For years, the mandate of Cyber Threat Intelligence (CTI) teams has been narrow and well understood: track cyber threat actors, monitor for indicators of compromise, and defend the network. However, that mandate is widening. In today’s interconnected threat landscape, more CTI teams are being tasked with physical security, geopolitical and protective intelligence. Whether that is monitoring and securing executive travel, a facility, or an event, data shows that this new informal expansion is becoming an industry-wide shift.
What the Data Says About Cyber-Physical Security Convergence
The SANS 2026 CTI Survey affirms that CTI programs are being asked to cover more ground, including physical and geographical risk, without a proportional increase in headcount. Survey findings additionally emphasize that the risks CTI teams navigate increasingly span cyber, physical, and geopolitical domains simultaneously, rather than staying contained to the network.
Industry research confirms this shift from every angle:
- ASIS International: The security standards body developed formal Enterprise Security Risk Management (ESRM) guidance specifically to address how organizations struggle to unify physical and cyber risk into a single program with shared visibility.
- 2026 Physical Security Trends: Market analysis consistently identifies cyber-physical convergence and unified security operations as mainstream mandates rather than fringe concepts.
- International Security Journal: Analysis highlights a fundamental shift from reactive to proactive security, driven by the reality that digital and physical systems are now so closely linked that a compromise on one side rarely stays contained.
Taken together, the picture is consistent across independent sources: intelligence teams are being pulled toward physical and human risk, and most organizations are still early in closing the gap between that mission and the tooling built to support it.
Why Physical Security is a Natural Extension
It might seem like a jump from tracking ransomware to monitoring executive travel risk, but the underlying methodology is similar. Both rely on:
- Situational awareness: Understanding the context around an event, whether digital or physical.
- Data aggregation: Bringing together disparate sources into a coherent picture.
- Predictive analysis: Identifying indicators of risk before they become incidents.
CTI analysts are already well positioned to bridge this gap. When an executive’s safety or a physical location’s security is at risk, the earliest warning signs are frequently digital via social media sentiment, localized chatter, and open-source discussions. Treating physical security as an adjacent mission means pointing skills a team already has at a new question, rather than starting net-new.
The Strategic Advantage: Breaking Down Operational Silos
Bringing these missions together has a practical benefit beyond the workload—it prevents security silos where digital and physical intelligence teams operate in isolation. When the same team that monitors cyber threats also informs physical security decisions, the organization achieves a more complete view of risk, reducing the chance that threats fall between the gaps of two disconnected functions.
Extending CTI to Physical Security with Flashpoint
Facing this convergence head-on doesn’t require a new platform, a new vendor evaluation, or creating a new discipline. Organizations leveraging Flashpoint Ignite already have the foundation needed to seamlessly extend their visibility into physical and geopolitical threat landscapes.
Using both Flashpoint Cyber Threat Intelligence (CTI) and Flashpoint Physical Security Intelligence (PSI), security teams can answer two essential questions: “what is this threat actor doing” and “what is happening right now around this specific person or place.” Both draw on much of the same underlying data and OSINT tradecraft, so extending into physical security only requires a change in Intelligence Requirements, not mastery of new systems or tools.
With Flashpoint PSI, organizations gain real-time access to mainstream sources where conversations about fast-moving events tend to surface first, plus a geospatial layer that maps that activity to a specific place. Analysts can also draw boundaries around geographic locations to monitor mentions of an executive within that area, or observe a venue on event day, seeing relevant activity as it surfaces. All of this can be accomplished using plain language, removing the need to learn secondary query syntax or lengthy manual processes to get started.
Navigating the Future of Converged Intelligence
The distinction between cyber and physical intelligence will likely keep blurring and Flashpoint is helping security teams on the ground level integrate these two functions. CTI teams that take on physical security as part of their mission shouldn’t be expected to abandon their core discipline. Instead, they should be given the workflows to apply it to a wider set of questions, using tools built to extend rather than replace the way they already work.
See how Flashpoint supports converged cyber and physical missions from a single platform. Request a demo to see what this could look like for your team.