{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T15:17:47Z","timestamp":1783523867633,"version":"3.55.0"},"reference-count":57,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,4,17]],"date-time":"2026-04-17T00:00:00Z","timestamp":1776384000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc\/4.0\/"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2026,9]]},"DOI":"10.1016\/j.cose.2026.104930","type":"journal-article","created":{"date-parts":[[2026,4,17]],"date-time":"2026-04-17T23:15:37Z","timestamp":1776467737000},"page":"104930","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":1,"special_numbering":"C","title":["The practice of cyber-threat intelligence in organizations: A socio-technical case study of a mature financial organization"],"prefix":"10.1016","volume":"168","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7403-2350","authenticated-orcid":false,"given":"Scott","family":"Ainslie","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8862-5755","authenticated-orcid":false,"given":"Atif","family":"Ahmad","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dean","family":"Thompson","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2044-8163","authenticated-orcid":false,"given":"Sean","family":"Maynard","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"issue":"1","key":"10.1016\/j.cose.2026.104930_bib0001","first-page":"371","article-title":"Cyber threat intelligence\u2013issue and challenges","volume":"10","author":"Abu","year":"2018","journal-title":"Indones. J. Electr. Eng. Comput. Sci."},{"key":"10.1016\/j.cose.2026.104930_bib0003","doi-asserted-by":"crossref","first-page":"402","DOI":"10.1016\/j.cose.2019.07.001","article-title":"Strategically-motivated advanced persistent threat: definition, process, tactics and a disinformation model of counterattack","volume":"86","author":"Ahmad","year":"2019","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.104930_bib0002","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2020.102122","article-title":"How can organizations develop situation awareness for incident response: a case study of management practice","volume":"101","author":"Ahmad","year":"2021","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.104930_bib0004","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103352","article-title":"Cyber-threat intelligence for security decision-making: a review and research agenda for practice","author":"Ainslie","year":"2023","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.104930_bib0005","unstructured":"Alsubaie, M., Caldwell, A., Pitruzzello, S., Li, J., Akram, N., Maynard, S.B., Ahmad, A., & Ainslie, S. (2025). Process modeling in Information systems. International Conference on Information Systems, Nashville, Tenessee, USA."},{"key":"10.1016\/j.cose.2026.104930_bib0007","series-title":"A Theory of Action Perspective","author":"Argyris","year":"1978"},{"key":"10.1016\/j.cose.2026.104930_bib0008","series-title":"LWD 2-0 Intelligence","author":"Army","year":"2018"},{"key":"10.1016\/j.cose.2026.104930_bib0009","first-page":"1","article-title":"Standardizing cyber threat intelligence information with the structured threat information expression (stix)","volume":"11","author":"Barnum","year":"2012","journal-title":"Mitre Corporation"},{"key":"10.1016\/j.cose.2026.104930_bib0010","doi-asserted-by":"crossref","unstructured":"Bauer, S., Fischer, D., Sauerwein, C., Latzel, S., Stelzer, D., & Breu, R. (2020). Towards an evaluation framework for threat intelligence sharing platforms. 53rd Hawaii International Conference on System Sciences | 2020, Hawaii, USA.","DOI":"10.24251\/HICSS.2020.239"},{"key":"10.1016\/j.cose.2026.104930_bib0012","author":"Brown","year":"2021","journal-title":"2021 SANS Cyber Threat Intell. (CTI) Surv."},{"key":"10.1016\/j.cose.2026.104930_bib0013","author":"Brown","year":"2024","journal-title":"SANS 2024 CTI Surv.: Manag. Evol. Threat Landsc."