Understanding the Field of Cyber Threat Intelligence

Cyber threat intelligence (CTI) is a vital component of modern cybersecurity, blending traditional intelligence methodologies with the dynamic world of information security. This blog series will explore the definition of CTI, its subdisciplines, key stakeholders, and the intelligence cycle that drives its operations. By breaking down complex concepts into clear, digestible sections, we aim to provide a comprehensive yet accessible overview of the role of CTI in protecting organizations from cyber threats.

What is Cyber Threat Intelligence (CTI)?

Cyber threat intelligence (CTI) is a growing field at the intersection of cybersecurity and traditional intelligence studies. It combines methodologies and practices from both areas but is fundamentally driven by commercial industry needs and applications.

At its core, CTI is the process of collecting, processing, analyzing, and disseminating information about potential cyber threats and vulnerabilities. Its ultimate goal is to improve an organization’s awareness of attacker motives, targets, and behaviors observed across cyberspace.

For defenders on the tactical level, CTI provides valuable context for the anomalies and incidents they observe in their networks and systems. Meanwhile, for executive management, CTI provides a strategic perspective for leaders, enabling smarter resource allocation and long-term risk management. See the FIRST CTI curriculum to learn more.

Over the coming series, we will explore different aspects of this field. In this article, we introduce CTI, its consumers and stakeholders, and the three levels of CTI. In follow up posts, we’ll discuss the CTI lifecycle, foundational CTI disciplines, key job functions, and the stages of CTI program maturity.

A Brief History of Cyber Threat Intelligence

Although CTI shares many characteristics with traditional military and government intelligence, it began and evolved within the information security community. Early pioneers in incident response began grouping patterns of computer network intrusions and tracking adversaries systematically, giving rise to CTI.

One of the first public mentions of “cyber threat intelligence” was by Ian Cook at a FIRST conference in the late 2000s. From that point, the concept gained traction. Like many terms in cybersecurity, it quickly evolved—sometimes chaotically—due to overly enthusiastic marketing efforts, resulting in inconsistent usage of terminology across vendors.

A major turning point for CTI came in 2013 with the release of the APT1 report by Mandiant. This landmark publication exposed a decade-long Chinese cyber espionage operation linked to the People’s Liberation Army (PLA). Mandiant’s founder, Kevin Mandia, leveraged his military background from the US Air Force Office of Special Investigations to spearhead this effort.

Following the APT1 report, the CTI industry grew rapidly. However, this expansion was not without problems: inconsistent terminology, divergent analytical standards, and a lack of standardized training for analysts created confusion.

In response, James Chappell (Digital Shadows) and I (while at Fastly) founded the FIRST CTI Special Interest Group (SIG) in 2018 to develop a unified baseline for CTI terminology, analytical frameworks, and training standards. Before diving deeper, let’s define some key terms foundational to this discussion.

Foundational Concepts of Cyber Threat Intelligence

Let’s look at some of the foundational concepts of CTI: threats, vulnerabilities, risk, intelligence, and cyber threat intelligence.

A threat is any situation or event that could cause harm to individuals, organizations, or their assets, including operations, reputation, and information systems. In cybersecurity, a cyber threat involves actions that compromise, disclose, modify, destroy, or deny access to information or systems. In response, information security teams apply the CIA triad model to prevent unauthorized information disclosure, prevent unauthorized or otherwise unexpected changes to data, and ensure information is available to make decisions.

Threats are harmless without the presence of vulnerabilities. Vulnerability is a weakness or flaw in a system, software, hardware, process, or person that can be exploited by a threat actor to compromise security.

Finally, the probability of a specific vulnerability being exploited by a threat is defined as risk (Joint Task Force Transformation Initiative, 2012).

Intelligence is the structured process of planning, collecting, processing, exploiting, evaluating, analyzing, and disseminating information—often about foreign nations, hostile forces, or other threats. Its purpose is to support decision-making, policy formulation, and operational planning (Joint Chiefs of Staff, 2010; ODNI, 2024).

