Every week brings news of another breach, and the organizations that withstand these attacks best are often the ones that saw the risk coming. That foresight can come from threat intelligence, which is usually divided into 4 types: strategic, operational, tactical, and technical. They differ by how zoomed in they are. Strategic looks at the big-picture business risk, operational tracks specific attackers and their campaigns, tactical explains the methods attackers use, and technical delivers the exact clues—like malicious IP addresses and file hashes—that your security tools can act on.
Key takeaways
- Threat intelligence is processed, context-rich knowledge about cyber threats that supports an organization’s security and business decisions.
- Raw data alone is not intelligence.
- There are 4 common types of threat intelligence: strategic, operational, tactical, and technical.
- Strategic intelligence supports business and risk decisions, operational intelligence tracks specific actors and campaigns, tactical intelligence explains how attackers behave, and technical intelligence supplies the exact indicators that security tools detect and block.
- The 4 types work best together.
- A good program starts with business questions. Define what you need to know first, then choose sources and tools.
What is threat intelligence
Threat intelligence is analyzed and contextualized information about cyber threats that helps an organization make security and business decisions. It turns raw observations and threat data into knowledge a team can act on—for example, an explanation of an attacker’s motivation or a detailed description of the methods they use.
Threat data is not automatically threat intelligence. A list of suspicious IP addresses is data. It becomes intelligence only after analysts or automated systems work out what those addresses connect to, whether they are relevant to your organization, how reliable the source is, and what you should do next.
Level | Example |
|---|---|
Threat data | A suspicious IP address appears in firewall logs. |
Threat information | The IP address has been associated with credential phishing. |
Threat intelligence | The address is part of an active campaign against companies in your sector. It contacted one of your systems, the assessment has high confidence, and the recommended actions are to block it, search historical logs, and check affected accounts. |
Useful cyber threat intelligence should be:
- Relevant to your assets, sector, or region.
- Timely enough to still have value when it arrives.
- Carry context that explains the threat and its likely impact.
- Assessed meaning it states how reliable the source is and how confident the analysts are.
- Actionable so it supports a decision, a detection rule, or a response.
Why threat intelligence matters for businesses
No organization can investigate every threat, patch every flaw at once, or defend equally against every attacker. Threat intelligence helps you focus limited resources on the actors, methods, and campaigns most relevant to your critical assets. That focus feeds decisions about security investment, vulnerability fixes, detection coverage, incident response plans and supplier risk.
Threat intelligence also improves threat detection Technical intelligence identifies known malicious IP addresses, domains, and file hashes. Tactical intelligence supports behavior-based detection that still works even when an attacker changes its infrastructure. When an alert fires, threat intelligence adds the context an analyst needs to judge severity and choose a response, which speeds up triage.
But there is a risk on the other side. Poor-quality intelligence can create more work than it saves. Old or low-confidence indicators can cause legitimate infrastructure to be flagged as malicious. That’s why teams should judge feeds by their value and false-positive rate rather than by how many indicators they contain.
The 4 types of threat intelligence answer different questions for different people.
Type | Central question | Main users | Typical outputs | Main use |
|---|---|---|---|---|
Strategic | What cyber threats could materially affect the business? | Board, executives, CISO, risk, legal | Executive briefs, sector assessments, risk scenarios | Long-term risk and business decisions |
Operational | Which actor or campaign is active, and what may happen next? | Incident response, SOC leaders, threat analysts | Actor profiles, campaign reports, infrastructure maps | Prepare for or respond to a specific campaign |
Tactical | How do attackers operate? | SOC analysts, detection engineers, threat hunters | ATT&CK mappings, hunt hypotheses, behavioral detections | Detect behaviors and strengthen controls |
Technical | Which exact artifacts should systems detect or block? | SOC analysts, SIEM, EDR, firewalls, email tools | IOCs, signatures, blocklists, STIX objects | Automated detection, enrichment, and blocking |
Note that there is no universally accepted way to divide threat intelligence. Some frameworks group technical intelligence within the tactical category. This article keeps them separate, but these boundaries are not a formal standard.
1. Strategic threat intelligence
What strategic threat intelligence covers
Strategic threat intelligence is high-level analysis that translates cyber threats and activity into business risk. It looks at longer-term threats, attacker motivations, sector and regional exposure, geopolitical events, supplier dependencies, and the financial or operational damage an attack could cause. It deliberately avoids technical detail and stays focused on decisions.
Strategic threat intelligence answers questions such as:
- Which threat groups pose the greatest risk to your sector?
- Why do they target organizations like yours?
- How could geopolitical events affect operations?
- Which cyber risks deserve more executive attention or budget?
It also helps leadership think through how a merger, a new market, or a new supplier changes exposure.
Who uses strategic threat intelligence
The main consumers are board members, C-suite executives, the CISO and security leadership, enterprise risk teams, and legal and compliance teams. Then, business continuity, corporate security, and procurement teams also rely on it when they weigh third-party risk. Reports for this audience should explain what is at risk, identify the decision required, and offer a recommended course of action rather than simply repeat cyber news.