},{"key":"10.1016\/j.cose.2026.104930_bib0014","series-title":"SANS 2025 CTI Survey - Navigating Uncertainty in Todays Threat Landscape","author":"Brown","year":"2025"},{"key":"10.1016\/j.cose.2026.104930_bib0015","doi-asserted-by":"crossref","unstructured":"Burger, E.W., Goodman, M.D., Kampanakis, P., & Zhu, K.A. (2014). Taxonomy model for cyber threat intelligence information exchange technologies. Proceedings of the 2014 ACM Workshop on Information Sharing & Collaborative Security.","DOI":"10.1145\/2663876.2663883"},{"issue":"5","key":"10.1016\/j.cose.2026.104930_bib0016","doi-asserted-by":"crossref","first-page":"555","DOI":"10.1287\/orsc.1040.0094","article-title":"Transferring, translating, and transforming: an integrative framework for managing knowledge across boundaries","volume":"15","author":"Carlile","year":"2004","journal-title":"Organiz. Sci."},{"key":"10.1016\/j.cose.2026.104930_bib0017","article-title":"The Quest for the appropriate cyber-threat intelligence sharing platform","author":"Chantzios","year":"2019","journal-title":"Data (Basel)"},{"key":"10.1016\/j.cose.2026.104930_bib0018","doi-asserted-by":"crossref","unstructured":"Chen, P.D., Lieven.; Huygens, Christophe. (2014). A study on advanced persistent threats. 15th IFIP TC 6\/TC 11 International Conference on Communications and Multimedia Security, CMS 2014, Aveiro, Portugal.","DOI":"10.1007\/978-3-662-44885-4_5"},{"key":"10.1016\/j.cose.2026.104930_bib0019","article-title":"Sharing, compared: a study on the changing landscape of CTI networking","author":"Chi","year":"2024","journal-title":"Sharing, Compared: A Study Chang. Landsc. CTI Network."},{"key":"10.1016\/j.cose.2026.104930_bib0020","article-title":"Threat intelligence: collecting, analysing, evaluating","author":"Chismon","year":"2015","journal-title":"MWR InfoSecurity Ltd"},{"issue":"3","key":"10.1016\/j.cose.2026.104930_bib0021","doi-asserted-by":"crossref","first-page":"522","DOI":"10.2307\/259140","article-title":"An organizational learning framework: from intuition to institution","volume":"24","author":"Crossan","year":"1999","journal-title":"Academy of management review"},{"key":"10.1016\/j.cose.2026.104930_bib0022","series-title":"2023 Global Threat Report","year":"2023"},{"key":"10.1016\/j.cose.2026.104930_bib0023","unstructured":"Dandurand, L., & Serrano, O. (2013). Towards improved cyber security information sharing. 2013 5th International Conference on Cyber Conflict (CYCON 2013)."},{"issue":"2","key":"10.1016\/j.cose.2026.104930_bib0024","doi-asserted-by":"crossref","first-page":"147","DOI":"10.2307\/2095101","article-title":"The iron cage revisited: institutional isomorphism and collective rationality in organizational fields","volume":"48","author":"DiMaggio","year":"1983","journal-title":"Am. Sociol. Rev."},{"key":"10.1016\/j.cose.2026.104930_bib0025","series-title":"Cyber Intelligence TradecraftReport- The State of Cyber Intelligence Practices in the United States","author":"Ettinger","year":"2019"},{"issue":"1","key":"10.1016\/j.cose.2026.104930_bib0026","doi-asserted-by":"crossref","first-page":"22","DOI":"10.1080\/14702430701811987","article-title":"Rethinking military intelligence failure\u2013putting the wheels back on the intelligence cycle","volume":"9","author":"Evans","year":"2009","journal-title":"Defence Stud."},{"issue":"2","key":"10.1016\/j.cose.2026.104930_bib0027","doi-asserted-by":"crossref","first-page":"219","DOI":"10.1177\/1077800405284363","article-title":"Five misunderstandings about case-study research","volume":"12","author":"Flyvbjerg","year":"2006","journal-title":"Qualit. Inqu."},{"issue":"4","key":"10.1016\/j.cose.2026.104930_bib0028","first-page":"5","article-title":"Detection and response strategies for advanced persistent threats (APTs)","volume":"4","author":"Gilbert","year":"2025","journal-title":"Int. J. Sci. Res. Mod. Technol."