Cyber Threat Intelligence: What It Is, How It Works
Cyber threat intelligence (CTI) is threat information that has been analysed and put in context so someone can make a decision with it. NIST's glossary (from SP 800-150) defines threat intelligence as threat information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making.
A list of suspicious addresses is data. Intelligence says which of them matter to your organisation, how confident the source is, and what to do about it.
Updated 3 November 2026
The four types of threat intelligence
| Type | Audience | Answers | Example |
|---|---|---|---|
| Strategic | Board, executives | Who targets our sector and why? | A briefing on adversary intent informing budget |
| Operational | Incident responders, hunters | How do these attackers operate? | A campaign report with its stages |
| Tactical | Detection engineers, SOC | What techniques should we detect? | Techniques mapped to MITRE ATT&CK |
| Technical | Tools and automation | What can we block or match now? | Hashes, domains, IP addresses |
Labels differ across vendors; what matters is matching the product to the reader.
The intelligence cycle
- Direction. Decide the questions: which assets and adversaries matter, what decisions need support.
- Collection. Gather from internal telemetry, incident reports, government alerts, vendor research, and sharing communities.
- Processing. Normalise, deduplicate and enrich.
- Analysis. Judge reliability, state confidence, and say what it means for you.
- Dissemination. Deliver the right form to each audience: a one-page brief to executives, detection content to engineers.
- Feedback. Ask whether it changed a decision; adjust direction.
Indicators age fast, behaviours last
Indicators of compromise such as hashes and domains are easy to match and easy for attackers to change. Techniques (how they get in, move and steal) change more slowly, which is why the MITRE ATT&CK framework is the usual shared language for tactical intelligence. Use indicators for fast blocking and techniques for detection that lasts.
Where intelligence comes from
- Your own telemetry and incidents, the most relevant source you have.
- Government catalogues such as CISA's Known Exploited Vulnerabilities list; check a CVE with the KEV checker.
- Vendor and researcher reports, judged by who wrote them and what evidence they show.
- Sharing communities, covered in NIST SP 800-150 on threat information sharing.
- Free APIs and feeds, compared in free threat intelligence APIs.
Rate every source on reliability and every claim on credibility; unverified claims should be labelled as claims in your briefing.
Put it to work
Practise pivoting from one domain or hash to related infrastructure on the CTI pivot board, and design how feeds enter your tooling with the CTI feed architect. Many indicators originate from malware analysis, and consumers range from red and blue teams to the board.
Frequently asked questions
What is cyber threat intelligence?
Cyber threat intelligence (CTI) is threat information that has been aggregated, transformed, analysed, interpreted or enriched to provide the context needed for decision-making (NIST glossary, from SP 800-150). Raw indicators are information; intelligence adds who, why, how reliable and what to do.
What are the types of threat intelligence?
Common practice splits it by audience: strategic (executives and board: trends, adversary intent, risk), operational (defenders: campaigns and how attackers operate), tactical (analysts and engineers: techniques and procedures) and technical (machines: indicators such as domains, hashes and IP addresses). Labels vary between sources.
What is the difference between threat data, threat information and threat intelligence?
Data is raw observations, information is data with some processing, and intelligence is information analysed in context for a specific decision. A list of bad IP addresses is data; a note saying which of them target your sector this month and what to block is intelligence.
What are indicators of compromise?
Indicators of compromise (IOCs) are observable artefacts that suggest an intrusion, such as file hashes, domain names, IP addresses or registry keys. They go stale quickly because attackers change infrastructure, so behaviours (techniques) usually last longer than indicators.
What is the intelligence cycle?
A repeating loop of direction (what do we need to know), collection, processing, analysis, dissemination and feedback. Teams that skip direction collect everything and use little of it.
What does a threat intelligence analyst do?
Collects and evaluates reporting, tracks adversaries relevant to the organisation, maps behaviour to frameworks such as MITRE ATT&CK, produces briefings for different audiences and feeds detections and priorities to the security team. Writing clearly matters as much as technical depth.
Where can I get free threat intelligence?
Government sources such as the CISA Known Exploited Vulnerabilities catalog, vendor and researcher blogs, community sharing groups (ISACs) and open feeds. Free sources vary in quality and timeliness, so judge each by who produced it and how it was verified.