FREE COURSE / SELF-PACED LEARNING

Cyber Threat Intelligence Foundations: From Evidence to Decision

Learn to turn intelligence requirements, source evidence and uncertainty into defensible CTI judgments in this free course.

Read the first lesson Explore the curriculum

Read freely. Create an account to save your completed lessons.

Experience level
Beginner
Curriculum
6 modules · 12 lessons
Estimated reading
3 hr 10 min
Language
English

Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.

KNOW WHAT YOU’RE WORKING TOWARD

What you’ll learn

  • Explain how cyber threat intelligence differs from raw data, information, security reporting, and unsupported opinion.
  • Translate stakeholder decisions into clear, prioritized intelligence requirements and an ethical collection plan.
  • Evaluate source reliability, information credibility, relevance, timeliness, bias, and corroboration before drawing conclusions.
  • Apply structured analytical techniques and behavior-centered models to develop, challenge, and compare hypotheses.
  • Write concise intelligence assessments that separate evidence, assumptions, judgments, confidence, implications, and recommended decisions.
  • Plan responsible dissemination, feedback, and measurement so intelligence improves security decisions without exposing sensitive information.

Is this the right course for you?

Who it’s for

Learners ready to develop a structured cyber threat intelligence method.

Scope and boundaries

Evidence-to-decision foundations. Operational and strategic follow-on courses address different decision horizons and deliverables.

How you’ll learn

Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.

Before you begin

  • Basic cybersecurity literacy — You should recognize common concepts such as assets, vulnerabilities, controls, logs, incidents, networks, and identity. No prior intelligence-analysis experience or specific product knowledge is required.

About this course

A practical, vendor-neutral introduction to cyber threat intelligence (CTI) for aspiring analysts, defenders, security leaders, and adjacent professionals. Students learn how to define intelligence requirements, distinguish data from intelligence, evaluate sources and evidence, reason under uncertainty, model adversary behavior, produce clear assessments, and share intelligence responsibly. The course emphasizes transferable analytical habits, transparent judgment, and outcomes that help real people make better security decisions.

FOLLOW THE LEARNING PATH

Course curriculum

MODULE 1

1. Intelligence That Serves a Decision

Establish the purpose and boundaries of CTI. Learners distinguish evidence, information, and intelligence; identify the people CTI serves; and connect intelligence work to risk and security decisions.

  1. What Cyber Threat Intelligence Is—and Is NotBuild a precise mental model of CTI by separating observations, data, information, evidence, judgments, and decision-relevant intelligence.8 min reading
  2. Consumers, Decisions, and Levels of IntelligenceUnderstand who uses CTI, which decisions it supports, and how strategic, operational, and tactical perspectives connect.7 min reading

MODULE 2

2. Requirements and the Intelligence Workflow

Turn stakeholder needs into answerable intelligence requirements and manage a feedback-driven workflow that prioritizes effort, exposes gaps, and adapts as decisions change.

  1. From Stakeholder Need to Intelligence RequirementConvert vague security concerns into prioritized, answerable requirements tied to a decision, scope, and time horizon.7 min reading
  2. The Intelligence Workflow as a Learning LoopUse direction, collection, processing, analysis, dissemination, and feedback as an adaptive workflow rather than a rigid conveyor belt.6 min reading

MODULE 3

3. Collection, Sources, and Evidence

Build lawful, ethical collection plans; handle observables in context; evaluate source reliability and information credibility; and preserve provenance so conclusions can be reviewed.

  1. Collection Planning and ProvenanceSelect proportionate sources, document where evidence came from, and preserve the context required for later verification and lawful use.16 min reading
  2. Evaluating Sources, Evidence, and IndicatorsJudge source reliability and information credibility, distinguish observables from indicators, and avoid treating context-free artifacts as conclusions.17 min reading

MODULE 4

4. Structured Analysis of Adversary Behavior

Develop and challenge hypotheses, reason explicitly under uncertainty, recognize common cognitive traps, and use behavior-centered models to organize what is known without forcing the evidence.

  1. Reasoning Under UncertaintyRecognize assumptions and cognitive bias, use estimative language consistently, and make confidence judgments that reflect evidence quality and analytic agreement.20 min reading
  2. Behavior Models and Competing HypothesesOrganize adversary activity with behavior-centered models and compare alternative explanations against evidence to reduce premature conclusions.21 min reading

MODULE 5

5. Intelligence Writing and Briefing

Create assessments for technical and executive audiences by separating fact from judgment, expressing confidence and alternatives, explaining implications, and designing clear visual and verbal communication.

  1. Writing Defensible Intelligence AssessmentsWrite bottom-line-up-front assessments that distinguish sourced facts, assumptions, analytic judgments, confidence, alternatives, and implications.22 min reading
  2. Briefing and Visualizing for UnderstandingAdapt intelligence to technical and executive audiences, choose honest visual forms, and brief in a way that supports questions and decisions.21 min reading

MODULE 6

6. Dissemination, Action, and Improvement

Deliver intelligence to the right people with appropriate handling, translate findings into defensive action, gather feedback, and measure whether CTI changes decisions and reduces uncertainty.

  1. Responsible Sharing and Information HandlingBalance utility with privacy, sensitivity, legal authority, and partner trust when deciding what to share, with whom, and under which conditions.20 min reading
  2. From Intelligence to Action and Measurable ImprovementTranslate assessments into defensive choices, build feedback into operations, and measure CTI through outcomes, learning, and decision quality.25 min reading

BUILD ON THE RIGHT FOUNDATION

These courses address different scopes. Choose the foundation or follow-on that fits your next question.

Sources and editorial review

Reviewed by Threat Intelligence Lab

Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.