Domain Zero: Human threat intelligence is cyber's unfinished business

We numbered the domains of warfare, land, sea, air, space, cyberspace, and built intelligence methodology for each. But every domain has a precondition: a human deciding to act. The human domain isn't the sixth domain. It's the original. And it's the one we've done the least with, and our future (including AI) is most vulnerable to.

Whether it be social engineering attacks against AI, insider threats, radicalisation to violent extremism, technology-facilitated abuse, intimate partner violence, they all follow the same playbook. The behavioural pattern is structurally identical, the only variables are the target and the tools. 

This presentation is your playbook.

We start with the threat landscape: How structured adversarial-behaviour modelling extends to human-motivated, human-executed threats, beyond technical attack surfaces. The implications of pizza delivery patterns and sporting events on national security, what the rockets and roundabouts can teach us about systems weaponisation, and how the claim that human behaviour is too complex to model doesn't survive contact with what we already do.

The talk then moves to operational methodology: how standards like STIX 2.1 accommodate human-domain threat objects without modification, how behavioural indicators can be structured with the same analytical rigour as technical indicators of compromise, and how existing threat intelligence frameworks extend to domains they were never designed for yet fit remarkably well. This includes the AI attack surface: human-domain threat intelligence provides a detection layer for social engineering attacks against AI systems that technical red-teaming alone cannot address. We talk about the hard problems: building taxonomies that are machine-readable without flattening human complexity, managing false positives when telemetry is lived experience rather than endpoint data, and holding intelligence rigour and trauma-informed practice together as non-negotiable co-requirements.

This presentation draws on original research applying cyber threat intelligence methodology, kill-chain analysis, STIX/TAXII, adversarial behaviour detection frameworks, to interpersonal harm domains. It is grounded in practical implementation, not theory.

Participants will leave with a concrete understanding of how human-domain kill chains mirror the technical kill chains they already work with, how to structure behavioural indicators as actionable intelligence, and where human-domain threat intelligence integrates with existing workflows. The goal is not to convince the room that this matters, it's to show them they already have the tools and to challenge them to use them.