What Is Threat Intelligence? A Practical Breakdown

Many threat intelligence programs collect feeds, ISAC bulletins, CISA advisories and reports about named actors without changing what the SOC does or reducing the detection backlog. Threat information becomes intelligence when it changes a security decision. Closing that gap requires an architectural change that connects collection to security workflows.

Security teams create threat intelligence by analyzing threat information into decision-ready guidance that lets them choose and prioritize actions. Enrichment, hunting, detection engineering and response form a decision loop around collection. Useful intelligence produces a named decision: a rule written, a hunt run, a patch pulled forward or an account disabled.

TL;DR:

• Threat intelligence is analyzed, decision-ready information. A feed alone supplies data. NIST and SANS both define intelligence by the analysis applied and the decision it supports.
• Atomic indicators are a perishable input. Adversary behavior is more durable. Attackers can swap hashes, IPs, and domains cheaply, and the Pyramid of Pain explains why changing TTPs costs them more.
• Intelligence earns its budget when it reaches detection engineering, hunting and investigation. Without that handoff, feeds do not become rules, hunts or documented actions, and many programs gather no systematic feedback on whether intelligence changed a decision.
• SecOps consumes intelligence at volume. Hunting tests it against your own telemetry. When hunting runs only occasionally, current reporting may not reach the environment while the campaign is still active.

Threat Intelligence Is a Decision Product

NIST defines threat intelligence as threat information that has been aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes. The NIST threat intelligence glossary makes that distinction: raw IPs, domains, and hashes stay threat information until someone adds the analysis that connects them to a decision.

SANS's FOR578 course calls intelligence "actionable information that addresses an organization's key knowledge gaps, pain points, or requirements." A data feed or tool by itself does not produce intelligence. The course defines CTI, or cyber threat intelligence, as "the analysis of an adversary's intent, opportunity, and capability to do harm."

In many SOCs, much of what gets labeled intelligence still sits at the data layer. A good alert names the asset, the action, and the account involved, so an analyst can act without opening three other tools. A bad one is a bare indicator match, such as a dozen threat intelligence hits on a single IP, with no account, asset, or campaign context attached. The bare-indicator shape produces no decision.

The Four Types of Threat Intelligence and Who Consumes Them

The strategic, operational, tactical, and technical tiers exist to remind producers that different consumers need different products. Some frameworks use only three: SANS’s CTI poster lists strategic, operational, and tactical, and calls the model "a reference guide to remember that different audiences have different requirements of threat intelligence."

Detection engineers rely most on the tactical tier, especially the distinction between TTPs, or tactics, techniques, and procedures, and the indicators attached to them. MITRE's TTP-based hunting guidance, published in 2019, argues that searching for techniques an adversary must use is more durable than searching for tools and artifacts, because those techniques "do not change frequently."

First published in 2013, David Bianco's Pyramid of Pain still ranks the cost to the attacker of changing each indicator class: hashes trivial, IP addresses easy, domains a little harder, TTPs the hardest to replace. That's why a program built only on hash and IP feeds loses track of the same actor every time its infrastructure rotates.

Where Threat Intelligence Comes From, and What Each Source Gets Wrong

No single source comes close to complete because each collection source sees a different slice of activity. In a 2020 USENIX Security study, Bouwman and colleagues compared 2013–2018 indicators from two leading paid vendors against open sources and found almost no overlap between paid and open, and little between the two paid feeds. For 22 actors tracked by both vendors, only 2.5% to 4.0% of indicators overlapped, and shared indicators reached the second vendor an average of one month later.

Many programs combine public and commercial collection, and some add dark web collection. If you're paying for two premium feeds expecting redundancy, check how much they actually overlap first.

1. Open Feeds and OSINT

Open feeds, such as LevelBlue OTX and Blocklist.de, cost nothing to subscribe to, and open-source platforms such as MISP and OpenCTI carry no license fee. The real cost usually shows up later, as triage time, when indicators carry no expiration and no context about why they were flagged in the first place. A SOC that never prunes an open feed ends up chasing addresses that went legitimate months ago.

