“Many organizations equate “”threat intelligence”” with a subscription: a vendor feed of malicious IPs and file hashes piped into a SIEM. That’s threat data, not threat intelligence. The difference matters enormously, and understanding it is the first step toward a program that actually informs decisions instead of just generating more alerts.
The Pyramid: Data, Information, Intelligence
Raw indicators (an IP address, a file hash) are data. Context around that data (this IP was used in a phishing campaign last week) is information. Intelligence is the analytical layer on top: this IP is associated with a threat actor known to target financial services firms in our region, using a TTP that would bypass our current email filtering, which means we should prioritize hardening X control this quarter. That last step, turning observations into a decision, is what separates a mature CTI program from an expensive alert firehose.
The Three Levels of Threat Intelligence
Strategic: high-level trends for executives and board members: which threat actors target our industry, how the regulatory landscape is shifting, what’s the geopolitical risk to our supply chain. This informs budget and risk appetite decisions.
Operational: details on specific campaigns and actor TTPs (Tactics, Techniques, and Procedures) that inform SOC detection priorities and incident response playbooks.
Tactical: the indicators of compromise (IOCs) themselves: hashes, domains, IPs: the most perishable and least valuable layer on its own, since sophisticated attackers rotate infrastructure constantly.
Programs that only consume tactical intelligence are chasing indicators that are often already stale by the time they’re actioned. Mature programs invest disproportionately in operational intelligence, understanding how attackers operate, which survives infrastructure changes far better than any specific IOC.
The MITRE ATT&CK Framework as a Common Language
ATT&CK’s taxonomy of adversary tactics and techniques gives defenders a shared vocabulary for describing behavior instead of just indicators. Rather than “”block this IP,”” operational intelligence framed through ATT&CK says “”this actor consistently uses T1566.001 (spearphishing attachment) followed by T1055 (process injection): do we have detection coverage for that specific sequence?”” This reframes threat intelligence from reactive blocklisting into a gap analysis against your actual detection capability.
Building a Threat Intelligence Function Without a Massive Budget
Prioritize relevance over volume. Subscribing to every free feed available creates noise. Identify your actual threat landscape: industry, geography, technology stack: and focus intelligence collection there.
Participate in an ISAC (Information Sharing and Analysis Center) relevant to your industry. Peer-shared intelligence about active campaigns targeting your specific sector is often more actionable than generic commercial feeds.
Close the loop with detection engineering. Every piece of operational intelligence should prompt a question: “”do we have a detection rule for this technique?”” If not, that’s your next SOC engineering priority.
Track threat actor TTPs relevant to your industry over time, not just individual incidents: patterns emerge across campaigns that single-incident analysis misses.
Case Study: Contextualizing an IOC Feed
A retail company received a tactical feed alert for a known malicious domain. Rather than just blocking it, their analyst checked operational intelligence sources and found the domain was linked to a specific ransomware affiliate group known for targeting retail point-of-sale systems via a particular vulnerable payment processing plugin. That context let the team proactively patch the specific plugin across all locations: turning one blocked domain into a targeted vulnerability remediation effort that closed the actual door the actor would have used.
The Bottom Line
Threat intelligence earns its name only when it changes a decision: a detection rule you build, a patch you prioritize, a control you invest in. If your “”threat intel”” consumption ends at blocking an IP address, you’re one infrastructure rotation away from being back to square one. Invest in understanding how your likely adversaries operate, not just where they were seen last.”