Threat Intelligence

Raw data, such as a list of malicious web addresses, becomes intelligence only after someone checks it, adds context and links it to the organisation's own exposure. Teams usually describe four levels. Strategic intelligence tells the board which adversaries target the sector and why. Operational intelligence describes live campaigns. Tactical intelligence covers the methods attackers use, and technical intelligence supplies indicators such as file fingerprints and server addresses that tools can block. Sources include internal logs, industry sharing groups, government alerts and paid feeds. A feed alone is not intelligence; it is an input. Security operations, vulnerability teams and risk committees all use it. Analysts use it to decide which alerts to chase first and which controls to tighten.

A regional insurer joins an industry sharing group. An alert warns that a criminal gang is phoning help desks to reset staff passwords and then targeting claims systems. The insurer's analysts check this against their own logs, find two odd reset requests, tighten identity checks on the help desk, and brief the board on the wider campaign.