knowing that all proceeds went to Our Safer City, the City-based initiative and consortium focused on preventing violence against women and girls and domestic abuse.