Threat Intel That Delivers | Tom Hegel

Tom Hegel of SentinelLabs joins Dennis Fisher for a deep discussion of the value of a broad background, not just in tech but in life, how threat intelligence teams function, and the wide range of effects AI is having on how defenders and attackers function.
Timestamps0:00 – Welcome and intro with Tom Hegel0:40 – LabsCon recap and the standout opening talk2:10 – How Tom got into security: taking apart VCRs and repairing hardware3:35 – Fake antivirus, forensics and the early days of the industry5:49 – From MSSPs and SIEM vendors to Sentinel One7:02 – 90s self-sufficiency culture and Pringles-can cantennas8:24 – Hacking retro hardware with AI, and Doom on everything10:20 – Why a broad foundation beats early specialization12:28 – Threat intel: detection noise and writing for your audience15:17 – Diverse teams and global perspectives17:11 – Echo chambers in the security community19:40 – Underreported regions: Africa, Latin America and Chinese soft power22:09 – Living with compromised devices and surveillance capitalism25:01 – Post-compromise detection, and the PHP vulnerability hype28:22 – N-days vs. zero days: what attackers actually use30:29 – AI's early days and the long-term impact on software quality31:32 – Slop software and the rise of risky DIY apps33:36 – How threat actors use AI, from advanced groups to low-skill crime36:01 – Parallels to the 90s "wild west" of hacking37:17 – Defenders are empowered by AI too38:00 – Will people still understand how software works?39:20 – Cognitive decline and using AI without losing skill40:39 – AI-generated threat intel reports and accuracy43:22 – Hype-chasing vendors and AI slop45:13 – Trusting proven experts45:50 – Small, trusted conferences and private signal groups