Cyber Threat Intelligence
What Is Threat Intelligence? A Complete Introduction
Cyber threat intelligence (CTI) is the collection, analysis, and application of information about current and potential cyber threats. It operates at four levels: strategic (executive decision-making), tactical (attacker techniques and procedures), operational (specific campaign details), and technical (machine-readable indicators like IP addresses and file hashes).
Andreas Johansson · Chief Executive Officer
Senior IT management leader with 25 years of experience in Cloud, Security, and Datacenter infrastructure.
Defining Cyber Threat Intelligence
Cyber threat intelligence is more than a feed of malicious IP addresses. It's the process of collecting raw data about threats, analyzing it in context, and producing actionable insights that help organizations prevent, detect, and respond to cyber attacks.
The distinction between data, information, and intelligence is critical:
- Data is raw, unprocessed observations — a log entry showing a connection to an IP address, a file hash from a malware sample, or a domain registration record.
- Information is data with basic context — that IP address belongs to a known botnet, that file hash matches a ransomware variant, that domain was registered yesterday.
- Intelligence adds analysis, relevance, and actionability — that botnet is being used by a threat group targeting your industry, using techniques your current detection doesn't cover, with an expected campaign timeline of the next 2-4 weeks.
The Four Types of Threat Intelligence
Strategic Intelligence
Audience: Executives, board members, and senior leadership.
Strategic intelligence provides high-level assessments of the threat landscape, industry trends, and geopolitical risks. It answers questions like: What threat groups target our industry? How is the threat landscape evolving? What security investments should we prioritize?
Formats: Threat landscape reports, industry risk assessments, board briefings, annual threat reviews.
Tactical Intelligence
Audience: Security architects, detection engineers, and SOC leads.
Tactical intelligence describes adversary tactics, techniques, and procedures (TTPs) — how attackers operate. It maps to frameworks like MITRE ATT&CK and helps teams build detection rules, tune security tools, and design defensive architectures.
Formats: TTP reports, detection rule recommendations, adversary playbooks, ATT&CK mappings.
Operational Intelligence
Audience: Incident responders, threat hunters, and security operations managers.
Operational intelligence provides details about specific threats — active campaigns, targeted organizations, attack timelines, and infrastructure being staged. It enables proactive defense and informed incident response.
Formats: Campaign alerts, flash reports, situational awareness briefings, threat actor profiles.
Technical Intelligence
Audience: Security tools (automated consumption) and SOC analysts.
Technical intelligence consists of machine-readable indicators of compromise — IP addresses, domains, file hashes, email addresses, URLs, and YARA rules. These indicators feed directly into SIEM, EDR, firewall, and email security tools for automated detection.
Formats: IOC feeds (STIX/TAXII), YARA rules, Snort/Suricata signatures, blocklists.
Sources of Threat Intelligence
- Open-source intelligence (OSINT). Government advisories (CISA, ENISA, NCSC), vendor threat reports, security researcher publications, VirusTotal, Shodan, AlienVault OTX, and social media.
- Commercial feeds. Paid threat intelligence services that provide curated, enriched, and timely indicators and analysis. Providers include Recorded Future, Mandiant, CrowdStrike, and industry-specific services.
- Information sharing communities. Industry-specific Information Sharing and Analysis Centers (ISACs) and Information Sharing and Analysis Organizations (ISAOs) facilitate peer-to-peer intelligence sharing.
- Dark web monitoring. Monitoring underground forums, marketplaces, and paste sites for mentions of your organization, stolen credentials, and attack planning.
- Internal telemetry. Your own security logs, incident reports, and threat hunting findings generate intelligence specific to your environment.
Making Intelligence Actionable
Intelligence that stays in reports doesn't protect anything. Making intelligence actionable requires integration:
- Feed technical IOCs into detection tools automatically
- Map tactical TTPs to detection rules and coverage gaps
- Brief operations teams on relevant campaigns and threat actors
- Inform executive decisions about security investments and risk acceptance
How SeqOps fits
SeqOps keeps its vulnerability data current, so newly published CVEs are matched against the software on your servers. It doesn't replace a threat intelligence platform; it shows the weaknesses in your cloud and servers that attackers commonly exploit.