Page 246 - Cyber Defense eMagazine RSAC Special Edition 2025

The Rise of Identity Risk Intelligence

By Andres Andreu, COO and CISO, Constella Intelligence

For many years, cybersecurity professionals have relied on Indicators of Compromise (IOCs) such as IP
addresses, domain names, and file hashes to defend against a number of cyber threats. While these
technical artifacts provide valuable data points, their effectiveness as a primary defense mechanism is
waning in the face of increasingly strategic adversaries. Time has shown that adversarial strategies
gravitate towards paths of least resistance.

The Limitations of Traditional IOCs

Attackers can easily spoof traffic sources and rapidly change their operational infrastructure, rendering
techniques like IP address blocking efforts futile. An IP address identified as malicious today might be
obsolete tomorrow. Additionally, threat actors can manipulate malware file hashes in seconds, bypassing
signature-based detection systems. The proliferation of polymorphic malware, which automatically alters
its code, further diminishes the effectiveness of traditional hash-based detection methods.

Cybersecurity teams are often overwhelmed by the sheer volume of data from threat intelligence feeds,
much of which quickly becomes irrelevant. These massive "blacklists" of IOCs are often outdated due to
the ephemeral nature of attacker infrastructure and the ease of modifying malware signatures. This data
overload makes it difficult for security analysts to identify genuine threats and implement effective

246