Threat intelligence is the practice of gathering, analyzing, and applying insight about adversaries, their tactics, and their tooling to guide defensive decisions. It helps an organization understand who might target it and how, so that limited effort is spent where the likely threats actually are.

Within the Preparation phase, threat intelligence gives defense direction. Without it, teams tend to protect everything equally or chase the loudest news. Intelligence grounds priorities in evidence, informing which detections to build, which weaknesses to fix first, and which scenarios to rehearse. It connects the wider threat landscape to the specific environment a team must defend.

In practice, threat intelligence follows a lifecycle: defining requirements, collecting from open and commercial sources, analyzing to separate relevant signal from noise, and disseminating findings in a form each audience can use. Outputs range from technical indicators that feed detection to strategic assessments that inform leadership. The most valuable intelligence is actionable, timely, and tied to the organization's context, describing adversary behavior in terms defenders can map to controls. Shared frameworks and trusted communities help teams exchange insight and avoid learning the same lessons alone.

References#

• MITRE ATT&CK, adversary tactics and techniques knowledge base
• FIRST, Traffic Light Protocol for intelligence sharing