What Is Threat Intelligence?

Threat intelligence is information about adversaries — who they are, what they target, how they operate — processed into a form that changes a decision. Information that does not change a decision is a newsletter.

That distinction is the whole discipline. Most organisations consume a great deal of threat information and act on very little of it, which is a processing failure rather than a supply problem.

The three levels, and who uses each

Strategic — which adversaries target your sector and what they are after. Audience: leadership deciding where to invest. Operational — how specific groups behave, which techniques they favour, what their tooling looks like. Audience: detection engineers and hunters.

Tactical — indicators such as addresses, domains and file hashes. Audience: automated blocking and enrichment. This level is the most widely consumed and the shortest-lived.

Indicators expire quickly

Addresses and domains are cheap for adversaries to replace, and frequently are, sometimes within hours. Feeding large volumes of them into blocking infrastructure produces a growing list of stale entries and a false sense of coverage.

Behavioural intelligence — how a group operates rather than what infrastructure it used last week — has a far longer useful life, because changing technique is expensive where changing a domain is not.

Relevance filtering is the missing step

A feed describing campaigns against industries and platforms you do not operate consumes attention without changing anything. Filtering for your sector, your geography and your actual technology stack is what converts volume into signal.

Sector-specific sharing communities are usually more valuable per item than broad commercial feeds, because the filtering has already happened and the adversaries described are demonstrably interested in organisations like yours.

Attribution is interesting and rarely actionable

Which nation or group was responsible makes compelling reading and seldom changes what you do. The defensive value sits in technique — how initial access was obtained, how persistence was established, how data left — because those map to controls and detections.

MITRE ATT&CK exists largely to make that mapping systematic, which is why it has become the common vocabulary between intelligence and detection.

Your own environment is a source

The highest-relevance intelligence available is what has already been attempted against you. Phishing reported by staff, blocked exploitation attempts, credential stuffing patterns on your own login — all of it describes adversaries demonstrably interested in you, and most of it is discarded.

Sharing back, and what to be careful about

Sector sharing communities work because members contribute. Reporting what you have seen — phishing themes, indicators from blocked attempts, techniques observed — improves what you receive, and the reciprocity is usually the condition of membership rather than a courtesy.

The care needed is around what leaves with it. Indicators and techniques are shareable; customer data, internal system names, affected account identifiers and anything that identifies your specific exposure are not. Agreeing in advance what may be shared, and who approves it, prevents that decision being made hurriedly during an incident.

Where to start

Take the last threat report your organisation received and identify what changed as a result. If nothing did, the gap is in processing rather than in sourcing.

See building a threat intelligence programme. GuardsArm delivers threat intelligence.