A domain is a fact about an adversary for a few days. A behavior is a fact about how they work for a few months. Intelligence programs that only ship indicators are, without meaning to, building detections with an expiry date they never write down.
Attack Nemesis’s view is practical, not theological. Indicators still matter — they are how you catch the first beacon, how you hunt a known loader, how you answer the board when they ask whether you saw the campaign in the news. They are a terrible sole metric.
The conversion that matters is this: every finished report should name the behaviors that remain after the infrastructure is burned. Those behaviors become detections and tickets with owners and review dates. The indicators go on a 14-day clock. When they age out, coverage does not.
We have been running this with a set of public-sector and critical-infrastructure customers since winter. Median time from report to a signed action in the stack is now under a day. Indicator-only rules are auto-retired. The SOC did not get noisier. The incidents that used to arrive as a surprise now arrive as a bound object with a ticket already waiting.