Threat intelligence
Also known as: cyber threat intelligence, CTI, threat intel
Threat intelligence is evidence-based knowledge about cyber threats: who the attackers are, what they want, how they operate, and the technical clues they leave behind.
Security teams use it to prioritize defences, detect attacks sooner, and brief leaders on risk. While threat intelligence can be powerful, much of what's sold as intelligence is just raw data feeds, which only help if someone has the time to make them relevant.
Threat intelligence, explained at three levels
At home
Threat intelligence is like a neighbourhood watch newsletter for the internet. Experts gather reports of break-ins, scams, and suspicious activity, work out who is behind them and how they operate, and share warnings so others can prepare. When you see an alert about a new fake CRA text, that's threat intelligence turned into plain advice you can act on before the scam reaches you.
At work
Threat intelligence is analyzed information about who is attacking organizations, what they want, and how they do it. Security teams gather it from government advisories, vendors, and industry sharing groups, then use it to decide which flaws to patch first, what to block, and what to watch for. For a business, it means spending security money on the threats most likely to hit it.
At home
Threat intelligence starts with raw clues: the address a scam text points to, a malicious file sample, or chatter on a criminal forum. Analysts collect these, link them together, and work out who is behind them, what they are after and how they operate. The output depends on the audience. For the public, it becomes a plain warning about a new scam. For security tools, it becomes a list of addresses and file fingerprints to block automatically.
At work
Intelligence follows a cycle: set requirements, collect, process, analyze, distribute and get feedback. It is usually split into strategic intelligence for leaders, operational intelligence about specific campaigns, and tactical or technical intelligence such as attacker techniques and indicators of compromise. Sources include vendor reports, government agencies, information-sharing groups for specific industries, and open-source research. Machine-readable formats such as STIX, delivered over TAXII feeds, let tools import indicators without anyone retyping them.
At home
While threat reports read like neutral facts, every source has a viewpoint. Vendors highlight threats their products stop, and a report naming a country or group is an assessment with a confidence level, not proof. Good analysts say how sure they are, using phrases like 'high confidence'. In my view, government advisories, such as those from the Canadian Centre for Cyber Security, are the best place to start, because they explain what to do without trying to sell you anything.
At work
Intelligence only has value when it changes a decision, so mature teams start from priority intelligence requirements tied to their sector, assets and likely adversaries. Indicators decay fast, so feeds need confidence scores and expiry, and behaviour mapped to MITRE ATT&CK lasts longer than any IP list. A threat intelligence platform deduplicates and scores feeds before pushing them to the SIEM, EDR and firewalls. Measure output in terms of detections built, hunts run and incidents caught earlier, not the number of feeds subscribed to.
Real-world examples
At home
Fatima saw a warning from the Canadian Anti-Fraud Centre about fake CRA texts during tax season. Recognizing the scam, she deleted a similar message she received the next day.
At work
Jerome manages security for a Canadian health network. Threat intelligence showing ransomware groups exploiting a particular VPN flaw led his team to patch it days before attacks hit other hospitals.
How it compares
| feature | Threat intelligence | Threat data feed |
|---|---|---|
| What it is | Analyzed, actionable insight | Raw indicators and lists |
| Context | Who, why, and what to do | Little or none |
| Effort to use | Ready for decisions | Needs analysis |
| Audience | Leaders and defenders | Security tools |
Data says what. Intelligence says so what.
For analysts
Before buying threat intelligence, I'd write down which decisions it should inform. Without that, it becomes another unread report or noisy feed.
History & origin
Intelligence practices from military and government agencies shaped the field. In February 2013, the security firm Mandiant published its APT1 report, publicly linking a long-running hacking campaign to a unit of China's People's Liberation Army, a landmark in commercial threat intelligence. Information-sharing groups called ISACs grew across sectors, and standards such as STIX and TAXII, later managed by OASIS, made it easier to exchange intelligence. In Canada, the Canadian Centre for Cyber Security, created in 2018 within the Communications Security Establishment, publishes advisories and National Cyber Threat Assessments. Large vendors such as Microsoft, Google's Mandiant, and CrowdStrike now track hundreds of named threat groups. In my view, the best threat intelligence answers one question clearly: what should we do differently now?