In a short period of time, Cyber Threat Intelligence (CTI) at Dutch Railways (NS) evolved into an independent advisory function that helps stakeholders make more targeted, timely, and threat-driven decisions. Positioned as the “Rising Sun” at the center of the security ecosystem, CTI provides direction and energy to domains such as Security Operations, Risk, Architecture, and Physical Security.
In this session, we will take you through our CTI maturity journey: from programme approach and positioning choices to the practical use cases that turned intelligence into measurable impact. Using concrete examples, we will show how CTI and continuous monitoring accelerate processes such as risk management, detection and response, and broader security decision-making – always driven by real-world threats and stakeholder needs.
Attendees will leave with practical lessons on how to position, scale, and integrate CTI as an independent advisory capability within their own organization.