Intelligence operates across three levels which will be discussed in more detail later in this post.

Tactical: Immediate, specific action-focused insights.
Operational: Support for ongoing operations.
Strategic: High-level insights shaping long-term policy and strategy.

The cycle that structures these activities is known as the intelligence cycle, also known as the CTI cycle. There will be more details on this cycle in the next article.

Cyber threat intelligence applies traditional intelligence processes specifically to cybersecurity. It involves gathering, analyzing, and interpreting information about cyber threats and vulnerabilities to inform decision-makers at all organizational levels.

CTI helps organizations:

Proactively identify and mitigate risks, which in turn may mean prioritizing the mitigation of vulnerabilities.
Prioritize security investments.
Improve incident response capabilities.

CTI activities draw from a range of sources, including open-source intelligence (OSINT), commercial threat feeds, internal logs, and industry sharing partnerships.

The CTI SIG at FIRST defines it succinctly as:

“Cyber Threat Intelligence is the systematic collection, analysis and dissemination of information pertaining to a company’s operation in cyberspace and to an extent physical space. It is designed to inform all levels of decision makers. The analysis is designed to help keep situational awareness about current and arising threats.”

Purpose, Focus, and Consumers of Cyber Threat Intelligence

CTI’s primary purpose is to manage organizational risk by providing insights into malicious cyber activities targeting information systems. While focused on cyberspace, CTI may also cover physical threats, such as attacks on infrastructure. Over time, CTI has evolved to rival traditional intelligence disciplines, tracking both digital and real-world actors. As such, the consumers of CTI fall into two broad categories.

Technical Consumers: These include engineers and security analysts who use CTI to improve technologies and implementations. Examples include security engineers, threat hunters, and incident responders who use CTI to detect and respond to attacks. Technical consumers typically work at the tactical and operational levels.

Non-Technical Consumers: These are executives, business leaders, board members, policy-makers who use CTI to shape long-term strategies. These users operate at the strategic level. They use CTI to shape broader business decisions, such as resource allocation, mergers and acquisitions, or ecosystem-wide risk mitigation initiatives.

An important difference between commercial CTI and government intelligence is that commercial consumers of intelligence might not have any formal relationship with the intelligence producers. For instance, a company may benefit from a publicly released CTI report produced by a competitor and the report may be funded by the marketing and not security budget.

Another important distinction: a consumer is not the same as a stakeholder, though these terms are often used interchangeably. A consumer simply benefits from CTI outputs. Meanwhile, a stakeholder is invested in the CTI production process—financially, operationally, or through strategic partnership. Understanding this distinction is crucial for structuring CTI programs correctly and ensuring appropriate buy-in across organizations.

Levels of Cyber Threat Intelligence

Just like traditional intelligence, CTI operates across three levels: strategic, operational, and tactical.

Strategic Cyber Threat Intelligence

Strategic CTI offers long-term trend analysis. It considers geopolitical factors and industry trends to inform executive decision-making and resource planning. These might include emerging trends, larger geopolitical implications of trends, industry-specific threats, and supply chain risks.

Strategic CTI is primarily for senior leadership, informing corporate strategies, investment decisions, and long-term risk management. For example, understanding the global shift toward software supply chain attacks allows organizations to proactively review and harden their development pipelines.

Operational Cyber Threat Intelligence

Operational CTI provides contextual information about threat actor tactics, techniques, and procedures (also known as TTPs), enabling organizations to design robust monitoring and defense systems.

It supports ongoing cybersecurity operations by providing actionable insights on threat actor TTPs, current malware campaigns, and ongoing attack patterns. It also informs threat detection, incident response, and monitoring activities. For example, the APT1 report not only outlined a decade of espionage (which would be at the strategic level), but also detailed TTPs, allowing defenders to adjust their detection systems accordingly, which helps on the operational level.

A recent example is the Ivanti incident in 2024, where threat actors chained together vulnerabilities in Ivanti cloud applications. And one of the most well-known examples from recent years is the SolarWinds incident, where SolarWinds sent out updates that were infected with malware that allowed backdoor (remote) access to infected machines.

