Cyber Threat Intelligence Foundations: From Evidence to Decision
Learn to turn cyber evidence into defensible, decision-relevant intelligence through requirements, collection, structure...
12 lessons · 8 hr 15 minCourse
Cyber Intelligence Foundations
About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.
Difficulty
Beginner
Modules
6
Lessons
16
Time
8 hr 50 min
Language
en
Created by
Threat Intelligence Lab
Updated
11 September 2026
About this course
Cyber Intelligence Foundations is a step-by-step course for learners who want to understand how useful security intelligence is made. You will move from vague threat awareness to clearly framed intelligence questions, lawful evidence collection, source evaluation, structured analysis, and concise reporting for real decision-makers.
The course uses a fictional organization and realistic defensive scenarios so you can practice without needing privileged systems or sensitive data. Each lesson adds one capability to the previous lesson. By the end, you will produce a short intelligence assessment that states what is known, what is uncertain, why it matters, and what a defender should do next.
What you'll learn
- ✓ Explain how data, information, intelligence, and decisions differ in a defensive security workflow.
- ✓ Turn a stakeholder concern into a specific intelligence requirement with a decision, audience, and timeframe.
- ✓ Collect and evaluate public evidence while recording provenance, limitations, and confidence.
- ✓ Analyze adversary behavior, infrastructure, and indicators without overstating attribution or certainty.
- ✓ Produce a concise intelligence assessment that separates observations, judgments, implications, and recommended actions.
Before you begin
You will get more from this course if these foundations are already familiar.
- Basic security vocabulary — You should be comfortable with terms such as asset, vulnerability, authentication, malware, log, and incident. No programming or prior intelligence experience is required.
Course content
Module 1: Module 1: Start With the Decision
Learn what intelligence is, who uses it, and how to frame a useful requirement before collecting information.
Module 2: Module 2: Build an Evidence Base
Learn how to collect lawful public information, evaluate sources, and organize evidence so another analyst can reproduce your reasoning.
Module 3: Module 3: Analyze, Report, and Improve
Apply structured reasoning to adversary behavior and indicators, then communicate a concise assessment with actionable next steps.
Describe Adversary Behavior Without Overclaiming
Use behavior, capability, and context to explain threats without treating attribution as certainty.
Indicators of Compromise and Their Types
Learn what an IoC is, how common IoC types differ, and why context determines whether an indicator is useful.
Use Indicators With Context
Understand what domains, IPs, hashes, and patterns can tell you, and what they cannot prove alone.
Write and Review a Decision-Ready Assessment
Assemble evidence into a concise report that states the judgment, confidence, implications, and next actions.
Module 4: Module 4: Turn Intelligence Into Better Defense
Move from a finished assessment to a bounded defensive workflow, measurable outcomes, and a maintenance plan that keeps intelligence useful after publication.
Build a Bounded Defensive Hunt
Turn an intelligence judgment into a testable hunt hypothesis with known telemetry, limits, and an escalation path.
Keep Intelligence Useful Over Time
Add freshness, ownership, feedback, and review triggers so intelligence does not become stale background noise.
Module 5: Module 5: Apply Intelligence to Common Security Problems
Apply the foundation workflow to vulnerability exposure, identity-driven social engineering, and malware or ransomware activity without losing evidence discipline.
Build Vulnerability Intelligence That Prioritizes Action
Combine vulnerability facts, exposure, exploitation evidence, and business impact to support a defensible remediation priority.
Analyze Identity and Social-Engineering Threats
Investigate phishing and account abuse as behavior chains rather than isolated messages or login events.
Analyze Malware and Ransomware Activity
Describe malware behavior, delivery, impact, and defensive relevance without treating a family label as the whole assessment.
Module 6: Module 6: Operate Intelligence as a Capability
Build the habits that make an intelligence function dependable: stakeholder alignment, information governance, structured sharing, and safe automation.
Work With Stakeholders and Decision-Makers
Build trust by translating stakeholder concerns into useful requirements and communicating intelligence at the right level of detail.
Govern Intelligence and Handle Information Responsibly
Apply classification, access, retention, provenance, and privacy principles to intelligence work.
Share Structured Intelligence and Automate Safely
Use structured formats and automation to scale intelligence while preserving context, validation, and human accountability.