Threat intelligence 101: what it is and who needs it

01.What threat intelligence is

Threat intelligence is information about attackers, tools and techniques, filtered for relevance. The important word is filtered. A list of ten thousand bad IP addresses is data. Knowing which of them matter to your business, and what to do about them, is intelligence.

Good intelligence is relevant, timely, accurate and actionable. Weak intelligence fails at least one of these. It describes a threat you do not face, arrives too late, is wrong, or gives you nothing to do.

02.The four types

Intelligence is often split into four layers, from broad to specific. Picture a pyramid.

Strategic. Trends for leaders. Which kinds of attackers target your industry, why, and how the landscape is shifting. It informs budgets, risk decisions and board discussions. It is usually written in plain language.

Operational. Campaigns. Who is behind an active effort, what they want, and how they operate over time. It helps security managers plan defence and prioritise work.

Tactical. Techniques. How attackers behave step by step: how they gain access, move around and hide. Detection engineers and hunters use this to write rules and queries.

Technical. Indicators. File hashes, domain names, IP addresses and similar items that can be matched against logs. Technical intelligence is the most automatable, and it also decays the fastest. An address used in an attack today may belong to someone innocent next month.

Each layer has different readers and a different shelf life. Mixing them up is a common source of confusion.

03.Who needs it

Companies in targeted industries. Some sectors attract more attention because of the data they hold or the money that flows through them. If attackers focus on your industry, intelligence about them is worth more to you.

Security teams with enough capacity to act on it. This is the key condition. Intelligence is only useful if someone reads it and does something. A team that cannot keep up with its current alerts will not benefit from more information.

MSSPs serving many clients. A provider sees patterns across customers and needs to apply intelligence consistently to each. A platform with per-client scoring and separation of data makes this workable.

Smaller firms can get value through a managed service. If you have no security staff, you do not need to build a programme. A managed provider can use intelligence on your behalf, and report in plain terms.

04.Who probably does not need it yet

If you lack basics such as multi-factor authentication, patching, backups and log collection, do those first. Intelligence will tell you about threats you are already weak against, and you will not have capacity to respond. Fix the foundations, then add intelligence on top.

05.What a working setup looks like

Even a modest programme has the same parts:

• Sources. A small number of feeds and reports you trust, chosen for your sector. Quality beats quantity.
• Processing. Deduplication, normalisation and enrichment, so the same indicator does not appear five times.
• Scoring. A way to rank items by relevance to your assets, with reasons you can read.
• Delivery. Indicators pushed to your SIEM, EDR or firewall, and summaries sent to people who make decisions.
• Action. A routine for hunting, patching and updating detections based on what you learn.
• Feedback. Notes on what proved useful, so sources and scores improve.

Parts two to four are software. Parts one, five and six are people and habits. You need both.

06.Common mistakes

• Starting with technical indicators only. They are easy to collect but short-lived. Tactical and strategic views age better.
• Collecting everything. Volume creates noise and cost.
• No link to action. If nothing changes after reading, the effort is wasted.
• Ignoring internal intelligence. Your own incidents and logs are among your best sources.
• Forgetting to retire old data. Stale indicators cause false positives.

07.What to do next

Write down the three attackers or attack types most likely to target you. Pick one or two sources that cover them. Decide who reads the output and what they will do with it. Start small and measure.

08.Matching the type to the reader

The four types only help if each reaches the right person. A board member does not need a list of hashes. A hunter does not need a trend report. Match the type to the decision.

• Board and executives: strategic intelligence, a page at most, tied to risk and spend.
• Security managers: operational intelligence, to plan staffing, patching priorities and exercises.
• Detection engineers and hunters: tactical intelligence, to write rules and queries.
• Analysts and tools: technical indicators, delivered automatically into detection systems.

A common failure is giving analysts a strategic report and executives a feed of indicators. Both leave the room confused.

09.A worked example

Imagine a mid-sized logistics firm. A strategic report says that firms in the sector are being targeted for invoice fraud. That informs a decision: tighten approval steps for changes to supplier bank details. An operational report describes a campaign using fake supplier emails, which tells the security manager to review email filtering. A tactical report details how attackers set up mailbox forwarding rules to hide replies, so a detection engineer writes a rule for new forwarding rules on finance mailboxes. A technical feed gives sender domains, which are loaded into the email gateway.

Four layers, four readers, one threat, and each person did something different. That is what working intelligence looks like.

10.Build, buy or outsource

There are three honest options. Buy a feed or a platform when you want fast coverage and have staff to use it. Build when your needs are specific, you serve many clients, or you need to combine sources in ways products do not allow. Outsource when you have no staff to act on it. Many organisations mix them: a bought feed, a small amount of custom processing, and a managed provider for round-the-clock cover. Decide by asking who will act on the output, not which product has the longest feature list.

11.Keeping it honest

Intelligence is often wrong at the edges. Sources disagree, attribution is uncertain and indicators are reused or recycled. Good practitioners say how confident they are. Ask every source for a confidence level and the date of the information. Treat a claim from a single source as a lead, not a fact. When two independent sources agree, confidence rises. When you act on weak information, say so in your notes, so the next person knows how much weight to give it.

Brandsmashers Tech builds platforms that collect, clean and score threat information, and hunting workflows that make it useful. If you are deciding whether to build, buy or outsource, we can help you think it through.