Where to get strategic threat intelligence
Strategic intelligence draws on government and national bodies such as CISA the UK’s NCSC and CERT-EU along with sector risk reports and curated research from commercial providers. Internal sources matter too, since past incidents and business context shape what counts as relevant. Because this level often deals with incomplete information and future possibilities, good reports separate facts from analytical judgments and state the confidence behind each key assessment.
2. Operational threat intelligence
What operational threat intelligence covers
Operational threat intelligence explains a specific threat actor attack, or campaign. It covers the attacker’s identity or assessed identity, motivation and objectives, targets, infrastructure, and current activity. Where the other levels describe threats in general terms, operational intelligence is organized around one actor or operation.
It answers questions such as who is running a campaign, what they want, which sectors or countries they target, what infrastructure and malware they use, which stage of the attack is active now, and whether an internal incident is part of something larger.
Who uses operational threat intelligence
The main audiences are incident response teams, SOC managers, threat intelligence analysts, and threat hunters. Vulnerability management, malware analysis, and crisis management teams also use it during an active event. Typical outputs include threat actor profiles, campaign reports, infrastructure maps, attack-chain narratives, and early warnings.
Why operational intelligence requires specialized sources
Understanding a live campaign takes more than a public feed. It often draws on internet infrastructure data such as passive DNS and certificate records, malware analysis, sector-sharing communities, and curated vendor research that tracks actors over time.
Operational intelligence also connects the other levels. A campaign report may carry strategic context about the actor’s motivation, tactical detail about their TTPs, and technical indicators tied to their infrastructure. For example, when researchers identify a campaign that targets European software companies through stolen cloud administrator credentials, a business can check whether it fits the target profile and prepare its response before an incident occurs.
3. Tactical threat intelligence
What tactical threat intelligence covers
Tactical threat intelligence explains how attackers operate. It focuses on their tactics, techniques, and procedures (known as TTPs), rather than on a single IP address or file hash. Tactics describe an attacker’s broader goals during an intrusion. Techniques describe the methods used to reach those goals. Procedures describe how a particular actor applies those techniques in real incidents. The MITRE ATT&CK knowledge base provides a shared, behavior-based structure for this kind of analysis.
Tactical intelligenceIt answers more practical questions. How does the attacker gain initial access? How do they run code, steal credentials, keep access, avoid detection, and move between systems? Which security controls could interrupt those behaviors?
Who uses tactical threat intelligence
Tactical intelligence is the daily material of SOC analysts, threat hunters, detection engineers, and incident responders. Security architects use it to design stronger controls, and red and purple teams use it to test defenses against realistic attacker behavior. Typical outputs include ATT&CK mappings, behavior-based detection rules, threat hunt hypotheses, and incident response playbooks.
How tactical intelligence helps your organization
An attacker can replace a domain, server, or malware hash quickly. Changing their underlying methods, skills, and habits takes far more effort. That is why TTP intelligence tends to stay useful longer than large collections of short-lived indicators, and why it supports security architecture, detection engineering, and response plans so well.
Here’s oOne example: intelligence shows that an actor often steals cloud session tokens, adds new authentication methods, and uses legitimate remote access tools for persistence. Your team can then build detections for those behaviors and test whether identity and endpoint controls actually stop them.
4. Technical threat intelligence
What technical threat intelligence covers
Technical threat intelligence consists of the exact artifacts and observable signs tied to malicious activity. These are indicators of compromise (IOCs), along with signatures. Common examples include malicious IP addresses, domains and URLs, file hashes, phishing email content, malware signatures, and suspicious certificates.
It answers even more focused questions, for example:
- Which IP addresses should analysts investigate?
- Which domains are linked to malicious activity?
- Which file hashes identify known malware?
- Which of these appeared in internal logs, and how long should each indicator stay valid?
Who uses technical threat intelligence
Technical intelligence is used by SOC analysts, incident responders, and malware analysts, and it is consumed directly by systems. Security information and event management (SIEM) platforms, along with endpoint detection and response tools, firewalls, DNS security, and email security systems, all ingest it. Typical outputs include IOC feeds, blocklists, detection signatures, and STIX objects. STIX provides a standardized format for threat intelligence objects and their relationships, while TAXII supports exchanging them between systems; the two are often used together.
Limitations of technical threat intelligence
Technical intelligence is easy to automate but often loses value quickly, because attackers can change infrastructure, domains, and file hashes in a matter of hours or days. Old or low-confidence indicators create false positives and distract analysts. A useful IOC record should include the indicator and its type, the source, a confidence level, first-seen and last-seen dates, an expiry date, the related actor or campaign, and a recommended action. Quality scores, expiry information, and regular reviews of feed performance keep this level from becoming noise.
