Threat intel gets useful when you stop chasing feeds and start mapping flows — ULM shows how attacks actually move, so CISOs ...