What Is Cyber Threat Intelligence?

Ask ten security teams what cyber threat intelligence is and you will get two kinds of answer. Most will describe a thing they receive — a feed of IP addresses, a vendor portal, a weekly PDF. A smaller number will describe a thing they do — a process that turns questions into answers reliable enough to act on.

The second answer is the correct one, and the gap between the two explains why so many organisations buy threat intelligence and get nothing from it.

Intelligence is defined by its consumer, not its content

The oldest working definition in the discipline comes from military and national intelligence practice, and it survives translation to the cyber domain almost unchanged: intelligence is information that has been collected, evaluated, and analysed to answer a specific question for a specific decision-maker.

Every clause in that sentence is load-bearing.

• Collected — from a source whose nature and reliability are known.
• Evaluated — the source and the content assessed separately.
• Analysed — placed in context with other holdings, not merely reported.
• A specific question — the requirement exists before the collection does.
• A specific decision-maker — someone who will do something differently as a result.

Remove the consumer and you no longer have intelligence. You have information. A list of ten thousand malicious IP addresses with no stated question behind it is not intelligence in any useful sense; it is inventory. It becomes intelligence only at the moment someone can say who asked, what they will decide, and what would change their mind.

This is the most common failure in commercial CTI, and it is a structural one rather than a quality one. A vendor selling the same feed to four thousand customers cannot know the question any of them are asking. The product is therefore produced consumer-blind, and the work of making it intelligence — deciding what it means here — is silently transferred to the buyer, who usually does not do it.

Data, information, intelligence

The distinction is worth stating precisely, because the three words are used interchangeably in marketing and they are not interchangeable in practice.

Layer	What it is	Example
Data	An observation, uninterpreted	185.220.101.47 appeared in a firewall log at 03:14
Information	Data with context attached	That address is a known Tor exit node, seen in 900 other networks this week
Intelligence	Information assessed against a requirement	Tor egress to our payroll system at 03:14 is inconsistent with our access policy; the account involved has no prior Tor history; recommend credential reset and session review

Note what happens at the third row. Someone has made a judgement, and that judgement can be wrong. This is the defining property of intelligence and the reason it must carry a confidence statement. Data cannot be wrong, only inaccurate. Intelligence can be wrong, and the honest product says how wrong it might be.

The intelligence cycle — and where it actually breaks

The classical cycle has five or six stages depending on which doctrine you follow. Direction → Collection → Processing → Analysis → Dissemination → Feedback.

It is taught as a circle. It rarely runs as one. In practice three stages absorb almost all the failure:

Direction fails silently. Most teams never write down their Priority Intelligence Requirements. Without a PIR, collection expands to fill available budget and analysis has no criterion for relevance. The symptom is a team that collects enormously and reports little — every source is “interesting” because nothing has been declared uninteresting.

Processing is underestimated. Normalisation, deduplication, enrichment and entity resolution are treated as plumbing. They are not: they are where provenance is most often destroyed. An indicator that arrives with a source, a first-seen timestamp and a reliability grade, and leaves the pipeline as a bare string in a blocklist, has been stripped of everything that made it assessable. It can no longer be aged out, disputed, or attributed. The pipeline did not lose data; it lost the ability to reason about data.

Feedback almost never happens. Very few CTI functions can say whether their last fifty products changed any decision. Without that loop the function cannot improve, and cannot defend its budget with anything other than volume metrics — reports issued, indicators ingested — which measure effort, not effect.

The four kinds of CTI, and who each is for

“Threat intelligence” names four quite different products with different consumers, different lifespans, and different failure modes. Conflating them is why a CISO gets handed a packet capture and a SOC analyst gets handed a geopolitical essay.

Strategic

Consumer: executives, boards, risk committees. Lifespan: months to years. Question: how is the threat landscape changing in ways that should alter our investment, posture, or risk appetite?

Strategic intelligence is mostly prose, rarely technical, and judged on whether it improves a decision that involves money or people. It is the hardest to produce well because it requires the analyst to reason beyond the evidence while staying honest about doing so.

Operational

Consumer: incident response leads, threat hunters, security architects. Lifespan: weeks to months. Question: who is likely to come after us, with what tradecraft, and against which part of our estate?

This is campaign-level work: adversary behaviour, targeting patterns, infrastructure reuse, timing. It is the layer where frameworks like MITRE ATT&CK earn their keep, because it lets behaviour be described in a way that survives the adversary changing their tooling.

Tactical

Consumer: SOC analysts, detection engineers. Lifespan: weeks. Question: what does this adversary do, concretely, that we could detect?

Tactical intelligence is TTPs rendered into detection logic. Its quality test is brutally simple: did a detection get written, and did it fire on something real without drowning the queue in false positives?

Technical

Consumer: automated controls — firewalls, EDR, proxies, SIEM. Lifespan: hours to days. Question: what specific artefacts should be blocked or alerted on right now?