2. Commercial Feeds and Finished Reporting

Paid reporting earns its price on context. In Bouwman's study, paid reports were "much more complete in their description of the context, implications, and possible mitigation options." Depth has a cost: writing a finished report usually takes longer than a raw indicator takes to spread, so paid reporting tends to arrive after the fastest-moving phase of a campaign has already passed.

3. Government Advisories and ISACs

Government feeds are free, and the context is thin. CISA's Automated Indicator Sharing runs on STIX and TAXII and is open to private-sector and state, local, tribal, and territorial participants. DHS Inspector General reviews have found that those indicators often lacked the context needed to act on them, and that participation fell from 304 organizations in 2020 to 135 in 2022. ISACs add analysis specific to their sector, and many share threat information faster than government partners do. Use government indicators as leads to check against your own telemetry.

4. Dark Web and Infostealer Logs

Infostealer logs can expose credentials, session tokens, and URI paths that help teams prioritize a narrow, actionable slice of dark web collection. A practical way to narrow it is to start with URI paths containing "test," "staging," or "admin" and with legacy admin accounts, then flag which privileged accounts or stolen session tokens matter and whether any link to initial access brokers. Closed and dark web source use nearly doubled in a year, from 27% in 2023 to 48% in 2024, according to SANS's 2024 CTI survey.

5. Your Own Telemetry and Past Incidents

Internal telemetry lets teams test external claims against the users, systems, and incidents that actually define their exposure. Yet teams use external data more often than internal data: 90% versus 64%, in SANS's 2025 CTI survey of 489 professionals. That leaves what is often the most relevant source underused.

How Security Teams Actually Use Threat Intelligence

Security operations is the most common use for intelligence. Hunting and detection engineering, which turn it into lasting coverage, rank lower, so the handoff from enrichment and investigation into those two functions matters. In SANS's 2026 CTI survey, security operations (71%) reclaimed the top CTI use case it last held in 2022, overtaking threat hunting.

1. Enrichment at Ingestion

An indicator's reputation can change by the day, so context looked up later, at triage, can misdescribe the event it's attached to. Build the enrichment into SIEM lookup tables so each record carries a point-in-time view that the rest of your security operations stack can act on. The SIEM can correlate hits with GeoIP, compare across users and hosts, and adjust severity or routing on that basis.

2. IOC Matching and Retroactive Sweeps

When a new indicator arrives, sweep the history you retain for it; a match there points to past exposure that a live block would never catch. Stamus Networks reports that many large organizations have found that "an IOC without context is not valuable," so attach actor and campaign details before an indicator reaches a matching rule.

3. Converting TTPs Into Detection Rules

Rules tied to a report's tool names create a structural weakness: attackers can evade them from the day they ship. In a 2022 detection backlog post, SpecterOps calls the backlog an input chokepoint and uses the example of a 15-item high-level intelligence PDF that "provides very little actionable information for a detection engineer." A separate 2021 SpecterOps case study examined a detection that several threat reports recommended, built on specific BCDEdit command-line parameters; because the detection missed the underlying registry interaction, an attacker only needs to write marshaling functions to evade it.

When you request intelligence from the CTI team, ask which chokepoint and telemetry the behavior touches. Tool attribution alone does not answer that question.

4. Hunt Hypotheses

Hunts validate or discard intelligence. A hunt hypothesis tests whether the behavior an intel report describes is present in your telemetry when no alert has fired. If the hunt finds it, you have a detection gap. If it comes back clean, note the time window and telemetry the hunt covered; within those limits, you can deprioritize the report with evidence. David Bianco's PEAK framework separates hunts into hypothesis-driven, baseline, and model-assisted categories.

5. Vulnerability Prioritization

Orca's prioritization framework moves any vulnerability on CISA's Known Exploited Vulnerabilities (KEV) list to the front of the remediation queue regardless of CVSS score. Exploitation intelligence works best when it's paired with reachability analysis, which helps show whether the vulnerable code path is actually reachable in your own environment.

