Every security team is surrounded by data about threats. Feeds deliver thousands of suspicious IP addresses a day, vendors publish reports, and alerts arrive constantly. Very little of that data, on its own, helps anyone decide what to do. Cyber threat intelligence is the discipline that closes that gap. It asks which threats actually matter to a specific organization, gathers the right information about them, and delivers conclusions to the people who can act. This article explains what CTI is, the four types of intelligence and who uses each, the lifecycle that produces it, where it comes from, and how it makes detection, response, and testing more precise.
The short answer
Threat intelligence is knowledge about your adversaries that changes what you do. If a piece of information does not lead to a better decision, a faster detection, or a more targeted defense, it is not intelligence yet, no matter how sophisticated it looks.
In practice, CTI helps an organization answer three questions: who is likely to target us, how do they operate, and are we prepared for it? Every useful CTI program is built to answer those questions for its own business, not for the internet at large.
Data, information, and intelligence
The most common misunderstanding in this field is treating a stream of data as intelligence. The distinction is worth making precise, because it determines whether a CTI investment produces value or noise.
- Data is raw and unfiltered: an IP address, a file hash, a domain name, a username found in a dump.
- Information is data with some context: this IP address was used in a phishing campaign last week.
- Intelligence is information analyzed against your own environment and priorities: this campaign targets companies in our sector, uses a technique our current detection does not cover, and has impersonated our brand, so we need to act on these three points.
The value is created in the last step. Collecting more data is easy. Turning it into a judgment that someone can act on requires analysis, context about the business, and a clear understanding of what the organization needs to know.
The four types of threat intelligence
Threat intelligence serves different audiences, from the board to the analyst at the console. It is usually divided into four types, each answering a different question with a different time horizon.
| Type | Audience | Question it answers | Typical output |
|---|---|---|---|
| Strategic | Executives and the board | Which threats matter to our business and why? | Briefings on threat trends, risk to the sector, and investment priorities |
| Operational | Security leaders and incident responders | Who is targeting us, and what are they planning? | Insight into specific campaigns and actor intentions |
| Tactical | SOC analysts and detection engineers | How do these attackers operate? | Techniques mapped to MITRE ATT&CK, used to build and tune detection |
| Technical | Security tools and automated systems | What specific indicators should we block or watch? | Indicators of compromise such as domains, IP addresses, and file hashes |
The types have very different lifespans. Technical indicators change in days or hours, because attackers easily swap an IP address or a domain. Tactical knowledge about techniques lasts much longer, because changing how an attack works is costly for the adversary. This idea is often illustrated by the Pyramid of Pain: the higher up you build defenses, from indicators toward techniques, the more it hurts the attacker to adapt. A mature program uses all four types, but invests most of its analytical effort in the tactical and strategic layers.
The threat intelligence lifecycle
Intelligence is produced through a repeatable cycle. Skipping any stage is how CTI programs end up producing reports nobody reads.
- Define the intelligence requirements: what the organization needs to know, for which decisions, and for whom. A bank may prioritize fraud and credential theft, while an industrial company may prioritize threats to operational technology.
- Gather data from the sources that can answer those requirements, rather than from every source available.
- Normalize, deduplicate, translate, and organize the collected data so it can be analyzed.
- Connect the dots, assess reliability, and produce judgments: what is happening, how likely it is to affect us, and what should be done.
- Deliver the conclusions in the right format to the right audience, a short briefing for executives, detection guidance for the SOC, indicators for automated tools.
- Ask consumers whether the intelligence was useful and adjust the requirements accordingly.
The first and last stages are the ones most often neglected, and they are the ones that keep the program relevant to the business.
Where threat intelligence comes from
CTI draws on a wide range of sources, and good programs combine several of them so that each one compensates for the blind spots of the others.
- Open sources (OSINT): public reports, security advisories, researcher publications, social media, and technical repositories.
- Dark web and criminal communities: forums and marketplaces where access, data, and tools are traded, which often reveal targeting before an attack happens.
- Leaked credentials and infostealer logs: exposed usernames and passwords belonging to employees, customers, or third parties, one of the most actionable sources available because stolen credentials are a common entry point.
- Brand and domain monitoring: lookalike domains, fake profiles, and cloned pages that impersonate the organization.
- Commercial and community feeds: curated indicator feeds and sector sharing groups such as ISACs.
- Internal telemetry: the organization’s own alerts, incidents, and investigations, which are frequently the most relevant intelligence of all, because they describe attacks actually aimed at it.
