Threat intelligence

Raw data becomes intelligence when someone analyzes it against a question and states what it means for a particular organization. The classic cycle has five stages: direction (what does the customer need to know), collection, processing, analysis, and dissemination with feedback. A list of indicators is data. A judgment that a named actor is likely to target your sector next quarter, with a stated confidence, is intelligence.

Practitioners usually distinguish levels. Strategic intelligence informs leadership about trends and actors. Operational intelligence describes specific campaigns or planned activity. Tactical intelligence provides the concrete indicators, such as account handles, domains or file signatures, that defenders can act on immediately.

The field is best known for cyber threat intelligence, but the same approach applies to physical security, fraud, supply chain and reputational threats. Reputational threat intelligence draws heavily on open-source intelligence from news, social and web sources.

A reputational example: an analyst notices a group of newly created accounts pushing a fabricated claim about a company's product, traces the wording to a forum thread that solicited participants, and reports that a brigade is forming, with the likely date it will peak. A physical example: monitoring public posts for threats against an executive ahead of a shareholder meeting, which feeds executive protection.

Comms and risk teams often learn of an issue when it reaches the press. Intelligence work shifts that timeline by identifying who is preparing to act and what narrative they will use. It also gives the team shared vocabulary with security, legal and cyber colleagues, so a reputational issue can be escalated with evidence in the format those teams expect.

Threat intelligence is not a feed. Subscribing to a stream of alerts produces data; the intelligence is the analysis tailored to your organization. Volume of alerts is a poor measure of value.

It is also not prediction with certainty. Good products express confidence levels and say what would change the assessment. And it is not solely a cybersecurity concern. Information threats such as information operations belong in the same framework.

Finally, more sources do not mean better intelligence. The value of a collection is the questions it can answer for a specific organization. A team that can name its top five threat scenarios, such as a coordinated attack on a product launch, impersonation of an executive, or a hostile narrative around an earnings call, can decide which sources and alerts are worth the attention they cost. Teams that start from the feed instead of the scenario tend to end up with dashboards nobody acts on.