How the 4 types of cyber threat intelligence work together
A single intelligence product can move through all 4 levels as it develops:
- Strategic: a ransomware ecosystem increasingly targets healthcare suppliers.
- Operational: a specific group starts a campaign against identity and software providers.
- Tactical: the group steals credentials, abuses remote access tools, and disables endpoint defenses.
- Technical: analysts distribute the group’s current domains, IP addresses, URLs, and malware hashes.
Reading it the other way shows the value most clearly. Technical detections can reveal that an incident is underway. → Operational and tactical intelligence explain what the incident means and how the attacker behaves. → Strategic intelligence then helps leadership judge the wider business risk and decide what to change.
Each level makes the others more useful, which is the real point of working across all four rather than treating them as separate silos that never meet.
Common sources of threat intelligence
Threat intelligence comes from a mix of internal and external sources, and no single one is enough on its own. The strongest programs combine both so that gaps in one are covered by another.
Source category | Examples | Main value | Main caution |
|---|---|---|---|
Internal security data | SIEM logs, EDR alerts, identity events, firewall data, cloud logs | Direct evidence about activity inside your organization | Requires a clear asset inventory and adequate logging |
Government and CERT sources | CISA, NCSC, CERT-EU, national CERTs | High-authority advisories, campaigns, and defensive advice | Reports address a broad audience and need internal context |
Vulnerability sources | NVD, CISA KEV Catalog, vendor advisories | Vulnerability details, impact, and evidence of active exploitation | A flaw still needs matching to your own assets |
Sector communities | ISACs, ISAOs, trusted industry groups | Sector-specific incidents and peer information | Access and redistribution may be restricted |
Open-source intelligence | Security research, public feeds, malware databases | Broad and often free coverage | Quality, origin, and confidence vary widely |
Commercial providers | Mandiant, Microsoft, Google, CrowdStrike, and others | Curated actor, campaign, malware, and IOC research | Cost, overlap between feeds, and limited transparency |
Open, deep, and dark web | Criminal forums, marketplaces, leak sites | Stolen data, planned attacks, and access sales | Legal, ethical, and source-reliability concerns |
Internal data deserves special mention. Your own logs, incidents, and past investigations are often more relevant than any external feed, because they describe activity against your actual systems. When you assess an external source, judge it on relevance to your sector and assets, source reliability, timeliness, false-positive rate, the unique information it adds, and cost against practical use. Before employees interact with underground sources, consult your legal team.
One more governance point worth knowing. When intelligence is shared, the Traffic Light Protocol (TLP) signals how far it may travel, from TLP:RED for named recipients only through to TLP:CLEAR for open distribution. TLP indicates sharing limits, not a formal security classification.
With the right mix of sources in place, the next question is how to turn them into a working program.
How to start using threat intelligence in your business
You do not need a large team or an expensive platform to begin. A focused start is better than an ambitious program that collects everything and acts on nothing.
- Begin with business decisions. Define what you expect threat intelligence to support before you evaluate any tool. A smaller organization might start with just 1 or 2 use cases, such as detecting known malicious infrastructure in company logs or setting a fix order for actively exploited vulnerabilities.
- Assign responsibility. Give one person or team clear ownership of collection, analysis, distribution, and feedback, even if it is a named responsibility within your existing security team rather than a dedicated function.
- Identify critical assets and processes. Document your important applications, internet-facing systems, cloud and identity platforms, key suppliers, and the business processes that would hurt most if disrupted. External intelligence only becomes useful when you can match it against what you actually run.
- Create priority intelligence requirements. These, known as PIRs, are focused questions the program must answer, such as which actively exploited vulnerabilities affect your critical internet-facing assets. Keep them few, tie each to a real decision, and revise them as your environment changes.
- Start with a small source set. Internal logs, national CERT alerts, the NVD and CISA KEV Catalog vendor advisories, and 1 sector-sharing community are enough to begin. Add a commercial service only when the business case supports it, because more feeds do not automatically mean better intelligence.
- Use the intelligence cycle. Work through direction, collection, processing, analysis, dissemination, and feedback so that collecting data never becomes the whole point of the program.
- Tailor output to each audience. Executives need business impact and a clear decision. The SOC needs indicators, TTPs, and hunt queries. Vulnerability teams need a ranked list backed by exploitation and asset data. One long technical report rarely serves all of them.
- Set quality rules and measure results. Define approved sources, confidence terminology, IOC expiry, and rules for automatic blocking. Then track whether the intelligence leads to action, using measures such as the share of PIRs answered, detection rules created, relevant incidents found, and the false-positive rate by source.
When the program matures, threat intelligence platforms can help by collecting, normalizing, enriching, and correlating intelligence, then feeding it to your SIEM, endpoint tools, and case management. A platform is worth adding once you have defined your requirements and workflows, not before. Whichever threat intelligence solutions you eventually choose, the goal stays the same: to understand the threats most relevant to you, prepare for likely future attacks, and turn threat intel into decisions and defenses that hold up in practice.