This is the indicator layer, and it is the one most often mistaken for the whole discipline. Its defining characteristic is rapid decay. An adversary-controlled domain may be useful for seventy-two hours. A file hash dies the moment a single byte changes. Technical intelligence without an expiry policy does not merely become useless; it becomes actively harmful, accumulating into blocklists that generate false positives long after the threat has moved.

The pyramid of pain explains why feeds disappoint

David Bianco’s Pyramid of Pain ranks indicator types by how much it costs the adversary when you detect them. From cheapest to most expensive to change:

1. Hash values — trivially changed. One recompile.
2. IP addresses — cheap. Rent new infrastructure.
3. Domain names — modest cost. Register more.
4. Network and host artefacts — real effort. Retool.
5. Tools — significant. Rebuild or acquire.
6. TTPs — expensive. Retrain the operator and change how they work.

Commercial feeds overwhelmingly deliver the bottom three tiers, because those are the tiers that can be produced automatically and at volume. Those are also the tiers the adversary can discard without noticing. This is the structural reason organisations subscribe to more feeds and see no improvement in detection: they are buying the cheap end of the pyramid at scale and expecting behavioural-level results from it.

Moving up the pyramid is expensive — it requires analysts rather than pipelines — which is precisely why it is defensible.

Confidence is not optional, and it is not a number you invented

An intelligence product without a confidence statement is an opinion in a uniform.

Two public standards are worth adopting, and they do different jobs.

The Admiralty Code (NATO STANAG 2511) grades source and content separately, on two axes:

• Source reliability: A completely reliable → F cannot be judged.
• Information credibility: 1 confirmed → 6 cannot be judged.

So a report graded B2 is “usually reliable source, probably true content”. The critical feature is the separation: a completely reliable source can report something improbable, and an unreliable source can be correct. Collapsing the two axes into one number — which almost every commercial “confidence score” does — destroys exactly the information an analyst needs to decide whether to seek corroboration.

ICD 203 (US Intelligence Community Directive on Analytic Standards) fixes the meaning of estimative language, so that “likely” means the same thing to the writer and the reader. The point is not the specific bands; it is that the bands are published and fixed. Words like “possible” and “probable” carry wildly different probabilities in different readers’ heads, and an intelligence function that has not standardised them is miscommunicating at a rate it cannot measure.

There is a third state that both standards handle and most tooling does not: unable to assess. This is not low confidence. It is the explicit statement that we lack the basis to form a judgement at all. A system that has no way to express “we did not look” will express it as “we found nothing”, and those two are opposite in meaning. This single conflation is, in my experience, the most expensive unexamined bug in security reporting.

Both standards, and the three-state distinction above, are implemented in cti-confidence — a small open-source library that deliberately refuses to collapse the two Admiralty axes into a single score.

Sharing: TLP, and why it is a protocol rather than a preference

Intelligence loses value when it is hoarded and loses sources when it leaks. The Traffic Light Protocol (FIRST TLP 2.0) exists to make the sharing boundary explicit at the moment of writing rather than negotiable at the moment of forwarding:

• TLP:RED — named recipients only.
• TLP:AMBER — recipient’s organisation; TLP:AMBER+STRICT limits to the organisation only.
• TLP:GREEN — the community, not public.
• TLP:CLEAR — unrestricted.

The label belongs on the product, not in a covering email, because products outlive their covering emails.

What a good CTI product actually looks like

Strip away format and a defensible product answers six questions:

1. Who asked? The requirement, named.
2. What do we assess? The judgement, stated plainly and early.
3. On what basis? The evidence, with sources graded.
4. How confident, and why? Using published bands, not invented percentages.
5. What would change this? The indicator that would falsify the assessment.
6. So what? The decision this enables — and the decision it does not.

Question five is the one most often missing and the one that most reliably separates analysis from advocacy. An assessment that cannot name what would refute it has not been reasoned to; it has been arrived at.

The measurement problem

Finally, the question that ought to be asked of any CTI function and rarely is: how would we know if this were not working?

Counting reports issued, indicators ingested, or feeds subscribed measures activity. A function can score perfectly on all three while changing no decision. Effectiveness measures are harder and fewer, but they exist:

• What proportion of detections in production trace to a specific intelligence product?
• What is the median age of indicators still active in blocking controls?
• How often has an assessment been revisited and revised after the fact?
• How many products stated a falsifier, and how many falsifiers were subsequently observed?

The last one is uncomfortable and therefore useful. A function that never records being wrong is not a function that is never wrong. It is a function that is not checking.

