The category
Security Knowledge
Intelligence
Security Knowledge Intelligence
noun
The discipline of transforming years of security evidence into enduring organizational knowledge.
Every pentest, red-team operation, incident, and architecture review teaches an organization something about itself. Security Knowledge Intelligence is the practice of engineering that learning so it endures: structured instead of filed, connected instead of siloed, compounding instead of decaying.
It rests on three ideas: knowledge decay is the enemy, knowledge compounding is the method, and institutional memory is the outcome.
Adjacent categories
Necessary. Not sufficient.
Modern security programs already run several disciplines that sound close. Each answers a real question. None of them answers this one: does what we learn endure?
CTEM
Continuous Threat Exposure Management asks: where are we exposed right now?
It is a cycle, not a memory. Each scoping-to-mobilization loop optimizes the current snapshot; the lessons of previous loops live in tickets and decks, not in a knowledge base the next loop starts from.
Exposure Management
Exposure management asks: which assets and vulnerabilities matter most today?
It is inventory-centric and present-tense. When a finding is remediated it disappears from the queue — along with the understanding of why it existed, and how often it has come back before.
GRC
Governance, risk, and compliance asks: can we evidence our controls to an auditor?
It preserves attestations, not understanding. A control marked effective says nothing about the three engagements that defeated it, or the lesson each one carried.
All three disciplines consume security knowledge. None of them preserve it. The pentest that informed this quarter's exposure priorities is a PDF by next quarter; the incident that reshaped the risk register is a memory by next year. Every one of these programs would be stronger sitting on top of knowledge that endures.
That layer is Security Knowledge Intelligence.
Why the category exists today
The labor problem is solved.
Institutional memory was always the right answer, and it always failed for the same reason: turning unstructured reports into structured, connected, current knowledge was months of expert labor no team could spare.
AI changed the economics. Machines can now read the reports, extract the structure, and hold the connections across years. What used to be an aspiration is now an engineering practice.
Felswerk exists to make Security Knowledge Intelligence possible.