Cloud Security Podcast by Google
EP222 From Post-IR Lessons to Proactive Security: Deconstructing Mandiant M-Trends
Apr 28, 2025
In this engaging discussion, Kirstie Failey from the Google Threat Intelligence Group and Scott Runnels from Mandiant Incident Response dive into the art of transforming incident reports into the M-Trends report. They explore the paradox of learning from past incidents versus proactive security measures. The duo uncovers the complexities of 'dwell time' metrics and why repeated security mistakes persist. They also discuss the unique challenges faced by smaller organizations and the necessity of effective storytelling in cybersecurity reporting. A must-listen for security enthusiasts!
35:19
Episode guests
AI Summary
AI Chapters
Episode notes
Podcast summary created with Snipd AI
Quick takeaways
- Transforming incident reports into actionable M-Trends insights is challenging due to the need for cohesive storytelling amidst varied audience expectations.
- Dwell time metrics require careful interpretation, as shorter times don't always equate to better security outcomes depending on the incident context.
Deep dives
Challenges in Creating the M-Trends Report
The process of transforming numerous incident response reports into the M-Trends report is fraught with challenges. Consultants are typically trained to create descriptive reports focused on past events, which makes it difficult to extract prescriptive insights and actionable recommendations. This often leads to a demanding revision process, as consultants must adapt their narrative styles to fit the formal, cohesive structure that M-Trends requires. Additionally, balancing engaging storytelling with factual accuracy is crucial, highlighting the importance of collaborating with intelligence teams to support claims with concrete data.
