Cyber threat intelligence (CTI) is information that helps an organisation identify, assess, monitor and respond to cyber threats. It ranges from indicators such as malicious domains to analysis of attacker techniques. It is only useful when tied to a decision: what to block, what to hunt for, what to fix first.
What counts as threat information?
NIST SP 800-150, the guide to cyber threat information sharing, defines it broadly: any information that can help an organisation identify, assess, monitor and respond to cyber threats. It lists indicators of compromise, tactics, techniques and procedures used by threat actors, suggested actions to detect, contain or prevent attacks, and findings from analyses of incidents.
Two terms separate the types. Indicators are specific artefacts, such as an IP address or file hash, and they expire fast. Techniques describe behaviour, and they stay useful far longer, because changing behaviour is harder for an attacker than changing an address.
What are the levels of CTI?
A common way to organise it, offered as a practical split and not a formal standard:
Technical. Indicators for tools to match. Short lived, machine friendly.
Tactical. How attackers operate, often expressed with MITRE ATT&CK techniques. Used by detection engineers and incident responders.
Operational. What a specific campaign is doing now and who it is targeting. Used by security managers to adjust defences.
Strategic. Trends for executives and planners. Used to decide where to invest.
How is it shared?
STIX, Structured Threat Information Expression, is described by its maintainers as a language and serialisation format used to exchange cyber threat intelligence. It represents suspicion, compromise and attribution as objects and relationships, can be stored as JSON, and is open source. It lets different tools exchange the same information without custom conversion. Its sibling for transport, TAXII, is the protocol commonly paired with it.
NIST SP 800-150 covers the human side: setting sharing goals, identifying sources, scoping activities, writing rules for how information may be distributed, engaging sharing communities and using what you receive.
What does a real use look like?
CISA's DarkSide advisory is a worked example. It names ATT&CK techniques the actors used, such as phishing and external remote services, publishes indicators in STIX form, and lists mitigations. A team reading it can do three different things: block the indicators now, check whether their own remote access matches the pattern, and plan the segmentation and backup changes.
A constructed example: a regional bank reads that a campaign targets remote desktop gateways with password-only sign-in. They do not need the malware hash. They check their own gateways, find one without multifactor authentication, and fix it the same day. That is CTI doing its job.
What goes wrong?
Collecting without deciding. Subscribing to ten feeds and sending the indicators to a log store nobody reads. Treating every indicator as equally important, or never expiring old ones. And ignoring the question "does this apply to us?" Intelligence about an industry you are not in is trivia.
How do you judge quality?
Ask four things of any report or feed. Who produced it, and how do they know? How recent is it? Does it say how confident the authors are? And can you act on it with the tools you have? STIX 2.1 added a concept of confidence for this reason. Government advisories name their sources and techniques, which makes them easy to test against your own environment. Unsourced claims of a new threat group should be treated as leads to verify, not facts to repeat.
How to check or apply this
- Write three questions the intelligence should help answer, such as which techniques target our sector.
- Choose a small number of sources: government advisories, one sector sharing group, your own incident data.
- Map reports to ATT&CK techniques and check your detections against them.
- Feed indicators to blocking and detection with an expiry date.
- Record what changed because of each report, even if it is nothing.
- Review the sources quarterly and drop those that never changed a decision.
Where the intelligence concerns a vulnerable software package, Safeguard's zero-day monitoring and reachability analysis can show whether your code is exposed to it.
Quick check
Is a threat feed the same as threat intelligence?
No. A feed is raw data, usually indicators. Intelligence is that data placed in context for a decision about your environment.
What is STIX?
An open language and JSON format for exchanging cyber threat intelligence between tools and organisations.
Sources
- NIST SP 800-150, Guide to Cyber Threat Information Sharing
- STIX introduction, OASIS CTI documentation
- CISA AA21-131A
Last reviewed: 18 October 2026.
