Cyber adversaries are lowering the barrier to conducting sophisticated operations through automation and artificial intelligence, enabling faster reconnaissance, adaptive targeting, and persistent campaign execution that outstrips human-centric defensive planning. While defensive cyber operations have evolved toward threat-focused, intelligence-driven hunt methodologies, cyber threat intelligence remains insufficiently integrated into operational planning and rarely drives deliberate collection strategy. This paper argues that defensive cyber operations fail not due to a lack of data or tooling, but because they lack a mechanism for translating mission context and adversary behavior into decision-driving intelligence requirements. This paper makes three contributions. First, we introduce an operational model in which intelligence serves as the binding mechanism between mission, threat, and terrain through Priority Intelligence Requirement (PIR)-driven planning and deliberate collection. Second, we present Aegis-4, a structured, multi-agent workflow that operationalizes this model. Third, we introduce and demonstrate METIS, a multi-dimensional evaluation framework for assessing agentic systems designed to support intelligence-driven cyber planning. This work demonstrates how intelligence-driven defensive cyber operations can be structured as a scalable, traceable process and provides a concrete instantiation of how agentic systems can enable decision advantage at operational pace.
READ THE FULL ARTICLE HERE
doi.org/10.55682/cdr/ma3n-a3rc
The Cyber Defense Review
Volume 11, Issue 3