What cyber threat intelligence is: strategic, operational, tactical and technical
In short: Cyber threat intelligence is analysed information about threats that helps people make better security decisions. It is usually described at four levels, strategic, operational, tactical and technical, each serving a different audience from the board to the SOC tools.
What threat intelligence is
Cyber threat intelligence (CTI) is knowledge about threats, such as who might attack you, why, how and with what, that has been collected, analysed and shaped to support a decision. The key word is decision. A list of a million suspicious IP addresses is data. A short assessment saying "a criminal group targeting logistics firms in our region is exploiting the VPN product we use; patch within 48 hours" is intelligence.
Good intelligence is relevant (about threats to you), timely (arrives before it is useless), accurate and actionable (someone can do something with it). It also states how confident the analyst is and how reliable the sources are.
The four levels
| Level | Question it answers | Audience | Example |
|---|---|---|---|
| Strategic | What threats matter to our business over the next year? | Board, executives, risk managers | Ransomware against our sector is rising; budget for backup resilience |
| Operational | Which specific campaign or actor is coming, and when? | Security managers, IR leads | A group is targeting firms like us with fake invoice emails this month |
| Tactical | How do these attackers operate? | SOC analysts, detection engineers, hunters | They use stolen VPN credentials, then remote management tools |
| Technical | Which exact artefacts can we block or search for? | SIEM, EDR, firewalls, analysts | File hashes, domains and IP addresses from the campaign |
Some authors merge tactical and technical, or use slightly different definitions. In exams, explain the idea of different audiences and time spans rather than arguing over labels.
Where intelligence comes from
- Internal: your own incidents, alerts and logs. Often the most relevant source of all.
- Open source (OSINT): government advisories such as those from the UK National Cyber Security Centre (NCSC) or the US Cybersecurity and Infrastructure Security Agency (CISA), vendor research blogs and public reports.
- Communities: sector sharing groups such as Information Sharing and Analysis Centres (ISACs).
- Commercial: paid feeds and analyst services, which vary widely in quality.
Using CTI well
Start from intelligence requirements: the questions your organisation actually needs answered. Without them, teams collect everything and use nothing. Feed technical indicators into tools automatically, feed tactical knowledge into detection engineering and threat hunting, and turn strategic findings into short, plain-language briefings for leaders.
A common mistake is to equate CTI with buying a feed. Indicators age quickly and attackers change them cheaply. The longer-lasting value comes from understanding behaviour, which is covered in IOCs versus TTPs.
Real-world example: four levels at one water company
A fictional regional water company receives a government advisory about a group targeting water utilities. The security manager turns it into four products. For the board, a one-page strategic brief explains why the sector is targeted and what investment in operational technology monitoring would cost. For the incident team, an operational note describes how the group usually gets in, through exposed remote-access gateways. For the SOC, a tactical summary lists the group's techniques mapped to ATT&CK so analysts can check their detections. For the tools, the technical indicators (domains and file hashes) are loaded into the SIEM and firewall. One report, four audiences, each given only what they need.
Practice
A report tells the board that attacks on cloud identity are the main sector risk for next year. Which level is this?
What turns a list of indicators into intelligence?
Who is the main audience for tactical intelligence?
Key takeaways
- CTI is analysed threat information that supports a decision.
- Good intelligence is relevant, timely, accurate and actionable.
- Four levels: strategic, operational, tactical and technical.
- Sources include internal data, OSINT, sharing communities and commercial feeds.
- Start from intelligence requirements, not from buying feeds.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.