Threat Intelligence

What Is Threat Intelligence?

Threat intelligence (TI) — also called cyber threat intelligence (CTI) — is actionable, evidence-based knowledge about existing or emerging threats. It answers who is attacking, what techniques they use, what they target, and when they're active — enabling organisations to make informed, proactive security decisions rather than reactive ones.

Good threat intelligence turns raw data (IP addresses, malware hashes) into insights (this ransomware group targets healthcare companies using RDP — here's how to block them).

Types of Threat Intelligence

Strategic: High-level, business-focused intelligence about threat trends, attacker motivations, and geopolitical context. Audience: executives and board members.

Tactical: Intelligence about attacker techniques, tactics, and procedures (TTPs) based on frameworks like MITRE ATT&CK. Audience: security architects and programme managers.

Operational: Intelligence about specific, planned attacks — campaigns, actors, and targets. Audience: security operations centres.

Technical: Indicators of Compromise (IOCs) — IP addresses, domains, file hashes associated with known threats. Audience: security tools and analysts.

Indicators of Compromise (IOCs)

IOCs are artefacts observed in a network or system that indicate a potential security incident:

• Malicious IP addresses or domains communicating with internal systems
• File hashes of known malware
• Unusual registry modifications or file paths
• Known malicious email addresses

IOC feeds are used to block known threats automatically in firewalls, email gateways, and endpoint protection tools.

Threat Intelligence for SMBs

Full-scale threat intelligence programmes require dedicated analysts. But SMBs can benefit from accessible threat intelligence sources:

• CISA Advisories (US): Free alerts on active threats, critical vulnerabilities, and nation-state campaigns
• NCSC Advisories (UK): Free guidance and threat alerts for UK organisations
• Open-source feeds: AlienVault OTX, Abuse.ch, PhishTank
• Vendor intelligence: Most endpoint and email security vendors include threat intelligence feeds

Even subscribing to CISA and NCSC advisories and acting on their remediation guidance puts you ahead of most SMBs.