---

สรุปภาษาไทย

Cyber Threat Intelligence (ข่าวกรองภัยคุกคามไซเบอร์) ไม่ใช่ “ฟีดตัวบ่งชี้” อย่างที่ เข้าใจกันทั่วไป แต่คือ ผลผลิตเพื่อสนับสนุนการตัดสินใจ ที่ต้องมีครบสามอย่าง — ผู้ใช้ที่ระบุตัวได้ · คำถามที่ตั้งไว้ก่อนเก็บข้อมูล · ระดับความเชื่อมั่นที่ประกาศชัด สินค้าที่ขายกันในชื่อนี้ส่วนใหญ่ขาดทั้งสามข้อ

ประเด็นหลักของบทความนี้:

• ข้อมูล ≠ สารสนเทศ ≠ ข่าวกรอง — ข่าวกรองคือชั้นที่มี การวินิจฉัย ของมนุษย์อยู่ จึงเป็นชั้นเดียวที่ “ผิดได้” และด้วยเหตุนั้นจึงต้องแนบระดับความเชื่อมั่นเสมอ
• วงรอบข่าวกรองพังที่สามจุด — ไม่เคยเขียน PIR (ความต้องการข่าวกรองลำดับต้น), ประเมินขั้นประมวลผลต่ำเกินไปจนทำลายที่มาของหลักฐาน, และแทบไม่มีการป้อนกลับ
• CTI มีสี่ระดับ — ยุทธศาสตร์ (ผู้บริหาร) · ปฏิบัติการ (ทีม IR/Hunt) · ยุทธวิธี (นักวิเคราะห์ SOC) · เทคนิค (ระบบอัตโนมัติ) ⛔ สับสนสี่ระดับนี้ คือเหตุที่ผู้บริหารได้รับ packet capture ส่วนนักวิเคราะห์ได้รับบทความภูมิรัฐศาสตร์
• Pyramid of Pain — ฟีดเชิงพาณิชย์ส่งมอบชั้นล่างสุด (hash/IP/domain) ซึ่งเป็นชั้นที่ ฝ่ายตรงข้าม เปลี่ยนทิ้งได้โดยแทบไม่เจ็บ จึงเป็นเหตุผลเชิงโครงสร้างว่าทำไม สมัครฟีดเพิ่มแล้วการตรวจจับไม่ดีขึ้น
• Admiralty Code แยกสองแกน — ความน่าเชื่อถือของ แหล่ง (A–F) กับความน่าเชื่อของ เนื้อหา (1–6) ⛔ การยุบสองแกนเป็นคะแนนเดียว ทำลายข้อมูลที่นักวิเคราะห์ต้องใช้ ตัดสินว่าควรหาหลักฐานยืนยันเพิ่มหรือไม่
• “ประเมินไม่ได้” ไม่เท่ากับ “ความเชื่อมั่นต่ำ” — ระบบที่ไม่มีช่องให้พูดว่า เราไม่ได้ดู จะรายงานออกมาว่า เราดูแล้วไม่พบ ซึ่งมีความหมายตรงข้ามกัน นี่คือข้อบกพร่องที่แพงที่สุดและถูกตรวจน้อยที่สุดในการรายงานด้านความมั่นคง
• TLP ต้องติดบนตัวผลผลิต ไม่ใช่ในอีเมลนำส่ง เพราะผลผลิตอยู่นานกว่าอีเมล

คำถามที่ควรถามหน่วยข่าวกรองภัยคุกคามทุกหน่วย และแทบไม่มีใครถาม คือ “ถ้าหน่วยนี้ทำงานไม่ได้ผล เราจะรู้ได้อย่างไร” — การนับจำนวนรายงานหรือจำนวนตัวบ่งชี้ วัดได้แค่ ความพยายาม ไม่ใช่ ผลลัพธ์ หน่วยที่ไม่เคยบันทึกว่าตัวเองเคยประเมินผิด ไม่ใช่หน่วยที่ไม่เคยผิด — แต่เป็นหน่วยที่ไม่ได้ตรวจสอบตัวเอง

อภิธานศัพท์

English	ไทย
Threat Intelligence	ข่าวกรองภัยคุกคาม
Priority Intelligence Requirement (PIR)	ความต้องการข่าวกรองลำดับต้น
Indicator of Compromise (IOC)	ตัวบ่งชี้การถูกบุกรุก
Tactics, Techniques, Procedures (TTP)	ยุทธวิธี เทคนิค และกระบวนการปฏิบัติ
Source reliability	ความน่าเชื่อถือของแหล่งข่าว
Information credibility	ความน่าเชื่อของเนื้อหาข่าว
Confidence assessment	การประเมินระดับความเชื่อมั่น
Attribution	การระบุผู้กระทำ
Collection	การรวบรวมข่าวสาร
Dissemination	การแจกจ่ายข่าวกรอง
Traffic Light Protocol (TLP)	มาตรฐานการควบคุมการเผยแพร่

---

References. MITRE ATT&CK; David Bianco, The Pyramid of Pain (2013); NATO STANAG 2511 (Admiralty Code); US ODNI Intelligence Community Directive 203, Analytic Standards; FIRST Traffic Light Protocol 2.0; OASIS STIX/TAXII 2.1.