Threat intelligence is the discipline of studying adversaries, the campaigns they run, and the methods they favor, then turning that understanding into guidance that helps an organization defend itself. It answers questions that purely technical signals cannot: who is likely to target this organization, what they tend to go after, how they operate, and where defenses should be strengthened first. The work supplies the context that makes everything else more deliberate, because detection rules, patching priorities, and executive decisions all improve when informed by a clear picture of the relevant threats rather than by reaction alone. The practice is often described across three levels: strategic intelligence on long-horizon trends and motivations, operational intelligence tracking specific campaigns and groups, and tactical intelligence covering the concrete technical details defenders can act on quickly.
Roles on this path#
- Threat Intelligence Analyst: collects, analyzes, and communicates intelligence about threats and adversaries so an organization can anticipate and prioritize its defenses.
- Strategic Threat Analyst: studies the broad forces shaping the threat landscape to inform executive strategy and long-term risk decisions.
- Threat Researcher: studies malware, attacker infrastructure, and techniques to produce the technical knowledge detection and intelligence teams depend on.
- Dark Web Analyst: collects and analyzes activity across dark web forums, marketplaces, and closed communities to surface risks to an organization.
- CTI Manager: leads a cyber threat intelligence team, aligning collection and analysis with risk and translating insight for technical and executive audiences.
Skills and certifications#
- Analysis over collection: weighing source reliability, separating confirmed fact from assessment, and stating conclusions with an honest sense of confidence.
- Frameworks: mapping observed behavior to catalogs of adversary tactics and techniques such as the MITRE ATT&CK Knowledge Base.
- Structured methods: familiarity with structured analytic techniques and the discipline of avoiding bias.
- Sources: gathering from internal telemetry, commercial and open feeds, information-sharing communities, and reporting on known adversary groups.
- Writing: clear, well-judged products, since a briefing or indicator set only has value when its audience can use it; resources from SANS support the craft.
How to progress#
People commonly enter from security operations, incident response, or general intelligence analysis, and some arrive from research, journalism, or military and government settings where assessment and reporting are already second nature. With experience, an analyst may specialize in tracking particular adversaries or regions, lead an intelligence function, or move toward threat hunting and detection engineering. Threat intelligence feeds the investigative work of DFIR by providing context on who and what an organization is facing, and it guides defensive security teams on what to watch for and prioritize, while leaving detection engineering and response operations to those functions.