Log in Request a demo

Glossary

Threat Intelligence.

Also called Cyber threat intelligence, CTI

Learn more
Threat Intelligence 101
Product track
Cyber Threat Intelligence
In Short

Threat intelligence is threat information that has been aggregated, transformed, analyzed, interpreted or enriched to give the context needed for decisions. It turns raw facts about threats into knowledge a team can act on. Good threat intelligence is relevant to your organization and arrives in time to change a decision.

Last updated October 7, 2026
Profile MapGlossary Term
  1. Also Called2other namesCyber threat intelligence · CTI
  2. Related Terms2linked entriesIndicator of compromise (IoC) · Dark web
  3. Read Next1guide on the same topicThreat Intelligence 101

What is threat intelligence?

NIST defines threat intelligence as threat information that has been aggregated, transformed, analyzed, interpreted or enriched to provide the necessary context for decision-making processes. The key word is context. A list of bad addresses is information. It becomes intelligence when someone has checked it, explained it and linked it to a decision.

How does it work?

Teams often describe a cycle. This is a common way to explain the work, not a rule from one source.

  • Decide what you need to know.
  • Collect raw information from sources such as incident reports, malware samples and technical feeds.
  • Process and check it, and add context.
  • Share the finding with the people who need it.
  • Ask for feedback and adjust the next round.

What levels of intelligence are there?

Intelligence is often split by audience. Strategic intelligence helps leaders understand who may target the business and why. Operational intelligence describes campaigns and how attackers work. Tactical intelligence is the technical detail that tools and analysts use daily, such as indicators of compromise, the traces that suggest a system was affected.

Why does it matter?

NIST describes the purpose of threat intelligence as supporting decision-making. In practice, that can help a team choose which weaknesses to fix first and which threats fit its industry. It can also give leaders a plain way to explain risk to people outside security. Without context, a team can end up reacting to alerts one at a time, which is general reasoning rather than a statement from NIST. Intelligence also needs to be timely, because a late warning may not change anything.

How do you put it to use?

Start from questions, not feeds. Ask which decisions your team has to make soon and what it would need to know to make them well. Then choose sources that answer those questions. Feed the results into tools you already run, such as monitoring and email filtering, and share short summaries with decision makers. Ask them whether the summaries helped.

Is threat intelligence the same as threat data?

No. Data is the raw material. Intelligence is what remains after it has been analyzed and given context. NIST’s definition includes the steps of aggregating, analyzing, interpreting and enriching for this reason.

Is threat intelligence the same as a threat intelligence platform?

No. Threat intelligence is the knowledge. A threat intelligence platform is software that helps collect, organize and share it. You can have one without the other, but a platform without good questions often produces noise.

Is it the same as threat hunting?

No. Threat hunting is a search through your own systems for signs of attackers. Intelligence can guide that search by saying what to look for.

Also Called.

  • NameCyber threat intelligence
  • NameCTI

Questions.

  • What is threat intelligence?

    Threat intelligence is threat information that has been aggregated, transformed, analyzed, interpreted or enriched to give the context needed for decisions. NIST uses this definition. The key word is context.

  • What are the levels of threat intelligence?

    Intelligence is often split by audience. Strategic intelligence helps leaders see who may target the business and why. Operational intelligence describes campaigns and how attackers work. Tactical intelligence is technical detail such as indicators of compromise.

  • Is threat intelligence the same as threat data?

    No. Data is the raw material. Intelligence is what remains after the data has been analyzed and given context, which is why the NIST definition includes aggregating, analyzing, interpreting and enriching.

  • How do you start using threat intelligence?

    Start from questions, not feeds. Ask which decisions your team must make soon and what it needs to know, then choose sources that answer those questions and share short summaries with decision makers.

Sources

  1. 1 threat intelligence - Glossary | CSRC, NIST CSRC
  2. 2 NIST SP 800-150: Guide to Cyber Threat Information Sharing, NIST CSRC

In Our Research

  1. 1 Cracking the Code: How Cyber Threat Intelligence Could Save Your Business October 2024
  2. 2 Analyst Support in Cyber Threat Intelligence: Best Practices September 2024
  3. 3 Enhancing Business Resilience with Comprehensive Cyber Threat Intelligence April 2024
  4. 4 Three Types of Cyber Threat Intelligence January 2022
  5. 5 DORA in 2026: what the ESAs say about year two October 2026
  6. 6 Cyber compliance calendar 2026 and 2027: key dates October 2026

Keep Learning.

101 guide Threat Intelligence 101 A plain introduction to threat intelligence: what it is, how it works and how a small team can start using it. Open

Keep Exploring.

Knowledge Hub
101 guide External Attack Surface Management 101 How to find, check and reduce everything an attacker could reach from the internet, and how to keep that list true as your company changes. Open 101 guide ROI Framing And Board Report Template For Threat Exposure A way to estimate the return on outside-threat monitoring with your own inputs, plus a board report template without invented benchmarks. Open Industry Government And Public Sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply. Open Role MSSPs And Service Providers Run external threat monitoring for many clients from one platform, with findings you can send to client tools through the API and MCP. Open

Browse The Library.