Threat Intelligence
Gathered and analyzed information about current attackers, their methods, and attack indicators.
Threat intelligence↗ is information gathered, processed, and interpreted about current attackers, the methods they use, the sectors they target, and indicators of compromise (IoCs). Its goal is to base defense on the real-world threat landscape rather than guesswork.
Good threat intelligence isn't a raw pile of data, it's contextual, actionable information that answers "who is targeting whom, with what method, and how do we stop it?" It is usually handled at different levels: strategic (the big picture and trends for senior leadership), operational (attacker campaigns and methods), and tactical (concrete indicators, malicious addresses, file signatures).
Its value depends on connecting this information directly to defense: indicators get turned into detection rules, attacker methods feed threat-hunting hypotheses, and trends shape investment priorities. This lets an organization update and prioritize its defenses before an attack happens, not after.