What is cyber threat intelligence?

Cyber threat intelligence is information about attackers that has been analysed to the point where it changes a decision you were going to make anyway. That last clause is the whole subject. A feed of malicious domains is not intelligence, it is information; it becomes intelligence when somebody establishes what it means for a particular organisation and that organisation does something differently as a result.

Before the argument, the mechanism, because the words are easier to keep straight once you have watched them work on something ordinary.

Look at what changes between the second and third columns. Nothing new is collected. Nobody goes out and gathers another fact. Somebody takes what is already sitting in the middle column, works out what it means for one particular reader with one particular problem, and says so plainly enough to act on.

That is the whole job, and it is why a feed cannot do it for you. The feed can fill the first two columns for thousands of items a second. It cannot fill the third, because the third column contains your delivery van, your payroll supplier, your firewall rule.

The distinction sounds pedantic until you notice who insists on it. The United States government's flagship publication in this space is NIST Special Publication 800-150, Guide to Cyber Threat Information Sharing, published in October 2016 by Johnson, Badger and Waltermire of NIST with Snyder and Skorupka of MITRE. It defines its subject like this:

Cyber threat information is any information that can help an organization identify, assess, monitor, and respond to cyber threats.

Read the title again. Information sharing. Across the whole document NIST does not use the phrase "cyber threat intelligence" as its term of art, and the definition it does give is deliberately broad: any information that can help. An industry that sells intelligence has spent a decade building on a foundation whose most cited government document carefully says information instead.

Europe went the other way, which is worth knowing if you buy from vendors on both sides of the Atlantic. ENISA, the European Union Agency for Cybersecurity, uses the term freely: its 2020 threat landscape series includes a dedicated Cyber Threat Intelligence Overview, it has published a study of threat intelligence platforms, and it runs an annual CTI conference. So the same activity is called information sharing in Washington and threat intelligence in Brussels, and neither is wrong. If a definition seems to shift depending on whose document you are reading, that is because it does.

It is worth being fair to NIST about why. SP 800-150 is a guide to sharing, and sharing is something you do with information. The moment a producer analyses something for a specific consumer, it stops being generally shareable, because the analysis is bound to that consumer's estate and risk appetite. The word choice is not an oversight or a criticism of the industry. It is a precise description of what can be passed between organisations, and it quietly marks the boundary this guide is about.

The commercial consequence is the part worth carrying into a procurement meeting. Information and intelligence are priced similarly, described in similar language, and are not substitutes for one another. A buyer comparing two products on coverage, update frequency and integration count is comparing two collection systems, which is a reasonable thing to do and tells you nothing about whether either will change a decision.

Information or intelligence: the test is whether it changes a decision

Most products sold as threat intelligence sit in one quadrant, and it is not the one the brochure implies.

The bottom-left quadrant is not a criticism. A raw feed is a perfectly good product and every programme needs one. The failure is a budget line labelled threat intelligence that buys only the bottom left, and an annual review that never asks which decisions moved.

Notice also that the top right cell is the only one that cannot be bought as a product, because it is defined partly by your organisation. A vendor can get most of the way there with a well-run intelligence service that knows your sector and your stack, and the last step, deciding what to do, is not something anybody can sell you.

The intelligence cycle, and the single phase that does the work

Every textbook draws the same loop, and the loop is genuinely useful. What the textbooks tend not to say is that five of its six phases move information around and exactly one of them produces intelligence.

One more thing about the loop before leaving it. The phases are drawn as a circle because the output of feedback is supposed to become the input to direction: you learn what your last assessment missed, and that shapes the next question you ask. In practice most programmes run it as a line, and a line has no mechanism for getting better. The organisations that produce genuinely good internal intelligence are almost always the ones that treat the last arrow as real, which costs nothing except the willingness to hear that a report changed nothing.

Direction is a question. Collection is acquisition. Processing is parsing and deduplication. Dissemination is delivery. Feedback is asking whether it mattered. Only analysis takes a set of facts that were already public and produces a statement that was not.

That is why the cycle is worth drawing rather than listing. If you can buy the first three phases and automate the fourth, then a programme can be fully staffed, fully funded and producing nothing that did not arrive in the post.

The cost profile explains why this happens. Direction is a meeting. Collection is a subscription. Processing is a pipeline somebody builds once. Each has a clear owner, a clear price and a clear completion state. Analysis has none of those: it takes an experienced person an unpredictable amount of time, produces a judgement rather than an artefact, and cannot be scheduled in advance because you do not know what you will find. It is the only phase in the loop that behaves like research, and it is therefore the first thing cut when the quarter is tight.

Feedback fails for a different reason. It requires going back to somebody and asking whether the thing you sent them made any difference, which is a question with an uncomfortable answer often enough that the habit rarely forms. A cycle that never closes is not a cycle. It is a pipeline with an arrow drawn on the diagram.

