What is threat intelligence, and how does it differ from raw threat information? Describe the different types of threat intelligence and their use cases.

Question

Accepted Answer

Threat intelligence is analyzed, contextualized, and actionable information about potential or current threats that helps organizations make informed security decisions. It transforms raw data into insights that guide defensive actions and strategic planning.

Raw threat information consists of unprocessed data about potential threats: IP addresses, domain names, file hashes, or reports of attacks. This data lacks context about relevance, reliability, or recommended actions. Threat intelligence adds analysis that answers questions like: Is this threat relevant to our organization? How reliable is this information? What should we do about it? Who is behind the threat, and what are their motivations?

Threat intelligence is typically categorized into four types based on audience and timeframe. Strategic intelligence provides high-level information about the threat landscape for executive and board-level audiences. It addresses questions about which threat actors target organizations in your industry, what their motivations are, and how the threat landscape is evolving. Strategic intelligence informs risk management decisions, security investment priorities, and organizational policy. It typically has a longer shelf life, remaining relevant for months or years.

Tactical intelligence describes the tactics, techniques, and procedures used by threat actors. It helps security teams understand how attacks are conducted and how to detect and defend against them. For example, tactical intelligence might describe how a particular ransomware group gains initial access, moves laterally, and deploys encryption. Security architects and detection engineers use tactical intelligence to design controls and create detection rules.

Operational intelligence provides information about specific impending attacks or active campaigns. It might include details about threat actors planning to target a particular industry during a specific timeframe, or indicators that a known campaign is expanding its targeting. Operational intelligence has a shorter shelf life and requires timely action.

Technical intelligence consists of specific technical indicators such as IP addresses, domains, file hashes, and malware signatures. This is the most granular form of intelligence, directly consumed by security tools for automated blocking and detection. Technical indicators have the shortest shelf life, as attackers frequently change their infrastructure.

Effective threat intelligence programs produce or consume intelligence across all four types, matching the right intelligence to the right audience and integrating it into security operations, architecture decisions, and strategic planning.