Is the biggest CTI bottleneck no longer collection, but structure?
Source Reddit ThreatIntel
Discussion
This content discusses a perceived bottleneck in cyber threat intelligence (CTI) shifting from data collection to the structuring of that data. It highlights an open research project, TI Mindmap Hub, which aims to transform unstructured OSINT threat reports into structured intelligence formats such as STIX 2.1 bundles, ATT&CK mappings, and knowledge graphs to improve machine reasoning and analysis. The project also supports AI agent queries via an MCP server. This is a discussion and research initiative rather than a direct security vulnerability or threat.
r/threatintel (opens in a new tab)u/F0rm4t-SecRun0 points0 comments
I don't think the biggest bottleneck in threat intelligence is collection anymore.
It's structure.
We're publishing hundreds of excellent threat reports every week, but most of them remain documents. Humans can read them, but machines struggle to reason across them.
I've been exploring a different approach through an open research project called TI Mindmap Hub.
The idea is to automatically transform public OSINT reports into structured intelligence, including:
- STIX 2.1 bundles
- ATT&CK mappings
- IOC extraction and correlation
- Diamond Model & Attack Flow diagrams
- Knowledge Graph relationships across reports
- 5W root-cause analysis
The project also exposes an MCP server, so AI agents can query the CTI knowledge graph instead of relying only on unstructured text.
Every week I publish a threat intelligence brief generated from the latest corpus of analyzed reports, explaining both the findings and how the structured data helps identify broader trends.
Platform: https://ti-mindmap-hub.com/
Latest weekly brief: https://medium.com/ti-mindmap-hub-research/ti-mindmap-hub-weekly-threat-brief-issue-23-2dcf79fface7
I'm curious how others are approaching this.
- Are you using AI agents or LLM workflows to process threat reports today?
- If so, what has worked well, and what has failed?
- Do you think MCP (or similar protocols) is the right direction for exposing CTI to AI assistants?
- If anyone is interested in collaborating, this is an open research effort rather than a commercial product. I'd love feedback, ideas, or contributions from the community.