In under 1.5 years, Cyber Threat Intelligence (CTI) at Dutch Railways (NS) matured from a startup capability into an independent function delivering timely, actionable insights to anticipate and counter cyber threats. Positioned independently from the SOC, CTI serves as the ‘sun’ at the center of NS’s security ecosystem, providing energy and input to multiple domains – such as SOC, cybersecurity architecture & risk, and corporate security. This session shares our rapid ‘zero to mature’ CTI journey through three practical use cases, demonstrating how CTI accelerates and strengthens key security processes. You will learn concrete lessons learned and insights into common pitfalls when scaling, positioning, and integrating CTI within a large organization.