Decision Criteria: Build, Buy, or Let Your Provider Carry It

Requirements and people to act on them determine the right model more than budget does. In SANS's 2026 CTI survey, 91% of CISOs surveyed rated threat intelligence valuable or extremely valuable, yet only 26% said it significantly influences their decisions. The same survey found that 57% of programs don't track maturity over time and 49% gather no systematic feedback.

Many programs collect intelligence without linking it to requirements, actions, and feedback. Most formal CTI teams have fewer than four full-time staff, and intelligence exists so someone outside the CTI team can make a decision with it.

If you have no documented intelligence requirements, write them before buying anything. SANS's Priority Intelligence Requirements guide chains strategic PIRs to a Threat Actor Prioritization, then weighs Priority TTPs against existing defenses. Without that chain, programs "drift toward collecting whatever data is available rather than what is needed," according to Decryption Digest.

If your security team is one to three people, outsourced threat intelligence services can carry that burden. Judge the result by outcomes: ask how intelligence changed a verdict in one of your own investigations.

A threat intelligence platform may add noise before it adds signal when no analysts can act on its output. Teams create that noise when they buy a platform and activate every feed before defining how anyone will use the output, trying to jump from no process to full automation without building the requirements and workflows in between. A platform is generally only as useful as the description attached to each indicator it stores; indicators with no attached context just accumulate as an unused database.

Embedded provider or platform intelligence can suffice for triage and detection when it enriches alerts inside the workflow that acts on them. The same SANS survey found executives rank actively targeted vulnerabilities (79%) and adversary TTPs (77%) first and business-focused intelligence last at 41%, a gap it attributes to production rather than demand. Judge the intelligence by whether it changes what gets prioritized and how investigations run.

For reporting, Kraven Security offers this template for distinguishing outcomes from raw throughput: replace "15 reports this month" with "15 reports produced, with 12 receiving positive feedback and 8 leading to documented actions by stakeholders."

Testing Intelligence Against Your Own Environment

Most teams already consume intelligence. Many lack a regular way to test it against their own environment. The hardest intrusions often never trip a signature. When hunts run only occasionally, a hypothesis drawn from this month's reporting may not run until the campaign behind it has moved on.

In SANS's 2026 hunting survey, data quality or quantity overtook staffing as the top barrier to effective hunting for the first time in the survey's history, cited by half of respondents. Confirmed findings should go to detection engineering, whether the fix is a new rule, a closed telemetry gap, or a control change. Without that loop, intelligence that never matched an alert leaves no trace in your coverage.

Frequently Asked Questions About Threat Intelligence

What Is the Difference Between Threat Data and Threat Intelligence?

Threat data is a raw observable, such as an IP address, domain, or file hash, with no context attached. It becomes threat intelligence only once someone analyzes it against a specific decision, such as whether to block it, hunt for it, or escalate it.

Does Threat Intelligence Replace the Need for a SOC?

No. Intelligence informs the decisions a SOC already has to make; it doesn't run the SOC's workflows for it. A feed with no team positioned to act on it just produces noise.

What Skills Does a Threat Intelligence Analyst Need?

Strong analysts combine the technical ability to parse indicators and TTPs with the analytical judgment to connect them to an organization's specific exposure. Writing clearly for a non-technical audience, such as a board or an executive team, matters as much as the technical analysis itself.

Where Does Threat Intelligence Sit Within a Security Team?

There's no single reporting line. Some programs sit inside the SOC and feed enrichment and triage directly; others report through detection engineering or a dedicated CTI function that serves the SOC, hunting, and leadership as separate customers. What matters more than the org chart is whether the function has a direct channel into the teams that act on what it produces.

How Long Does It Take to Stand Up a Threat Intelligence Capability?

Writing documented intelligence requirements usually takes a matter of days. Building the workflows that turn intelligence into detections and hunts, and proving they work, typically takes a full quarter or more, since it depends on how quickly a program can show a feed changed a real decision.

‍