What Is Cyber Threat Intelligence?

Cyber threat intelligence, commonly abbreviated CTI, is the discipline of collecting, analyzing, and distributing evidence-based knowledge about adversaries who attack computer systems, so that defenders can make better decisions about where to spend limited resources. It adapts the intelligence tradecraft of national security agencies to computer crime and intrusion, replacing troop movements and procurement records with malware samples, network telemetry, criminal forum activity, and incident response findings. The distinction that matters is between data and intelligence: a list of malicious IP addresses is data, while an assessment of which adversary is likely to target a given organization, using which techniques, and what that implies for control priorities, is intelligence.

The NIST guide to cyber threat information sharing sets out the categories that constitute the raw material: indicators of compromise, the tactics, techniques, and procedures adversaries use, recommended detection and containment actions, and analytic findings from investigated incidents. It also describes the organizational work of establishing sharing goals, scoping what may be released, and joining existing communities, which in practice consumes as much effort as the analysis itself.

Levels of Intelligence

Practitioners separate output into three levels by audience and time horizon. Strategic intelligence addresses executives and boards, covering adversary motivation, geopolitical drivers, and sector-level risk trends on a timescale of months. Operational intelligence describes specific campaigns and threat actor groups, informing hunting priorities and architectural decisions over weeks. Tactical intelligence consists of the technical artifacts consumed by detection systems: file hashes, domains, addresses, and signatures, useful immediately but decaying quickly. A well-known consequence of this hierarchy is that the cheapest indicators for a defender to collect are also the cheapest for an adversary to change, which argues for investing analytic effort in behavior rather than artifacts.

Analytic Frameworks

Several models structure how intrusions are decomposed. The cyber kill chain, published by Lockheed Martin researchers in 2011, breaks an intrusion into sequential phases from reconnaissance through actions on objectives, and supports the argument that defenders need only break one link. The diamond model of intrusion analysis relates adversary, capability, infrastructure, and victim as four vertices, which suits pivoting between observed artifacts during an investigation. The most widely deployed today is MITRE ATT&CK, a curated knowledge base of adversary tactics and techniques observed in real intrusions, organized into matrices for enterprise, mobile, and industrial control systems. Its technique identifiers have become a common vocabulary that lets detection coverage, red team exercises, and vendor product claims be compared against the same reference.

Sharing Standards and Communities

Intelligence loses value if it cannot move between organizations quickly and unambiguously, which motivated machine-readable exchange formats. STIX, the Structured Threat Information Expression language, provides a graph-based object model for representing indicators, campaigns, threat actors, malware, and the relationships among them, while its companion protocol TAXII defines how those objects are transported over HTTPS. Both were approved as OASIS standards in version 2.1 in 2021. Distribution happens through sector-specific Information Sharing and Analysis Centers, government programs such as automated indicator sharing operated by national cybersecurity agencies, commercial feeds, and closed trust groups. Handling restrictions are conveyed with the Traffic Light Protocol, whose version 2.0 marks a report TLP:RED, TLP:AMBER, TLP:GREEN, or TLP:CLEAR to tell recipients how widely it may be redistributed. Persistent difficulties include indicator quality, duplicate reporting across feeds, liability concerns that discourage victims from disclosing, and the risk that shared context identifies the reporting organization.

Applications

Cyber threat intelligence has applications in a range of fields, including:

• Security operations center alert triage and prioritization
• Threat hunting and detection engineering
• Incident response scoping and attribution
• Vulnerability management prioritized by observed exploitation
• Fraud prevention in financial services
• Critical infrastructure and industrial control system protection
• Third-party and supply chain risk assessment