The intelligence lifecycle: from requirements to feedback
In short: The intelligence lifecycle is a repeating process that starts with knowing what decision-makers need and ends with asking whether the product helped. Skipping direction or feedback is the most common reason threat intelligence programmes fail to deliver value.
Why a lifecycle?
Threat intelligence borrows its working method from traditional intelligence agencies. The intelligence lifecycle (sometimes called the intelligence cycle) breaks the work into stages so that effort is spent on questions that matter and products reach people who can act on them. Versions differ slightly, but most describe six stages.
Stages one to three: direction, collection, processing
Direction (also called planning and requirements) sets the questions. These are often written as priority intelligence requirements (PIRs). Examples: "Which ransomware groups target healthcare in our country?" or "Are any of our domains being imitated for phishing?". Requirements should come from stakeholders such as the SOC, IT operations, risk and leadership, not from the CTI team alone.
Collection gathers raw material to answer the requirements: internal logs and incident reports, government advisories, ISAC sharing, vendor reports and commercial feeds. Collect what the requirements need, and record where each item came from so its reliability can be judged.
Processing turns raw material into a usable form: removing duplicates, translating languages, parsing reports into structured indicators, and tagging items with dates and sources.
Stage four: analysis
Analysis is where information becomes intelligence. The analyst links facts, compares hypotheses and reaches a judgement, then states how confident they are. Useful habits include:
- Separating what is known from what is assessed.
- Using consistent confidence words (for example low, moderate, high) and explaining why.
- Considering alternative explanations, not only the first that fits.
- Watching for bias, such as over-trusting a favourite source or seeing a famous threat actor behind everything.
Structured models such as the Cyber Kill Chain and Diamond Model and the MITRE ATT&CK framework help organise analysis.
Stages five and six: dissemination and feedback
| Consumer | Format that works |
|---|---|
| Executives | One-page brief, plain language, business impact and recommended decision |
| SOC and hunters | Technical report with TTPs, detection ideas and queries |
| Security tools | Machine-readable indicators, for example in STIX via TAXII |
| IT teams | Specific actions: patch this, disable that, by this date |
Dissemination delivers the product in the right format, at the right time and with the right sharing label (see TLP and sharing). Feedback asks consumers whether it was timely, relevant and acted on. Their answers update the requirements, and the cycle starts again.
Tip: keep a simple log of each request, product and the feedback received. After a few months it shows clearly which work delivers value.
Practice
What is a priority intelligence requirement?
At which stage does information become intelligence?
Why is feedback essential?
Key takeaways
- The lifecycle runs: direction, collection, processing, analysis, dissemination, feedback.
- Direction sets priority intelligence requirements with stakeholders.
- Analysis turns information into judgements with stated confidence.
- Disseminate in the format each audience can use.
- Feedback closes the loop and keeps work relevant.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.