FREE CloudSecNext Summit | Jun 3-4: At this global event, stay informed with what's next in cloud security. Register now!


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

2021 SANS Cyber Threat Intelligence (CTI) Survey Results

  • Tuesday, January 19, 2021 at 1:00 PM EST (2021-01-19 18:00:00 UTC)
  • Robert M. Lee


  • Anomali
  • Cisco Systems
  • DomainTools
  • Infoblox
  • Sixgill
  • ThreatQuotient

You can now attend the webcast using your mobile device!



Since 2017, SANS has seen steady growth in organizations that produce or consume CTI. In last years Cyber Threat Intelligence (CTI) Survey, a large majority of survey respondents both produce and consume such intelligence, whether raw data, contextual threat alerts or published threat intelligence reports.

The 2021 survey will build on the trends in CTI from previous CTI surveys to provide guidance on how organizations are expanding their use of CTI, leading into how an organization can get the most out of CTI.

Also, this year may bring a unique perspective, given the global changes and challenges associated with the coronavirus

Attendees at this webcast will gain insight:

  • How consumers and generators of CTI leverage, create and measure intelligence
  • What progress has been made on automation of intelligence collection and processing
  • What improvements organizations have realized as a result of using CTI
  • Which best practices are in use across respondents' organizations

Register today to be among the first to receive the associated whitepaper written by SANS instructor Rebekah Brown and SANS instructor and CTI expert Robert M. Lee.

Click here to register for a panel discussion of the survey results on Wednesday, January 20, 2021, at 1PM Eastern. On this webcast, Robert M. Lee and sponsor speakers will explore how these results can improve CTI program.

Speaker Bio

Robert M. Lee

Robert M. Lee, a SANS certified instructor and author of ICS515 ICS Active Defense and Incident Response and FOR578 Cyber Threat Intelligence courses, is the founder and CEO of Dragos, a critical infrastructure cyber security company, where he focuses on control system traffic analysis, incident response and threat intelligence research. He has performed defense, intelligence and attack missions in various government organizations, including the establishment of a first-of-its-kind ICS/SCADA cyber threat intelligence and intrusion analysis mission. Author of SCADA and Me and a nonresident National Cyber Security Fellow at New America, focusing on critical infrastructure cyber security policy issues, Robert was named EnergySec’s 2015 Energy Sector Security Professional of the Year.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.