What is threat intelligence?
Definition, types, the production cycle, the standards used to share it, and how a mid-sized company can start using it without building an analyst team.
On this page
Threat intelligence (cyber threat intelligence, or CTI) is information about adversaries, their methods and their infrastructure, analysed and put in context so an organisation can decide how to prevent, detect and respond to an attack. It is not a list of indicators: it is information that supports a specific decision, with a source, a date and a confidence level.
What is threat intelligence, in detail
NIST describes cyber threat information as data that helps an organisation deal with cyber threats, including indicators of compromise, and notes that organisations that share it improve their own security posture [1]. Two ideas are worth keeping from that definition: the information exists to serve a decision, and its value grows when it circulates between organisations.
In practice we separate three layers, and it helps not to mix them:
- Data: a hash, an IP address, a domain. On its own it says nothing.
- Information: that data linked to a campaign, a malware family or a specific vulnerability.
- Intelligence: the information assessed against your environment. "This campaign exploits a product we run and have not yet patched" is intelligence; "this IP is malicious" is, at most, data.
This split is our working criterion, not a standard: it is a reminder that the value is created in the third layer.
The four types of threat intelligence
A common working framework (not a standard) separates four levels according to who consumes it:
| Type | Question it answers | Who uses it | Example |
|---|---|---|---|
| Strategic | Which threats matter to our business, and why? | Executives, risk committee | Sector report on groups that target your industry |
| Operational | Which campaign is active and how does it operate? | Head of security, incident response | Description of an ongoing ransomware campaign |
| Tactical | Which techniques does the adversary use? | Detection engineering, threat hunting | Techniques mapped to MITRE ATT&CK |
| Technical | Which concrete artefacts should we block or search for? | SOC, automated tooling | Hashes, domains, IP addresses |
MITRE ATT&CK is the common reference for the tactical level: a knowledge base of adversary tactics and techniques built from real-world observations [2]. Mapping detections to ATT&CK shows which techniques you cover and which you do not.
How it is produced: the intelligence cycle
Intelligence is not downloaded, it is produced. The classic cycle has six steps:
- Requirements: which decisions it must support (patch, prioritise, invest). Without this, everything else is noise.
- Collection: open sources, CERT/CSIRT bulletins, sector exchanges, commercial providers and your own telemetry.
- Processing: normalise, deduplicate, discard what has expired.
- Analysis: check against your asset inventory and exposure, and assign a confidence level.
- Dissemination: deliver to each consumer in their own format (a note for the board, a detection rule for the SOC).
- Feedback: measure whether it helped decide anything. If it did not, change the requirements.
Sources and standards for sharing it
A good practice is to combine several sources with different biases. Two free public examples:
- CISA's catalogue of vulnerabilities exploited in the wild, which it describes as the authoritative source of such vulnerabilities [3].
- Threat landscape reports such as the ENISA Threat Landscape 2025, which analyses 4,875 incidents between 1 July 2024 and 30 June 2025 [4].
Open standards exist for exchanging information between organisations:
- STIX is a language and serialisation format for exchanging cyber threat intelligence, and TAXII is an application-layer protocol for transporting it over HTTPS [5].
- TLP 2.0 (Traffic Light Protocol) labels how far each piece may be redistributed: TLP:RED, TLP:AMBER, TLP:GREEN and TLP:CLEAR [6].
What the data says and how it changes your prioritisation
The ENISA report identifies phishing (60%) and vulnerability exploitation (21.3%) as the two leading initial access points in the incidents it analysed [7]. It is an aggregate figure and does not describe your company, but it shows where to look first: email and exposed systems.
This is where intelligence turns into a very concrete task, patch prioritisation. A catalogue of exploited vulnerabilities [3] shows which flaws are already used in real attacks, and models such as EPSS estimate the probability that a published CVE will be exploited [8]. Combined with technical severity (CVSS [9]) and with what you actually have exposed, they stop you patching in alphabetical order.
What it is for in a company, case by case
- Vulnerability management: decide what gets fixed this week and what can wait.
- Detection: turn adversary techniques into rules and searches. It is the foundation of a managed SOC (SOCaaS / MDR), where intelligence feeds threat hunting.
- Incident response: NIST integrates incident response into cybersecurity risk management and the CSF 2.0 framework [10]; adversary context shortens the analysis phase.
