What Is threat intelligence?

The concept of intelligence isn’t anything new. It’s been used throughout history and in many different industries; we see it in OSINT, espionage and even market research, among others.

Threat intelligence, specifically, is collecting and analyzing information about indicators of past, current and future cyber threats, which enables an organization to take action to protect their assets, network and the entire organization. The keyword here is analysis.

Let’s think of it this way: You’ve compiled a list of all the data breaches that took place over the past year and the types of malware that caused them. That list may be informative, but it doesn’t do much good by merely existing. So what now?

You have to combine your historical knowledge with data on current threats, attack vectors, existing and exploited vulnerabilities, threat actors that are specific to your industry, then analyze and compare them to find the needle in the haystack that will yield the relevant intel that helps you prevent cyberattacks on your infrastructure.

One of the biggest takeaways of cyber threat intelligence is the change of security approach from reactive to proactive. It brings proactive defense against any threats that emerge outside your landscape before they even hit you. But it can only do that if it’s relevant, punctual and actionable.

So, data presented in cyber threat intelligence needs to be:

• Contextualized
• Evidence-based
• Relevant

The biggest challenge is setting the groundworks for threat intelligence. There needs to be the goal of threat intelligence, which in most cases is to protect the organization from a data breach and damage to their reputation. After setting the goal, we get to the intelligence requirements which would, for example, be knowing what the active threat actors are in your industry.

Once you have both goal and requirements set, that’s when you can decide what should be collected, then how to prioritize and analyze it further.

Types of threat intelligence

We can distinguish four main categories of threat intelligence:

Strategic	The big picture of past, current and future trends in the threat landscape
Operational	Specifics about the nature and purpose of attacks and attackers.
Tactical	Techniques, tools and tactics of the attackers
Technical	Technical indicators about malware and campaigns (threat intelligence  feeds)