Where programmes actually stop

Buying a feed accomplishes direction, collection and processing on the day the contract is signed. That is what makes the failure so hard to see from a management report: three of six phases are green, the invoice is being paid, and nobody has yet had to form a view about anything.

The four types everyone repeats came from one paper

Search for threat intelligence types and you will find the same four on almost every page: strategic, operational, tactical and technical. They are usually presented as though they were doctrine, in a pyramid, with no source attached.

It is worth pausing on how unusual that is. Four categories, repeated across hundreds of vendor pages, training courses and job descriptions, presented as settled professional consensus, with no citation anywhere. Not because anybody is hiding the source, but because each page copied the page before it and the attribution fell off somewhere around the third hop. This is worth knowing for its own sake, and it is also a reasonable proxy for how carefully a given page was researched: if it lists the four types and names the origin, somebody read something.

They come from one document. Threat Intelligence: Collecting, Analysing, Evaluating, written by David Chismon and Martyn Ruks at MWR InfoSecurity, published in 2015 in conjunction with CERT-UK and the Centre for the Protection of National Infrastructure. Thirty-six pages, and every page footer carries all three sponsors.

Two of those three no longer exist under those names, which matters if you go looking. CERT-UK was absorbed into the National Cyber Security Centre when it became operational on 3 October 2016, alongside CESG and the Centre for Cyber Assessment. The Centre for the Protection of National Infrastructure became the National Protective Security Authority in March 2023, with a broader remit, under MI5. The model outlived both of its institutional sponsors, which is a reasonable definition of influential and also a reason the citation trail went cold.

The four-type split is more useful than the pyramid that later replaced it, because it divides by consumer rather than by seniority. A board paper and a detection rule are not two rungs of the same ladder with the board at the top. They are different products, for different readers, with different useful lifetimes, and the same underlying finding may support both or neither.

The paper is also careful about something the summaries drop entirely: operational intelligence, meaning specific forewarning of an attack about to happen to you, is by far the hardest of the four to obtain, and for most organisations it is not realistically available at all. Anyone selling it should be asked how they came by it. That caution is not a footnote in the original and it is absent almost everywhere the four types are repeated.

Reading the table is one thing and using it is another, so here is the same finding from the case later in this guide, turned into four different products for four different readers.

Two things to take from that. The first is that the four types are not four levels of quality with the board at the top, they are four audiences, and a finding that is valuable to one may be worthless to another. The second is that the empty box is the normal case, not a failure. If somebody offers to sell you operational intelligence, the reasonable question is how they came by advance knowledge of an attack aimed specifically at you.

The paper is worth reading in full for a second reason, and it is the thing that reframed this guide while researching it. Its first reference is the Butler Review of Intelligence on Weapons of Mass Destruction, 2004: the British public inquiry into how intelligence assessments on Iraq went wrong.

That is the founding document of UK cyber threat intelligence opening with a citation to an inquiry into intelligence failure. The lineage is worth naming as British rather than universal: an American account of the same discipline would more likely start from military doctrine and the intelligence cycle as taught at Langley, and a European one from ENISA's threat landscape work. The vocabulary is shared, the ancestry is not. Not a vendor case study, not a breach report. An inquiry into confident assessments that turned out to be untrue.

That choice sets the professional standard the field inherited and mostly ignores. The lesson of Butler is not that intelligence is unreliable. It is that intelligence which does not carry its own uncertainty is dangerous, because the caveats get stripped as an assessment travels upward and what reaches the decision-maker is a confident sentence that nobody in the chain would have signed. Any threat report that never says probably, never says we could not verify this, and never distinguishes what was observed from what was inferred, has failed a test that predates cyber security by decades.

What analysis actually looks like, on one real case

Abstractions are cheap here, so this section walks one case end to end. On 18 August 2026 Microsoft Defender Experts published an analysis of MacSync Stealer, a macOS information stealer, extending earlier work by RST Cloud. The report links more than thirty domains by behaviour rather than by matching, and is explicit that the domain count is a by-product of the method rather than the finding.

That report is collection. The indicator table in it is processing. Neither is intelligence yet, and Microsoft would not claim otherwise.

Direction came first, though it is easy to skip past. The question was not what is MacSync Stealer, which the report already answers well. The question was whether the controls a typical organisation already runs would have caught this infrastructure, because that is the thing a reader can act on and the thing no vendor report can answer for them.

Analysis was querying every domain in that table against Verisign's RDAP service and looking at when each was registered.

The reasoning was ordinary, which is the point. If infrastructure is being rotated in response to disclosure, as the reporting describes, then replacement domains should be young: registered shortly before or during the campaign. That is a prediction, it is cheap to test, and registry data is public. Nothing here required access to the malware, a sandbox, or a commercial feed.

