Threat intelligence is becoming risk operations infrastructure.

Threat Intelligence Was Built for Experts. Here’s Why Every Risk Team Needs It Now

Arjun Bisen, CEO and cofounder

For years, threat intelligence was limited to a specialized group of expert threat hunters, fraud investigators, and incident responders who used intelligence from the criminal underground and other external sources to anticipate emerging threats, strengthen defenses, or investigate incidents after they occurred.

Zara Perumal and I were part of that group. I led a risk team at Stripe, and Zara worked on countering influence operations at Google’s Threat Analysis Group. We had access to the underground, experienced investigators, and good tools, and we could still only investigate a fraction of what we saw.

But the barriers to entry for cybercrime and fraud have collapsed. Impersonating a business, compromising and selling accounts, launching phishing campaigns, and scaling malicious activity across thousands of digital touchpoints now takes little money and even less skill.

AI is speeding this up. In the underground forums we monitor, much of the “AI” on offer is marketing, but three uses are real and growing: sharper phishing and social engineering lures, automation platforms that let low-skill operators run campaigns at scale, and tools that sift stolen data for the most valuable targets. Attackers don’t need autonomous AI to do serious damage. They just need to do more, faster. AI gives them that.

The lines between cybersecurity, fraud, and financial crime are also blurring. The criminal groups we monitor don’t distinguish between these categories. They use whatever tools work, and share infrastructure across fraud, money laundering, and data harvesting, operating much like franchises, which is how the UN has described the scam networks running across Southeast Asia. The proceeds from these activities support broader criminal networks involved in trafficking, exploitation, and violence. Inside most enterprises, those threats still land on separate teams with separate tools, with security in one place, fraud in another, and third-party risk in a third. Attackers count on that.

That’s why threat intelligence now belongs in almost every enterprise risk workflow. Onboarding a merchant, vetting a vendor, monitoring a partner, spotting a new fraud pattern: each of these decisions gets better when you understand an entity’s digital footprint and can see the suspicious signals around it. The challenge is that few organizations have the investigative resources to apply this expertise at scale. Experienced investigators are scarce and expensive, and a single case can take days. Hiring more of them was never going to keep pace with attackers who can scale with a few lines of code.

What Zara and I learned from years on the defender’s side is that most of an investigation is routine work: gathering evidence, checking it against other sources, and ruling things out. Agents can do that work, and people should spend their time on the finer judgment calls only they can make.

This is why we built Overwatch Data.

By combining external intelligence, investigative tools, and AI agents, we can bring capabilities once reserved for specialist investigators into everyday risk operations. Teams can easily investigate threats, connect evidence across sources, and identify emerging risks without spending days on each case. Teams at Visa already use Overwatch. In its first 90 days, one customer resolved six times more critical threats, detected emerging threats three days earlier and got back more than 20 analyst hours each week. Every investigation also sharpens our agents, so the platform gets better for every customer the more it’s used.

The stakes go well beyond losses on a balance sheet. When fraud succeeds, the money often ends up funding trafficking and exploitation. That’s why we’re empowering threat intel, fraud and risk teams with the intelligence they need to act on threats before they cause harm.