- Offensive testing: aim a pentest or Red Team at the techniques that attackers in your sector really use.
- Third-party risk: manage the risk of critical suppliers, an area covered by our third-party and supply chain risk management solution and the HodeiShield platform.
- Leadership and compliance: justify investment with threats that are relevant to the business, within a GRC consulting approach.
Common mistakes
- Piling up feeds without context. More indicators is not more intelligence; without cross-checking them against your inventory they only generate alerts.
- No defined consumer. If nobody decides anything with it, it is not intelligence.
- Ignoring expiry. An indicator from months ago may today be a legitimate, reassigned address.
- Not closing the cycle. Without feedback, requirements are never refined.
- Treating it as a product rather than a process. Buying a subscription does not replace analysis.
How to start without an analyst team
- Write down three decisions you want to support (for example, what to patch first, which suppliers to watch, which detection rules to prioritise).
- Inventory your internet-facing assets; without that inventory there is no context.
- Subscribe to two or three quality sources and drop the rest.
- Assign an owner and a weekly review cadence.
- Measure: which decision changed this week thanks to intelligence?
If you would rather not build it in-house, a SOCaaS / MDR service brings this cycle with analysts. And if you want to know what an attacker sees of your domain from the outside, you can ask about places in the external radar.
And artificial intelligence: does it change anything?
Yes, but it does not replace the cycle. We cover that in a separate article: how AI improves threat intelligence compared with traditional methods.
Frequently asked questions
What is threat intelligence?
It is information about adversaries and their methods, analysed in the context of your organisation to support a specific security decision: what to patch, what to watch, what to detect or where to invest.
What is the difference between an indicator of compromise and intelligence?
An indicator of compromise (hash, IP, domain) is a technical data point. Intelligence links it to a campaign, assesses its relevance to your environment and gives it a source, a date and a confidence level. NIST counts indicators as part of cyber threat information, but the latter is broader [1].
Does a small or mid-sized business need threat intelligence?
Yes, although it does not need its own team. Using reliable public sources, such as CISA's catalogue of exploited vulnerabilities [3], is enough to decide what to patch first, or you can hire a managed service to do it for you.
What are STIX, TAXII and TLP?
STIX and TAXII are open standards for describing and transporting cyber threat intelligence [5]. TLP is a labelling system that says how far a piece of information may be shared [6].
How does it relate to MITRE ATT&CK?
ATT&CK provides a common vocabulary of tactics and techniques [2]. Tactical intelligence is expressed in those terms so the detection team knows which techniques it must cover.
Next step
If you want to turn intelligence into real detection and response, talk to the Hodeitek team or get to know HodeiShield, our platform for third-party risk management and compliance.
Sources
- Guide to Cyber Threat Information Sharing (SP 800-150). NIST. https://csrc.nist.gov/pubs/sp/800/150/final
- MITRE ATT&CK. MITRE. https://attack.mitre.org/
- Known Exploited Vulnerabilities Catalog. CISA. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- ENISA Threat Landscape 2025. ENISA, 2025-10-01. https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025
- STIX and TAXII documentation. OASIS Open. https://oasis-open.github.io/cti-documentation/
- Traffic Light Protocol (TLP) 2.0. FIRST. https://www.first.org/tlp/
- ETL 2025: EU consistently targeted by diverse yet convergent threat groups. ENISA, 2025-10-01. https://www.enisa.europa.eu/news/etl-2025-eu-consistently-targeted-by-diverse-yet-convergent-threat-groups
- Exploit Prediction Scoring System (EPSS). FIRST. https://www.first.org/epss/
- Common Vulnerability Scoring System (CVSS). FIRST. https://www.first.org/cvss/
- Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (SP 800-61 Rev. 3). NIST, 2025-04-03. https://csrc.nist.gov/pubs/sp/800/61/r3/final
Self-check your SOC's toil
Estimate how much repetitive SOC work you could automate with AI/orchestration, in 2 minutes.
Was this article useful?
Gorka Gonzalo
Founder & CEO
Founded Hodeitek in 2023 and runs the company, after more than 8 years in pentesting, Red Team, OT/ICS auditing, and SOC leadership. A cybersecurity and AI expert, he sets the technical and product direction of HodeiShield and personally leads the most critical engagements — from defense strategy to applying AI in threat detection. He is the client's direct point of contact: whoever scopes the work also answers for the result.