Explainable Threat Intelligence for Nontechnical Decision Makers

Sophie M. Richardson

Explainable Threat Intelligence for Nontechnical Decision Makers

Author(s)	Dr. Sophie M. Richardson
Country	United States
Abstract	Cyber threat intelligence has become an important component of organizational cybersecurity because it transforms threat-related data into contextual knowledge that can support security decisions. Yet the usefulness of threat intelligence depends not only on technical accuracy but also on whether intended users can understand its significance, uncertainty, organizational consequences, and recommended actions. This requirement becomes particularly important when cyber-risk decisions involve executives, business managers, finance officers, public administrators, compliance leaders, and other stakeholders who do not possess specialist cybersecurity expertise. The present study develops the concept of Explainable Threat Intelligence (ETI) as a human-centered communication layer that converts technically rich cyber threat intelligence into decision-oriented explanations without eliminating evidence, uncertainty, or analytical traceability. NIST defines cyber threat intelligence as threat information that has been analyzed or enriched to provide context for decision-making, while NIST Cybersecurity Framework 2.0 is deliberately structured so that cybersecurity outcomes can be understood by executives, managers, and practitioners with different levels of technical expertise. A simulation-based comparative design representing 270 hypothetical nontechnical decision makers was developed to compare raw technical CTI, conventional executive summaries, and explainable CTI. The simulated results indicate mean decision accuracies of 60.4%, 76.9%, and 87.3%, respectively. Explainable CTI also produced higher simulated decision confidence and shorter decision time. The findings are methodological illustrations rather than empirical population estimates, but they demonstrate how explanation quality may be evaluated through measurable decision outcomes. The paper concludes that effective threat intelligence for nontechnical audiences should communicate threat relevance, affected business assets, confidence, supporting evidence, likely consequences, uncertainty, and prioritized response options while retaining links to underlying technical detail. Such an approach can strengthen cyber-risk governance by connecting technical detection capabilities with accountable organizational decision-making.
Keywords	cyber threat intelligence; explainable threat intelligence; cybersecurity decision-making; nontechnical decision makers; explainable artificial intelligence; cyber-risk communication; threat-informed defense; executive cybersecurity
Field	Engineering
Published In	Volume 3, Issue 3, May-June 2022
Published On	2022-06-04

View / Download PDF File

About AJAMIR Fees & Payment Current Issue Publication Archive	Submit Research Paper Track Submission Status Publication Guidelines Publication Ethics Peer Review & Plagiarism	Join as a Reviewer Editors & Reviewers Reviewer Referral Program Get Reviewer Membership Certi.	Website/Journal Policies Usage Policy Content Policies Privacy Policy

Contact Us		+1-872-302-3851	editor@ajamir.com

American Journal of Advanced Multidisciplinary Innovation and Research

A Widely Indexed Open Access Peer Reviewed Multidisciplinary Bi-monthly Scholarly International Journal

Explainable Threat Intelligence for Nontechnical Decision Makers

Share this