What Is Cyber Threat Intelligence?

The intelligence lifecycle, step by step

Mature CTI teams follow a lifecycle, usually described in five or six phases. The labels vary between frameworks; the logic does not.

1. Direction. Decide what questions you are answering and for whom. These are your intelligence requirements - for example: which ransomware groups target European healthcare, and which of their techniques would work on us?
2. Collection. Gather raw material against those requirements: open source reporting, commercial feeds, sharing communities such as ISACs, vendor research and your own internal telemetry and incident data.
3. Processing. Normalize what you collected so it can be worked with: deduplicate, translate, and structure it in a consistent format. This is where STIX earns its keep.
4. Analysis. Turn processed information into judgments: what does this mean for us, how confident are we, and what should change because of it. This is the human core of the discipline.
5. Dissemination and feedback. Deliver the result in the form each audience needs - a briefing, a report, a detection rule, a blocked indicator - then ask whether it helped. Feedback loops back into direction, and the cycle repeats.

The four levels of threat intelligence

CTI is usually split into four levels. The split matters because each level answers a different question, for a different audience, on a different time horizon.

A common trap is buying technical intelligence - indicator feeds - and expecting strategic answers from it. Indicators age out in days; the why behind an attack does not.

STIX, TAXII and MITRE ATT&CK, in plain words

STIX (Structured Threat Information eXpression) is a common format for describing threats - a shared vocabulary in which threat actor, campaign, indicator and the relationships between them mean the same thing in every tool. If intelligence is knowledge, STIX is the grammar it is written in.

TAXII is the transport that moves STIX around: a protocol platforms use to publish and subscribe to collections of intelligence. STIX is the letter; TAXII is the postal service.

MITRE ATT&CK is a public, community-maintained catalog of adversary behaviors: tactics (what attackers are trying to achieve) and techniques (how they do it), drawn from real-world observation. It gives defenders a shared map. Instead of saying they did something clever with scheduled tasks, you can say T1053 - and anyone can check whether their detections cover it.

Who consumes threat intelligence

Intelligence has no value until someone uses it. In practice, a CTI function serves several very different customers:

• SOC analysts use technical intel to enrich alerts: is this IP known infrastructure, is this hash known malware?
• Incident responders use operational intel to understand who they are likely dealing with and what that actor tends to do next.
• Detection engineers and threat hunters use tactical intel - TTPs mapped to ATT&CK - to decide which detections and hunts to build.
• Vulnerability managers use intel to prioritize: of the thousands of open CVEs, which are actually being exploited by actors that target us?
• Executives and risk owners use strategic intel to steer budget and posture.

What adoption actually looks like

Honest expectations help. Industry surveys - the annual SANS CTI survey is the most cited - have tracked the same trends for years: CTI has moved from a niche discipline to a mainstream function, but maturity is uneven.

How to start without a big team

You do not need a threat intelligence team to start doing threat intelligence. You need three things: one or two written intelligence requirements, a small set of sources you actually read, and a place to structure what you learn so it accumulates instead of evaporating in bookmarks and chat threads.

That last part is where a threat intelligence platform earns its place. Open source options like OpenCTI let you store knowledge as structured STIX objects, connect free sources, map everything to ATT&CK and share it with the tools and people who act on it. Start with one requirement, one weekly product - even a half-page email - and one consumer who reads it. Grow from evidence that it helps.