},{"issue":"1","key":"10.1016\/j.cose.2026.104930_bib0029","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1177\/1094428112452151","article-title":"Seeking qualitative rigor in inductive research: notes on the Gioia methodology","volume":"16","author":"Gioia","year":"2013","journal-title":"Organ. Res. Methods"},{"key":"10.1016\/j.cose.2026.104930_bib0030","series-title":"Intelligence is For Commanders","author":"Glass","year":"1948"},{"issue":"2","key":"10.1016\/j.cose.2026.104930_bib0031","doi-asserted-by":"crossref","first-page":"529","DOI":"10.2307\/41703466","article-title":"Toward a new theory of the contribution of the IT function in organizations","volume":"36","author":"Guillemette","year":"2012","journal-title":"MIS quarterly"},{"issue":"4","key":"10.1016\/j.cose.2026.104930_bib0032","doi-asserted-by":"crossref","first-page":"593","DOI":"10.2307\/2393338","article-title":"Follow the leader: mimetic isomorphism and entry into new markets","volume":"38","author":"Haveman","year":"1993","journal-title":"Adm. Sci. Q."},{"key":"10.1016\/j.cose.2026.104930_bib0033","series-title":"Intelligence Power in Peace and War","author":"Herman","year":"1996"},{"key":"10.1016\/j.cose.2026.104930_bib0034","series-title":"Psychology of Intelligence Analysis","author":"Heuer","year":"1999"},{"key":"10.1016\/j.cose.2026.104930_bib0035","series-title":"JP 2-0 Joint Intelligence","author":"JCS","year":"2013"},{"issue":"4","key":"10.1016\/j.cose.2026.104930_bib0036","first-page":"21","article-title":"Words of estimative probability [CIA Historical Review Program 22 Sept 93]","volume":"8","author":"Kent","year":"1964","journal-title":"Center Study Intell."},{"issue":"1","key":"10.1016\/j.cose.2026.104930_bib0037","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1080\/0960085X.2022.2088414","article-title":"Adopting and integrating cyber-threat intelligence in a commercial organization","volume":"32","author":"Kotsias","year":"2022","journal-title":"Eur. J. Inf. Syst."},{"key":"10.1016\/j.cose.2026.104930_bib0038","series-title":"2020 SANS Cyber Threat Intelligence (CTI) Survey","author":"Lee","year":"2020"},{"key":"10.1016\/j.cose.2026.104930_bib0039","series-title":"IC21: The Intelligence Community in the 21st Century","author":"Lowenthal","year":"1996"},{"key":"10.1016\/j.cose.2026.104930_bib0040","series-title":"Intelligence: From Secrets to Policy","author":"Lowenthal","year":"2020"},{"issue":"4","key":"10.1016\/j.cose.2026.104930_bib0041","doi-asserted-by":"crossref","first-page":"948","DOI":"10.1108\/ITP-01-2017-0001","article-title":"Establishing a partnership between top and IT managers: a necessity in an era of digital transformation","volume":"32","author":"Manfreda","year":"2018","journal-title":"Inf. Technol. People"},{"key":"10.1016\/j.cose.2026.104930_bib0042","series-title":"Improving Intelligence Analysis - Bridging the Gap between Scholarship and Practice (1st Edition ed.)","author":"Marrin","year":"2011"},{"key":"10.1016\/j.cose.2026.104930_bib0043","series-title":"Qualitative Data analysis: an Expanded Sourcebook","author":"Miles","year":"1994"},{"key":"10.1016\/j.cose.2026.104930_bib0044","series-title":"JDP 2-00 Intelligence, Counter-intelligence and Security Support to Joint Operations","author":"MOD","year":"2023"},{"key":"10.1016\/j.cose.2026.104930_bib0045","doi-asserted-by":"crossref","first-page":"56044","DOI":"10.1109\/ACCESS.2022.3176965","article-title":"Multimodal classification of onion services for proactive cyber threat intelligence using explainable deep learning","volume":"10","author":"Moraliyage","year":"2022","journal-title":"IEEe Access."},{"key":"10.1016\/j.cose.2026.104930_bib0046","series-title":"Social Research Methods: Qualitative and Quantitative Approaches","author":"Neuman","year":"2014"},{"issue":"1","key":"10.1016\/j.cose.2026.104930_bib0047","doi-asserted-by":"crossref","first-page":"29","DOI":"10.1016\/S0963-8687(99)00013-X","article-title":"Mind the gap\u2019: diagnosing the relationship between the IT organisation and the rest of the business","volume":"8","author":"Peppard","year":"1999","journal-title":"J. Strat. Inf. Syst."