Threat Intelligence

Threat Intelligence is the systematic collection, evaluation and classification of information about threat actors, tactics, vulnerabilities and attack patterns in IT security. Raw data is turned into usable insights that support security teams in their decisions. Depending on the objective, threat intelligence can be used strategically, operationally or tactically. Strategically, it helps with priorities and investments, operationally with situation pictures, and tactically with indicators of compromise or TTPs.

The added value increases significantly when the information is related to the organization's own industry, region, technologies and exposure – and to the Threat Actors actually relevant to it. Threat intelligence is therefore not an end in itself, but a tool for better prioritization of risks. In modern security programs, it frequently flows into detection rules, hunting hypotheses and management decisions. The term thus stands for context-based knowledge that makes defensive measures more targeted and effective.

See also: Adversary Intelligence and MITRE ATT&CK.