$ curl -sL -H 'Accept: application/rdap+json' https://rdap.org/domain/lumenagnet.com

{"objectClassName":"domain","ldhName":"LUMENAGNET.COM",
"events":[{"eventAction":"registration","eventDate":"2025-09-26T14:02:11Z"},
{"eventAction":"expiration","eventDate":"2026-09-26T14:02:11Z"}]}

The conclusion is one sentence and it is not in either vendor report: the domains were not registered as the campaign rotated, they were bought in batches up to a year in advance. Rotation and registration are different activities.

The prediction failed, and a failed prediction is usually where the finding is. Every domain predated the report by months. The operator was not registering infrastructure as the campaign burned through it. They were working through stock bought in advance, which is a different operation with different economics and a different detection profile.

That is intelligence rather than information, by the test set out at the top, because it changes a decision. Scoring or blocking newly registered domains is a widely deployed control, it is cheap, and against this campaign it is worth nothing, because every one of these domains had been sitting unused for months before it served anything.

dogtrainersgeorgia[.]comRegistered 28 November 2025Same registrar as the other 30Same purchase day as five othersAn innocuous small-business name

Two honest limits belong with that finding. Registry data is point-in-time and a registrar of record can be a reseller, so this identifies a pattern rather than an owner, and none of it names a person. And two of the 31 domains did not resolve at all, so the counts describe twenty-nine. Stating both is not throat-clearing. An assessment that hides its own limits is exactly the failure mode the Butler Review was convened to examine.

That last part is the one that changes an incident response. A defender who sees a dog-training company in a malicious domain list reasonably assumes a small business got compromised and starts looking for someone to contact. There is no one. The name is cover, bought on the same day as five others.

Try the analysis step yourself, in about ten minutes

The fastest way to understand the difference is to do the last column once. Nothing here needs a licence, a platform or a login.

Take any published indicator list, from any vendor report you can find. Pick the domains out of it. For each one, ask a public registry when it was registered, which is a single command and costs nothing:

$ curl -sL https://rdap.org/domain/example.com | python3 -m json.tool | grep -A1 registration

Now ask one question of the answers: is this pattern what I expected? If every domain in a supposedly fast-rotating campaign turns out to be older than the campaign, you have found something the report did not say. If they are all a week old, you have confirmed the report and learned that domain-age scoring would help you here.

Either answer is intelligence, because either one changes what you would do. That is the entire step, and the only expensive part is being willing to look.

Where this sits next to the SOC

A common and reasonable confusion is where threat intelligence ends and the security operations centre begins, because both look at attacker activity and both produce written output.

The difference is the direction of the question. A SOC starts from something that happened in your estate and works outward: this alert fired, what is it, does it matter. Threat intelligence starts from something happening in the world and works inward: this campaign exists, does it reach us, and would we notice. Threat hunting sits between them, starting from a hypothesis about what might already be present and looking for evidence either way.

They feed each other in both directions, and a programme that runs one without the others tends to fail in a predictable way. Intelligence with no SOC produces assessments nobody can action. A SOC with no intelligence is permanently reactive, because every alert is triaged on its own merits with no view of what is currently being done to organisations like yours. Hunting without intelligence is a search with no priority ordering, which in a large estate is indistinguishable from luck.

What to ask anyone selling you intelligence

The market's structural problem is that the first three phases are easy to sell and the fourth is expensive to staff.

Starting without a budget

Everything above is achievable with no platform and no subscription, and the worked example in this guide was done that way deliberately to prove it.

The three things that actually gate a useful programme are a named question, a place to write the answer down, and somebody who will read it. Registry lookups are free. Vendor reports are free. Your own logs are the highest-value collection source you have and you already own them, because they are the only source that knows your estate. What a platform buys is scale and speed in the phases that were never the bottleneck.

If you are starting from nothing, the honest first move is not to buy a feed. It is to write down the last three security decisions your organisation made and ask what information would have made each of them better. That list is your collection requirement, and it will be shorter and stranger than any vendor's coverage map.

The position

Most of what is sold as cyber threat intelligence is cyber threat information, and NIST has been quietly using the more accurate word since 2016.

That is not a reason to buy less of it. Information is the input and the pipeline does not run without it. It is a reason to be precise about what has been bought, because a programme that mistakes the input for the output will keep paying for collection and wonder why nothing changes.

None of this is an argument for cynicism about the vendors. The MacSync analysis this guide leans on is careful work, states its own method, and explicitly declines to lead with the number that would have made the better headline. The gap that mattered was not a mistake in it. The gap was that an indicator table is not an analysis and was never presented as one, and the reader who wanted a decision had to do the last step themselves.

That last step is the job. It is also the only part of this that cannot be outsourced, bought as a subscription, or automated by the current generation of tooling, which makes it the part worth building a team around.

The test survives every vendor conversation and every internal review: name the decision that changed. If nobody can, then whatever else was produced, it was not intelligence. The discipline this one borrowed its name from learned that lesson expensively enough to hold a public inquiry into it, and the paper that gave this field its vocabulary put that inquiry first in its bibliography.