Cyber threat intelligence (CTI) is evidence-based knowledge about adversaries: who they are, what they want, how they operate and what tools they use. Defenders use it to anticipate, detect and respond to attacks. It applies the intelligence cycle to cyberspace. Many organisations buy “threat feeds” and believe they have threat intelligence. In fact, a list of malicious IP addresses is data. It becomes intelligence only when it is analysed in relation to the organisation’s own risks and decisions.
Three levels of CTI
| Level | Audience | Questions | Example products |
|---|---|---|---|
| Strategic | Boards, executives, policymakers | Who might target us and why? How is the threat landscape changing? | Annual threat assessments, briefings on state actors or ransomware economics |
| Operational | Security managers, incident responders | Which campaigns are active against our sector? What are they likely to do next? | Campaign reports, actor profiles |
| Tactical / technical | Security operations, detection engineers | What do attacks look like on our networks? | Indicators of compromise (IOCs), detection rules, malware analysis |
Frameworks analysts use
The Cyber Kill Chain (Lockheed Martin, 2011) breaks an intrusion into stages: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. The insight is that defenders can break the chain at any stage, and that detecting an attack early is far cheaper than responding late.
The Diamond Model (Caltagirone, Pendergast and Betz, 2013) describes every intrusion event by four linked features: adversary, capability, infrastructure and victim. Pivoting between them helps analysts link incidents into campaigns. For example, they can move from a malware sample to its infrastructure, and from there to other victims.
MITRE ATT&CK is a public knowledge base of adversary tactics (goals, such as persistence or lateral movement) and techniques (how goals are achieved), based on real-world observations. It has become the common language of the field. Analysts map threat reports to ATT&CK techniques, and defenders measure their detection coverage against it. That shifts focus from fragile indicators such as IP addresses and file hashes, which attackers change easily, to behaviours, which are much harder to change. Security practitioners call this idea the “pyramid of pain”.
Sharing intelligence
No single organisation sees enough of the threat landscape alone, so sharing is central to CTI:
- Sector sharing communities (ISACs/ISAOs) bring together organisations in finance, health, energy and other sectors.
- National CERTs/CSIRTs and cybersecurity agencies issue alerts and coordinate responses.
- Standards such as STIX (a format for describing threat information) and TAXII (a protocol for exchanging it) make sharing machine-readable.
- The Traffic Light Protocol (TLP) marks how widely shared information may be passed on: TLP:RED, AMBER, GREEN or CLEAR.
NIST’s guide to cyber threat information sharing (SP 800-150) covers how to set up sharing relationships, protect sensitive data and decide what to share.
National cyber strategies
Since the 2000s, almost every major country has published a national cyber or information security strategy. The strategies differ in emphasis in ways that matter for analysts:
- United States and allies emphasise protecting critical infrastructure, public–private partnership, shifting security responsibility to software makers and service providers, and the role of offensive and defensive cyber capabilities.
- The European Union relies on regulation. The NIS2 Directive (2022) extended cybersecurity and incident-reporting obligations to many more sectors and medium-sized entities, and newer laws regulate the security of connected products.
- China frames the issue around cyberspace sovereignty (网络主权). Its Cybersecurity Law (2016), Data Security Law (2021) and Personal Information Protection Law (2021) create a comprehensive regime for network security, data classification and cross-border data transfer.
- Russia has long used the broader concept of information security, which includes the content of information and its effect on society as well as the security of systems. This concept runs through its information security doctrines and its proposals at the United Nations.
The Tallinn Manual, produced by international law experts under the NATO Cooperative Cyber Defence Centre of Excellence, analyses how existing international law applies to cyber operations. It is not a binding treaty, but it is widely used as a reference in debates on sovereignty, the use of force and state responsibility in cyberspace.
Building a CTI capability
- Define requirements. Which assets matter most? Which threats are realistic for your sector and size? What decisions will intelligence support?
- Collect from internal sources first. Logs, incidents and phishing reports reveal who is actually targeting you.
- Add external sources selectively: sharing communities, government alerts, vendor reports and open sources.
- Analyse against your environment. Map threats to ATT&CK techniques and check whether you can detect them.
- Deliver at the right level: detection rules for engineers, campaign briefings for managers and risk assessments for executives.
- Measure outcomes. Count detections, prevented incidents, reduced response times and decisions supported, not the number of indicators ingested.
Where the field is going
AI is changing both sides. Attackers use it to write convincing phishing in any language, find vulnerabilities and scale operations. Defenders use it to triage alerts, summarise reports and analyse malware. AI systems are also becoming targets in their own right, through prompt injection, data poisoning and model theft. MITRE’s ATLAS knowledge base now catalogues these attack techniques. The fundamentals of CTI remain those of intelligence: clear requirements, rigorous analysis, honest confidence levels and products that support real decisions.