CrowdStrike’s Adam Meyers on Threat Intelligence, Identity Attacks and Business Alignment

Security teams can’t prioritize risk well if they don’t understand what the business needs to keep running. Adam Meyers, CrowdStrike’s senior vice president of counter-adversary operations, argues that security teams and business leaders need a shared view of operational priorities, likely threats and the controls that can reduce exposure.

That coordination matters as attackers move away from conspicuous malware and toward compromised identities, legitimate tools and less visible paths into company systems. Meyers’ advice: use threat intelligence to guide defensive priorities, maintain visibility across endpoints, cloud services and identity systems, and actively search for signs of intrusion.

Connect security decisions to business needs

Information security has often been handled primarily by technical teams responsible for deploying tools and monitoring for threats. Meyers says those teams may not always know which business activities and services matter most. That gap can leave security decisions detached from the needs of the organization’s operations.

He describes CrowdStrike’s work as building understanding in both directions: helping technology and security teams learn what the business values, while helping business leaders see how security issues can affect their ability to operate. That shared context can make it easier to explain why a control matters and to direct resources toward risks that could disrupt important functions.

Senior leaders also need timely, usable information when an incident requires a decision. Meyers says briefings can help executives and board members understand changes in attacker behavior, the role of identity controls and the organization’s readiness. His team has used quarterly sessions to bring these topics to leadership’s attention.

The goal is practical: leaders should be able to make informed choices about how the organization responds and what preparation it needs. Security teams, in turn, need to explain risks in terms that connect technical findings to business impact.

Use intelligence to guide hunting and investment

Threat intelligence can help an organization identify which adversaries may target its industry and how those groups tend to operate. Since no organization can defend against every possible threat at once, that information helps teams decide which defenses and investments deserve priority.

Intelligence also gives threat hunters a clearer idea of what to look for. Meyers says the time attackers need to gain access, move through an environment and raise their privileges has been shrinking. The average time for those steps was 84 minutes in 2022 and 62 minutes in 2023, a reduction of 22 minutes in one year.

That pace makes passive monitoring insufficient on its own, in his view. Teams need to search their environments for unusual activity, using knowledge of attacker methods to guide where they look and what patterns may matter. Hunting and intelligence work together: intelligence helps focus the search, while visibility lets teams investigate what they find.

A useful intelligence program depends on being able to see activity across the enterprise. Meyers points to endpoint detection and response (EDR), identity protection and cloud security as parts of that foundation. Without suitable coverage, intelligence may identify a relevant threat but leave the team unable to determine whether it is present or to act on the finding.

That visibility needs to cross technical domains. Identity systems deserve particular attention because investigators need to know which accounts are active, what they connect to and which resources they access. If security teams can’t see that activity, it becomes harder to trace suspicious behavior across an environment.

Preparation also takes practice. Meyers recommends regular tabletop exercises to consider which adversaries are relevant to an organization and how teams should respond to an incident. Rehearsal can expose uncertainty in roles and response plans before staff have to make decisions under pressure.

Third parties and generative AI extend the threat picture

Attackers can reach an organization through its suppliers and service providers. Meyers describes software supply chain attacks as one route: malicious code or backdoors may be inserted into software distributed through closed or open source channels. A compromised vendor can also provide a path to the customers that trust and use its services.

Those relationships include people as well as technology. Meyers says attackers are targeting individuals who work at companies, extending the risk beyond software dependencies and managed services. For defenders, that means assessing how access granted to external services and individual accounts could expose internal systems.

Generative AI is another tool attackers are beginning to use. Meyers says groups have applied it to automate script development and to learn about specific technologies or targets. He cites activity attributed to Scattered Spider involving scripts that interact with Microsoft Entra ID. These examples point to practical uses of AI for reconnaissance and task automation; they don’t establish that every group has adopted the technology or that it replaces other methods.

Why compromised identities are a major entry path

Meyers says EDR tools have made it harder for attackers to bring obvious malicious software into monitored environments. Malware can be easier to spot, so some threat actors instead enter through identities that appear legitimate. Credentials may be stolen, guessed through brute force or password spraying, or exposed in material such as a developer’s code repository. API credentials can also provide access.

After gaining entry, attackers may use unmanaged devices or seek areas with weaker monitoring. They can then use ordinary software and tools to move through systems while trying to avoid detection. This approach shifts the defensive challenge: recognizing the abuse of valid access can require close attention to account behavior and connections across identity, endpoint and cloud data.

Meyers describes a ransomware path in which attackers use a compromised identity to explore an environment, then target a hypervisor. Because that system may not support modern security tools, activity there can be harder to detect. From that foothold, attackers may encrypt large numbers of servers.

For security teams, the takeaway is to treat identity visibility as part of enterprise monitoring, not a separate concern. Combine it with threat intelligence, active hunting and regular exercises, and translate technical findings into the operational risks leaders need to understand. That gives teams a clearer basis for deciding what to protect first and how to respond when an attacker gets in.

About Adam Meyers

Meyers leads CrowdStrike’s threat intelligence business and a geographically distributed team that tracks criminal, state-sponsored and nationalist cyber groups. The team produces intelligence intended to help customers prepare for and defend against those adversaries. His remit includes technology development and deployment involving AI, machine learning, reverse engineering and natural language processing to detect suspicious and malicious behavior.