Log in Request a demo

Glossary

Human Intelligence (HUMINT).

Also called human-source intelligence

Learn more
Threat Intelligence Platforms 101
Product track
Cyber Threat Intelligence
In Short

Human intelligence, or HUMINT, is intelligence derived from information collected and provided by human sources. The US Department of Defense dictionary defines it this way. In cyber threat intelligence it means learning about threats through people, such as sources inside criminal communities, rather than only from technical data.

Last updated November 1, 2026
Profile MapGlossary Term
  1. Also Called1other namehuman-source intelligence
  2. Related Terms3linked entriesUnderground forum · Threat intelligence
  3. Read Next1guide on the same topic

How Does HUMINT Work?

The US Department of Defense Dictionary of Military and Associated Terms defines human intelligence as a category of intelligence derived from information collected and provided by human sources. The source is a person, not a sensor or a log file.

In cyber threat intelligence, as a general illustration, a team may build relationships with people in closed criminal communities, talk directly with sellers on an underground forum. It may also speak with insiders and victims. Analysts then check what they hear against technical evidence.

How Is It Different from OSINT and Technical Intelligence?

Open source intelligence, or OSINT, uses publicly available information. Technical intelligence uses data such as malware samples, domains and network traces. HUMINT adds what people say and intend, which these other types often cannot show. For example, a conversation with a seller can reveal who plans to sell access to a company, and why, before any technical trace exists.

Why Does It Matter?

Technical data tells you what happened. People can tell you what is planned and why. HUMINT can add early warning and context to alerts, such as who is behind an offer and what they want.

It also carries risk: sources can lie, and contact with criminals can raise legal and safety questions. Findings should be treated as claims to verify, not as facts.

How Do You Use It Well?

US Intelligence Community Directive 203 sets analytic standards. It tells analysts to describe the quality and credibility of the sources behind a judgment. The factors it names include source access, motivation, possible bias, expertise, and possible denial and deception. The steps below turn those factors into a check for a human source report.

Checking a Human Source Report
  1. Ask how close the source isICD 203 lists source access as a factor. Did the person see it first hand or repeat what they heard?
  2. Ask what the source wantsThe directive lists motivation and possible bias. A seller may want to look bigger or to hurt a rival.
  3. Look for denial and deceptionThe directive names possible denial and deception. Ask whether the claim could be bait.
  4. Check age and accuracyThe directive lists accuracy, completeness and the age and currency of information. Is the claim still true today?
  5. Validate and state your uncertaintyCompare the claim with technical evidence. ICD 203 asks analysts to express and explain uncertainty.
  6. Write a source summaryICD 206 strongly encourages a short summary of the strengths and weaknesses of the source base.

Follow your legal and ethical rules before any contact with a threat actor. If you do not have a team for this work, use a provider that does it for you.

Brandefense Cyber Threat Intelligence supports analysts who work with sources like these.

Also Called.

  • Namehuman-source intelligence

Questions.

  • What does HUMINT stand for?

    HUMINT stands for human intelligence. The DoD Dictionary defines it as a category of intelligence derived from information collected and provided by human sources.

  • What is HUMINT in cyber threat intelligence?

    It means gathering insight on threats from people, such as sources in criminal communities, and checking it against technical evidence.

  • Is HUMINT the same as OSINT?

    No. OSINT uses publicly available information. HUMINT comes from human sources.

  • How do you judge a human source report?

    US Intelligence Community Directive 203 tells analysts to describe source quality and credibility, with factors such as access, motivation, possible bias and possible deception. Then check the claim against other evidence and state the uncertainty.

Sources

  1. 1 DoD Dictionary of Military and Associated Terms, human intelligence, US Department of Defense
  2. 2 Intelligence Community Directive 203, Analytic Standards, US Director of National Intelligence

In Our Research

  1. 1 Konni (Vedalia / TA406 / Opal Sleet): North Korea’s Steady Hand in Espionage Operations March 2026
  2. 2 DarkHotel (APT-C-06 / ATK52 / DUBNIUM): The Global Espionage Network Behind Elite Cyber Intrusions March 2026
  3. 3 Moonlight Tiger (APT-C-09, Patchwork, Dropping Elephant): India’s Silent Espionage Arm in the Digital Battlefield December 2025
  4. 4 How to Leverage Emerging Technologies for Deep and Dark Web Monitoring July 2024
  5. 5 Open-source intelligence (OSINT) Glossary term
  6. 6 Underground forum Glossary term

Keep Learning.

101 guide Threat Intelligence Platforms 101 What a threat intelligence platform is, what it does with data, how it differs from a SIEM or a feed, and how to choose one. Open

Keep Exploring.

Knowledge Hub
101 guide Threat Intelligence 101 A plain introduction to threat intelligence: what it is, how it works and how a small team can start using it. Open Glossary term Threat Actor A threat actor is an individual or a group that poses a threat to an organization or system. Open Use case Threat Search And Investigation Search across sources to follow up an alert. Open

Browse The Library.