},{"issue":"5","key":"10.1016\/j.cose.2026.104930_bib0049","first-page":"824","article-title":"A comparative analysis of cyber-threat intelligence sources, formats and languages","volume":"9","author":"Ramsdale","year":"2020","journal-title":"Electronics. (Basel)"},{"key":"10.1016\/j.cose.2026.104930_bib0050","doi-asserted-by":"crossref","first-page":"135","DOI":"10.1007\/978-3-319-78440-3_8","article-title":"Cybersecurity as an industry: a cyber threat intelligence perspective","author":"Samtani","year":"2020","journal-title":"Palgr. Handb. Int. Cybercr. Cyberdev."},{"key":"10.1016\/j.cose.2026.104930_bib0052","unstructured":"Sauerwein, C., Sillaber, C., Mussmann, A., & Breu, R. (2017). Threat intelligence sharing platforms: an exploratory study of software vendors and research perspectives."},{"key":"10.1016\/j.cose.2026.104930_bib0051","doi-asserted-by":"crossref","unstructured":"Sauerwein, C., Fischer, D., Rubsamen, M., Rosenberger, G., Stelzer, D., & Breu, R. (2021). From threat data to actionable intelligence: an exploratory analysis of the intelligence cycle implementation in cyber threat intelligence sharing platforms. The 16th International Conference on Availability, Reliability and Security.","DOI":"10.1145\/3465481.3470048"},{"key":"10.1016\/j.cose.2026.104930_bib0053","unstructured":"Shaw, T., & Jarvenpaa, S. (1997). Process models in information systems. Information Systems and Qualitative Research: Proceedings of the IFIP TC8 WG 8.2 International Conference on Information Systems and Qualitative Research, 31st May\u20133rd June 1997, Philadelphia, Pennsylvania, USA."},{"issue":"1","key":"10.1016\/j.cose.2026.104930_bib0054","doi-asserted-by":"crossref","first-page":"20","DOI":"10.5465\/amj.2007.24160882","article-title":"Persuasion with case studies","volume":"50","author":"Siggelkow","year":"2007","journal-title":"Acad. Manage. J."},{"key":"10.1016\/j.cose.2026.104930_bib0055","author":"Strauss","year":"1990","journal-title":"Basics Qual. Res."},{"key":"10.1016\/j.cose.2026.104930_bib0056","doi-asserted-by":"crossref","first-page":"212","DOI":"10.1016\/j.cose.2017.09.001","article-title":"A survey on technical threat intelligence in the age of sophisticated cyber attacks","volume":"72","author":"Tounsi","year":"2018","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.104930_bib0057","doi-asserted-by":"crossref","unstructured":"Wagner, C., Dulaunoy, A., Wagener, G., & Iklody, A. (2016). Misp: the design and implementation of a collaborative threat intelligence sharing platform. Proceedings of the 2016 ACM on Workshop on Information Sharing and Collaborative Security.","DOI":"10.1145\/2994539.2994542"},{"key":"10.1016\/j.cose.2026.104930_bib0058","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.cose.2019.101589","article-title":"Cyber threat intelligence sharing: survey and research directions","volume":"87","author":"Wagner","year":"2019","journal-title":"Comput. Secur."},{"issue":"2","key":"10.1016\/j.cose.2026.104930_bib0059","doi-asserted-by":"crossref","first-page":"74","DOI":"10.1057\/ejis.1995.9","article-title":"Interpretive case studies in IS research: nature and method","volume":"4","author":"Walsham","year":"1995","journal-title":"Eur. J. Inf. Syst."},{"key":"10.1016\/j.cose.2026.104930_bib0060","series-title":"Case Study Research and Applications. Design and Methods","author":"Yin","year":"2018"}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826001069?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826001069?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,5,27]],"date-time":"2026-05-27T20:02:46Z","timestamp":1779912166000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404826001069"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9]]},"references-count":57,"alternative-id":["S0167404826001069"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2026.104930","relation":{},"ISSN":["0167-4048"],"issn-type":[{"value":"0167-4048","type":"print"}],"subject":[],"published":{"date-parts":[[2026,9]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"The practice of cyber-threat intelligence in organizations: A socio-technical case study of a mature financial organization","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2026.104930","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"104930"}}