Threat Intelligence 101.

Threat intelligence is information about threats that has been collected, checked and explained so that someone can make a better decision. The key words are checked and explained. A list of bad web addresses is data. A note that says which group is using those addresses against companies like yours, and what to do about it, is intelligence.

It answers practical questions. Who is likely to target us? What methods do they use? Which of our weaknesses do they go after? What should we do first?

Threat intelligence can come from many places. Some comes from inside your own company, such as alerts and incident notes. Some comes from the outside world, such as public reports, government warnings, malware analysis and criminal forums. The best results combine both.

It is not a product you switch on. It is a habit of asking good questions, collecting evidence and sharing the answer with the people who need it. Tools and services help, but the value comes from fitting the answer to your business.

Security teams get more alerts than they can read and more advice than they can follow. Threat intelligence helps them choose. It shows which threats are real for your industry and which weaknesses attackers are using right now, so limited time goes to the right problems.

It also gives early warning. Criminals talk to each other, and a lot of that talk happens on dark web forums, where stolen logins and network access are offered for sale. Seeing an offer that matches your company can give you days to react before an attack starts.

Leaders benefit as well. Intelligence turns a vague worry about hackers into a short, clear statement: this is who may come after us, this is how, and this is what we are doing about it. That makes it easier to explain budgets and priorities.

This work is sometimes called cyber threat intelligence, or CTI. The word cyber only marks that the threats are digital. The method is the same as in any other field that uses intelligence: ask, collect, check, explain, share.

Most teams follow a cycle with five steps.

• Direction. Decide what you need to know and why.
• Collection. Gather raw information from your own systems and from outside sources.
• Processing. Clean it up, remove duplicates and check that it is reliable.
• Analysis. Add context and judgment until it answers the question.
• Sharing. Deliver the answer to the right people in a form they can use, then ask for feedback.

Collection is wider than many people expect. It includes public reports and technical feeds, but also the places where attackers work. An infostealer, for example, copies saved passwords from infected devices and sends them to a criminal server, and the stolen data is then sold. Finding your company in that data is a valuable piece of intelligence.

Processing and analysis are where most of the value is added. Raw material is easy to find. Deciding what is true, what is relevant and what it means takes skill and time, and it is the step that tools and automation support but cannot replace.

Feedback closes the loop. If readers say a report was not useful, the next round of direction should change.

Intelligence is written for different readers, and it is common to split it into three levels.

Strategic intelligence is for leaders. It looks at the bigger picture: who is interested in your industry, what they want and how the risk is changing. It is written in plain business language and helps with planning and budgets.

Operational intelligence is for the people who run security day to day. It describes campaigns and the way attackers work, such as the steps they take from first contact to their goal. It helps teams decide what to look for and where to strengthen defenses.

Tactical intelligence is the detail that tools and analysts use directly. Much of it is indicators of compromise, which are traces such as file fingerprints, addresses and domain names that suggest a system has been attacked. It is easy to share and quick to act on, but it also goes out of date quickly.

A healthy program has some of each. Tactical detail without strategy leads to chasing lists. Strategy without detail never reaches the tools.

You do not need a large team. Start small and make it useful before making it big.

• Write down five questions your team or leaders would like answered. Examples: which groups target our industry, and which of our systems are exposed?
• Choose a few sources that can answer them. Government warnings and well-known public reports are a good start.
• Decide who gets the answers and how. A short weekly note often works better than a long report.
• Connect what you learn to action, such as a blocked address, a patched server or a changed process.
• Ask readers what was useful, and adjust.

Once the basics work, think about what you cannot do yourself. Watching criminal forums and marketplaces safely takes access, skills and time. A service such as Brandefense Cyber Threat Intelligence can do that collecting and turn it into findings your team can act on, so your own people spend their time on decisions instead of searching.

Whatever you choose, keep the questions at the center. Sources and tools come second.

Budget owners can start from the procurement and finance page, and technology leaders from the CIO and IT director page. To compare ways to buy intelligence, read the guide to feeds, platform or managed service and the threat intelligence evaluation checklist.

Good threat intelligence is judged by what changes because of it, not by how much is collected.

Here are signs that it is working.

• People ask for it. Readers open the notes and come back with questions.
• Decisions change. A patch is moved up, a rule is added or a project is delayed because of something the team learned.
• Surprises are fewer. When something happens, someone can say whether it was expected.
• The time from learning about a threat to acting on it gets shorter.
• Findings are specific. They name what is affected and what to do, instead of general warnings.

Track these with simple measures, such as how many findings led to an action and how long each took. Avoid counting reports or feeds, because more volume is not better.

Review the questions every few months. Business changes, attackers change and the questions should change with them. A program that asks the same things year after year has stopped learning.

If your findings come from a service, check that they match your assets and industry. The platform side of that is covered by Brandefense Cyber Threat Intelligence, which is built around findings that your team can act on.

These public pages back the descriptions in this guide.

• NIST: Guide to Cyber Threat Information Sharing (SP 800-150). Sets out best practice for sharing indicators, attacker tactics and incident findings so organizations can identify, assess, monitor and respond to cyber threats.
• NIST CSRC Glossary: Cyber threat intelligence. Defines it as cyber threat information that has been aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes.