Threat Intelligence is analysed information about threats that can help an organisation identify, assess, monitor or respond to malicious activity. NIST defines cyber threat information broadly as information that can help an organisation identify, assess, monitor and respond to cyber threats, including indicators of compromise, adversary tactics, techniques and procedures, recommended defensive actions and findings from incident analysis. Threat intelligence therefore differs from simply collecting threat data: intelligence implies analysis, context and relevance to a defensive decision. Its practical purpose is to improve the quality and timeliness of security decisions rather than merely increase the amount of information available to analysts.
Threat intelligence can exist at several levels of abstraction. Strategic intelligence addresses broader trends, threat activity and risk implications relevant to organisational leadership. Operational intelligence concerns campaigns, threat actors, infrastructure and attack patterns relevant to security planning. Tactical intelligence focuses on adversary tactics, techniques and procedures that can inform defensive detection and hunting. Technical intelligence commonly includes indicators such as IP addresses, domains, URLs, file hashes, certificates and other machine-readable artefacts. These categories overlap in practice, but the distinction helps determine who should consume the information and what decisions it is intended to support.
Indicators of compromise are only one component of threat intelligence. An IP address associated with malicious activity can be useful for detection, but its significance depends on context, confidence, age, infrastructure reuse and the possibility that the address is shared or compromised. Tactics, techniques and procedures can be more durable because they describe behaviour rather than a single indicator. For example, intelligence describing credential theft, lateral movement or persistence techniques can inform detection engineering even after particular malware samples or network addresses have changed. NIST explicitly includes indicators, TTPs, suggested defensive actions and incident-analysis findings within cyber threat information.
Threat intelligence originates from many sources, including internal incident investigations, security vendors, research organisations, government agencies, industry groups, information-sharing communities and open sources. Internal intelligence can be particularly valuable because it reflects the organisation's own environment and observed attacks. External sources provide broader visibility into campaigns and emerging threats. NIST's guidance emphasises establishing information-sharing goals, identifying sources, defining handling rules and participating in information-sharing communities. Intelligence sharing therefore involves governance as well as technical ingestion because information may have restrictions concerning confidentiality, attribution, privacy or permitted distribution.
Threat intelligence becomes operationally useful when it is connected to defensive controls. Indicators can be loaded into detection systems, firewalls, endpoint platforms, email security systems or SIEM correlation rules. TTP information can guide threat hunting and detection engineering. Intelligence reports can influence vulnerability prioritisation when they show active exploitation of particular weaknesses. Incident responders can use intelligence to determine whether observed infrastructure resembles a known campaign. The value of intelligence therefore depends on its ability to change a decision, detection, investigation or defensive action rather than merely being stored in a repository.
Intelligence quality involves dimensions such as accuracy, relevance, timeliness, confidence, completeness and provenance. Stale indicators may become harmless or be reassigned to legitimate infrastructure. A feed containing enormous quantities of low-confidence indicators can create operational noise. Analysts therefore need mechanisms for assessing source reliability, indicator age, confidence and environmental relevance. Automated enrichment can help, but automated decisions should account for the possibility that an indicator is shared, compromised or otherwise ambiguous. Threat intelligence should consequently be treated as evidence requiring contextual evaluation rather than as an unquestionable list of malicious values.
Threat intelligence has an important relationship with security monitoring and response. SIEM platforms can use intelligence to enrich events; EDR can use indicators and behavioural intelligence to improve endpoint detection; XDR can correlate external intelligence with multi-domain telemetry; and SOC analysts can use intelligence during investigations. Conversely, internal incidents can produce new intelligence that is shared with relevant communities. This creates a feedback cycle in which intelligence informs detection while detection and incident analysis produce additional intelligence. NIST specifically describes incident-analysis findings and defensive recommendations as forms of cyber threat information.
Threat intelligence is often misunderstood as equivalent to threat feeds or lists of malicious IP addresses and file hashes. Those feeds are useful forms of technical intelligence, but the broader discipline includes analysis, context, adversary behaviour, information sharing and decision support. Intelligence also does not guarantee detection or prevention because adversaries can change infrastructure, use legitimate services, conceal activity and exploit previously unknown weaknesses. Its most durable contribution is often improved understanding of how threats operate and what evidence should be monitored. Effective programmes therefore connect intelligence requirements to concrete security decisions, continuously evaluate source quality and feed useful findings into defensive processes.