These incidents, among others, highlighted the need for monitoring software vulnerabilities, prioritizing patching, and implementing compensating controls.

Tactical Cyber Threat Intelligence

Tactical CTI focuses on immediate technical indicators, or observables, such as IP addresses, domain names, and malware signatures to support activities like security monitoring, threat hunting and incident response. It enables front-line defenders to detect and neutralize threats swiftly.

The Cyber Threat Intelligence Cycle

No discussion on CTI would be complete without touching on the cyber threat intelligence cycle. We will follow up with a detailed post on this topic soon, but we’ll include a brief summary here. This cycle resembles the military intelligence cycle but is focused on cyber threat actors, TTPs, and observables, and is applied specifically to civilian and commercial applications.

The cyber threat intelligence cycle is composed of several phases, each feeding output into the next phase, and in turn receiving feedback from it. It’s crucial for effective threat intelligence operations.

Planning and direction help guide the overall intelligence cycle process, and enterprises can use priority intelligence requirements to identify and manage risks. Questions asked during this stage include:

What cyber security questions need answers?
Who are the consumers of intelligence?
What threats are being faced?

An important part of this phase is understanding and considering the most valuable assets in an enterprise, as protecting these assets must be prioritized.

In the collection phase, data is gathered from sources like open-source intelligence (OSINT), dark web monitoring, and internal telemetry such as log data from monitored services.

The processing and exploitation phase pertains to cleaning, structuring, and formatting the collected data. In this phase, raw data is transformed into information, which ensures it can be analyzed efficiently.

During the analysis and production phase, information obtained from different sources is processed to identify patterns and produce actionable intelligence reports tailored to the intended audience at different levels (tactical, operational, and strategic).

Finally, during the dissemination phase, this intelligence is delivered to consumers in order to be integrated in the decision process and any actions that need to be taken. This could include alerts for technical teams, strategic reports for leadership, and briefings for partners.

It’s crucial to note that each phase provides feedback to the previous phase to continually refine outputs, adjust priorities, and improve processes.

Maturity Stages of Cyber Threat Intelligence Programs

Cyber Threat Intelligence (CTI) programs are not one-size-fits-all. Companies must tailor them based on their size and needs. As organizations recognize CTI’s value, their programs typically evolve through common stages of maturity, although some may remain at Stage 1 and outsource advanced tasks.

Stage 1 is unstructured, with CTI as a secondary role focused on tactical intelligence, such as IPs, domains, and hashes, using automated feeds for enrichment and alerting.
Stage 2 introduces more structured intake, selective automatic threat blocking, and the integration of operational and strategic intelligence. CTI teams also begin documenting investigations, building knowledge management processes, and supporting risk management (RM) initiatives. Threat landscape reporting (TLR) starts during this stage.
Stage 3 organizations generate internal intelligence, automate repeatable tasks, and collaborate widely with peers. CTI becomes fully integrated with corporate decision-making, incorporating geopolitical awareness and, in some cases, publicly publishing intelligence to support brand reputation and enhance security strategy. More details can be found on the FIRST CT SIG site.

Conclusion

Cyber threat intelligence is no longer a niche concept—it is a crucial part of modern cybersecurity operations. Rooted in both cybersecurity practices and traditional intelligence disciplines, CTI empowers organizations to understand, anticipate, and counter cyber threats.

CTI delivers actionable insights at strategic, operational, and tactical levels by adhering to a structured flow: the CTI cycle.

By employing this cycle, organizations can turn raw information into actionable insights, making themselves stronger and more resilient in a threat landscape that is constantly evolving.

Future posts will dive deeper into CTI frameworks such as threat hunting models, discuss foundational skills for CTI analysts, and explore how to mature a CTI program over time. As CTI continues to mature, standardized terminology, training, and processes will further enhance its impact, making it an indispensable tool for safeguarding digital assets in an increasingly complex threat landscape.