Org Profile: Turn “what happened” into “why it matters to us”

BLUF

AI needs context about your organization to help you synthesize generic threat reports into contextualized risk assessments.

Org Profile lets your team capture context about your technologies, suppliers, and operations, then reference it in AI prompts. Get assessments and reports specific to your organization, without pasting the same context each time.

How does Org Profile work?

Feedly AI combines three inputs: threat intelligence from the Threat Context Engine, the requirement in your prompt, and the Org Profile items you reference.

Here’s how to capture your organization’s context and use it in your prompts:

Step 1: Capture your organization’s context. Add your business context, the threats you track, and guidance for your team’s reports and briefings:

Reuse existing documentation when creating items by uploading CSV (.csv) files for lists or Markdown (.md) files for text items.

Step 2: Easily add relevant context to your prompts. Type @ and select the Org Profile items your prompt needs. You can also use Org Profile lists in AI Feed filters.

Step 3: Get AI answers more specific to your organization. When you reference Org Profile items, Feedly AI uses that context to explain a threat’s relevance and potential business impact in its response. Use that initial assessment to decide what warrants deeper analysis.

Using your Org Profile across the intelligence cycle: a banking example

These examples follow Northwind, a fictional regional US bank. Its CTI analysts create and name the Org Profile items used below. Names after @ represent items selected in the prompt editor.

Collection: track supplier incidents with Intel Agents

Use a saved supplier list to scope an Intel Agent’s collection:

What data breaches, ransomware incidents, and leak-site claims involve our "@suppliers"?

Then create a column with a prompt to assess each incident’s potential business implications:

Using our "@company overview", assess the potential business implications of this incident for Northwind. Focus on the specific facts in the incident and add at least one possible business implication per fact.

The supplier list identifies the third parties to monitor. The company overview gives Feedly AI context to assess why an incident may matter to Northwind.

Research: check exposure to a vulnerability with Ask AI

Use a vulnerability advisory and Northwind’s saved tech stack to investigate potential exposure:

Which products and versions in our "@tech stack" are affected by this advisory? What conditions are required for exploitation, and what must we check internally to establish exposure?

@tech stack gives Ask AI Northwind’s product and version details. The assessment connects the advisory to those technologies and identifies the deployment conditions analysts need to verify before recommending remediation.

Production: build a hunt package tailored to your tech stack with Report Builder

Use your tech stack, audience, and tradecraft instructions to turn a threat intelligence report into a tailored hunt package.

The hunt package report template asks you to select your @tech stack to scope the package to Northwind’s technologies. It uses the @threat hunting team to set the technical depth and @ICD203 to guide sourcing, distinguish facts from assessments, state confidence, and identify information gaps.

Delivery: brief leadership with Automated Newsletters

Reference business context and audience in the newsletter’s AI Overview prompt:

Prepare this newsletter for our "@security leadership". Using our "@company overview", summarize the developments that matter to Northwind. Focus on active exploitation of our "@tech stack", incidents at our "@suppliers", and activity from our "@threat actors". Only connect an article to Northwind's environment when the relevance is direct and specific.

Feedly AI uses the selected context to explain why developments matter to Northwind. The selected audience sets the focus and level of technical detail. Each scheduled run uses the current referenced items.

FAQs