The goal is not to collect from every possible source. It is to collect from the sources that answer the requirements defined in the direction stage.
How CTI powers the SOC
Threat intelligence and security operations are most valuable together. A SOC without intelligence reacts to alerts without context. Intelligence without a SOC produces knowledge that nobody acts on. In a managed SOC, CTI improves operations in four concrete ways.
First, it enriches alerts, so an analyst immediately knows whether an address or domain is associated with a known campaign. Second, it prioritizes, helping the team focus on activity linked to actors that actually target the organization’s sector. Third, it drives threat hunting, giving analysts specific hypotheses to search for, such as a technique recently adopted by a group that targets the industry. Fourth, it improves detection engineering, as techniques mapped to MITRE ATT&CK become new or better detection rules.
This applies regardless of the detection model in place. Whether the organization runs EDR, XDR, or MDR, intelligence is what tells the technology and the analysts what to look for beyond the vendor’s defaults.
How CTI shapes offensive testing
Intelligence is equally valuable on the offensive side. A credible Red Team engagement is built from intelligence about the actors that realistically target the organization, which is what separates adversary emulation from a generic attack scenario. The same applies to penetration testing priorities: knowing which techniques and entry points are being used against similar organizations helps decide where testing effort should go first.
The loop also works in reverse. Findings from offensive testing show which techniques the organization cannot detect, which in turn sharpens the intelligence requirements and the hunting priorities.
Common mistakes with threat intelligence
Four mistakes undermine many CTI investments:
- Buying feeds without analysis capacity. Thousands of indicators per day are useless if no one has the time or skill to evaluate them, and they often add alert noise instead of reducing it.
- Focusing only on indicators. Indicators expire quickly. Programs that never move beyond blocklists miss the longer-lasting value of understanding attacker techniques.
- Skipping the requirements. Without a clear definition of what the business needs to know, CTI becomes a generic news service rather than a decision tool.
- Not closing the loop. If intelligence never results in a new detection, a blocked threat, or a changed priority, the program cannot demonstrate value and eventually loses support.
How to measure the value of CTI
Threat intelligence should be measured by what it changes, not by how much it collects. Useful indicators of value include the number of detections created or improved from intelligence, threats identified before they caused impact, such as leaked credentials reset or fake domains removed, the share of alerts enriched with relevant context, reduced investigation time, and decisions informed by strategic briefings. A CTI program that can point to concrete actions it triggered is one that leadership will continue to fund.
How Mercurius delivers threat intelligence
Mercurius treats threat intelligence as a capability connected to operations, not as a separate feed. Intelligence requirements are defined with each client according to its sector, its exposure, and the decisions it needs to make. Collection covers the sources that matter most in practice, including dark web activity, leaked credentials, and brand impersonation, and the analysis is delivered in the format each audience needs, from executive briefings to detection guidance.
Because the same team runs the AI-native SOC and offensive security, intelligence flows directly into detection, threat hunting, and test scenarios. The result is intelligence that leads to action: credentials reset before they are used, detections created before a technique reaches the client, and test scenarios that reflect real adversaries.
Frequently asked questions
What is the difference between threat intelligence and threat data?
Threat data is raw, such as IP addresses, domains, or file hashes. Threat intelligence is that data analyzed against an organization’s own context and priorities, producing a conclusion that someone can act on. Data describes what exists. Intelligence explains what it means for you and what to do.
What are the four types of threat intelligence?
Strategic intelligence for executives, focused on risks and trends. Operational intelligence for security leaders and responders, focused on specific campaigns and actors. Tactical intelligence for SOC analysts, focused on attacker techniques. Technical intelligence for tools, focused on indicators of compromise.
Does a mid-sized company need threat intelligence?
Yes, though not necessarily a dedicated internal team. Mid-sized companies benefit most from focused intelligence, such as monitoring leaked credentials, brand impersonation, and threats to their sector, delivered as part of a managed security service that can act on it.
How does threat intelligence help a SOC?
It enriches alerts with context, helps prioritize activity linked to relevant threat actors, provides hypotheses for threat hunting, and turns knowledge of attacker techniques into new detection rules. It makes the SOC faster and more precise.
Is a threat intelligence feed enough?
Rarely. A feed provides indicators, which expire quickly and require analysis to be useful. Without people and processes to evaluate the data, connect it to the business, and act on it, a feed tends to add noise rather than reduce risk.
