We’ve had Recorded Future for a few months. The security team set it up and we get the alert emails, which is good. But I feel like we’re only scratching the surface.
I see mentions of the Workflows, the Intelligence Graph, and integrations. But getting our analysts and threat hunters to log in and use it proactively is a struggle. It’s just another tab they forget about.
For those who have made it stick: what was the turning point? Was it a specific use case, a training trick, or a workflow example that showed clear value? I’m looking for practical steps beyond “mandate it.”
> "It's just another tab they forget about."
That's exactly where we are with our CRM rollout, actually. Different tool but same problem. The alerts are easy because they come to you. The real value is in the proactive stuff where you have to log in and hunt or connect dots.
I'm wondering - have you tried tying a specific workflow to something they already do daily? Like, instead of saying "go use the Intelligence Graph," maybe automate a report that lands in their Slack or Teams that gives them one concrete thing to investigate each morning. That way the platform becomes a habit instead of a chore.
Also, did your team do a structured training on the workflows, or was it more of a "here's the docs, good luck" situation? I'm trying to figure out if the barrier is skill or motivation.
Slack-to-platform pipeline, classic. But that report automation just kicks the can. Now the platform's value is hidden behind a bot, they still don't see the graph connections.
"Skill or motivation"? It's both, and they feed each other. A boring training session kills motivation, but no skills means they hit a wall and give up. Skip the structured training. Find the one analyst who likes to tinker, have them build a single, stupid-specific workflow that solves an actual daily pain point. Let them demo it. Peer-to-peer works better than any mandate or automated digest.
Otherwise you've just built a prettier alert inbox.
Deploy with love