Callum Harvey is a cyber and disinformation policy researcher and practitioner attending Oxford as a Ramsay Postgraduate Scholar. He completed the MSc in Social Science of the Internet at the OII in 2025, with a thesis examining policy responses to disinformation through policymaker interviews in the UK, USA, and Romania. Callum also holds undergraduate degrees in digital media and international relations from the University of Wollongong, Australia.

‍

Mariarosaria Taddeo is Professor of Digital Ethics and Defence Technologies at the Oxford Internet Institute (OII), University of Oxford, where she leads the Digital Ethics and Defence Technologies research group. Her work focuses on digital ethics, the analysis of the ethical and social implications of artificial intelligence (AI) and other emerging technologies in high risk domains, including national defence, cybersecurity, cyber conflicts. Her research has been published in leading journals including Nature, Nature Machine Intelligence, Science, and Science Robotics.

The use of artificial intelligence (AI) by threat actors raises pressing questions about the role of AI firms in cyber threat intelligence (CTI). While substantial attention has been paid to the application of AI tools in CTI, there has been little academic examination of how AI firms function as producers and gatekeepers of CTI or how intelligence about AI-enabled threat actor tactics, techniques and procedures are shared with other stakeholders across government and civil society. In particular, the lack of critical engagement with information asymmetries benefiting AI firms investigating the misuse of their own systems warrants closer examination.This article presents a systematic literature review drawing on CTI literature, approaches from critical intelligence studies and critical data studies, and considerations of information asymmetry in cybersecurity. It identifies four themes: contested terminology describing non-state gatekeepers of online services, including AI; tension in how those gatekeepers are treated as intelligence producers within a broader environment of security privatisation; a focus in CTI literature on AI as a capability enhancing tool rather than on AI firms as intelligence producers; and vertical integration of data ownership, analytic capabilities and dissemination control influencing the transaction cost of sharing intelligence. In doing so, this paper identifies a significant gap in how literature accounts for AI firms as a distinct class of actor in CTI, and provide one of the first review analyses of the role of AI firms in cybersecurity. 

‍