Consumers, Decisions, and Levels of Intelligence

Start with the consumer and the decision

Intelligence exists to help someone decide. That person or team is the consumer. Consumers are not passive readers: they own choices, constraints, and consequences. The analyst’s job is to understand those conditions well enough to reduce relevant uncertainty.

A request such as “tell me about ransomware” names a topic, not a decision. Useful scoping begins with conversation:

Who needs the answer?
What choice will they make with it?
When must that choice be made?
Which assets, processes, regions, or partners are in scope?
What does the consumer already know?
What level of uncertainty can the decision tolerate?
Which actions are realistically available?

Different consumers can use the same evidence differently:

Consumer	Example decision	Useful intelligence
Board or executive leadership	Whether to change risk appetite or fund a multiyear capability	Business exposure, plausible scenarios, consequences, options, and uncertainty
Security leadership	Which threats and capabilities to prioritize this planning cycle	Threat relevance, control gaps, likely pathways, and resource trade-offs
Incident commander	Whether to contain systems, expand scope, or notify stakeholders	Current activity, affected assets, plausible intent, confidence, and near-term indicators
Detection engineer	Which behaviors to monitor and which telemetry is required	Observable behaviors, data sources, analytic logic, limitations, and test cases
Vulnerability team	Which exposures require accelerated treatment	Evidence of exploitation, asset criticality, exposure conditions, and compensating controls
Fraud, legal, privacy, or communications teams	Which obligations or harms may arise	A carefully bounded account of what happened, whose data or processes may be affected, and what remains unknown

The consumer determines the decision context, not the truth of the analysis. Analysts must remain objective even when a stakeholder prefers a particular conclusion. Good partnership means understanding the consumer’s needs while preserving analytic independence.

Intelligence requirements are shared agreements

A requirement should make the relationship explicit:

For [consumer] to decide [choice] by [time], assess [question] within [scope].

For example:

For the incident commander to decide within two hours whether to isolate the finance segment, assess whether the observed email and network activity represents a coordinated intrusion and identify which systems show related behavior.

This formulation does not promise certainty. It defines what uncertainty matters, to whom, and by when. Later lessons turn such statements into formal requirements and collection plans.

Analyst habit: Do not infer the consumer only from a job title. Two chief information security officers may have different authorities, risk tolerances, and immediate choices. Ask about the actual decision.

Intelligence fits only when consumer, choice, and deadline align — Audience, decision, timing, assets, prior knowledge, and acceptable uncertainty define the product before analysis begins.

Strategic, operational, and tactical perspectives

CTI is often described as strategic, operational, or tactical. These labels are useful when they describe the decision being served. They become misleading when treated as rigid boxes or as a ranking of importance.

Perspective	Typical question	Time horizon	Common consumers	Suitable detail
Strategic	How might the threat environment affect objectives and risk?	Months to years	Executives, boards, risk owners, security leaders	Trends, scenarios, business impact, choices, assumptions
Operational	How is a campaign or intrusion unfolding, and what may happen next?	Hours to months	Security operations, incident leaders, threat hunters, fraud or resilience teams	Activity patterns, intent, sequencing, affected assets, opportunities to intervene
Tactical	What observable behavior should defenders detect, block, or investigate now?	Seconds to weeks	Analysts, responders, detection and platform engineers	Behaviors, artifacts, telemetry, queries, thresholds, limitations

Some practitioners also use technical intelligence for highly detailed knowledge about malware, infrastructure, vulnerabilities, protocols, or detection logic. Treat it as a description of content, not a separate layer that automatically has intelligence value. Technical detail becomes intelligence when interpreted for a decision.

One incident across three perspectives

Return to Northbridge Services:

Tactical: Several finance systems launched the same unusual child process after opening archive attachments. Defenders need a tested behavioral query and a list of affected hosts.
Operational: The events likely represent a coordinated intrusion attempt against payment staff. The incident commander needs to know probable scope, likely next actions, and containment opportunities.
Strategic: The recurring targeting of payment workflows suggests material exposure to business-email and credential-enabled fraud. Leadership needs to decide whether to redesign approval processes and invest in identity controls.

These are not three unrelated products. Tactical observations can reveal an operational pattern; operational learning can expose a strategic risk. Strategic priorities, in turn, determine which operational questions and tactical telemetry deserve attention.

Avoid two common mistakes

Equating tactical with low value. A precise, timely detection can prevent immediate harm. Value depends on the decision, not the altitude.
Calling vague prediction strategic. A long time horizon does not excuse weak evidence. Strategic assessments should still state assumptions, alternatives, confidence, and implications.

Choose the product by need

Before writing, map four variables:

Variable	Prompt
Consumer	Who owns the decision?
Decision	What choice is available?
Time	When must the answer arrive, and how long will it remain useful?
Detail	Which evidence and explanation allow this consumer to act without overload?

A single product may serve several consumers, but this should be deliberate. Put the key judgment and implications first, then provide layers of supporting detail. Do not force executives through raw artifacts or deprive technical teams of the evidence they need to verify and act.

Analyst check: If you removed every threat-group name and vendor label, would the product still explain the relevant behavior, exposure, and decision? If not, it may be relying on labels instead of analysis.

Key takeaways

Begin with a real consumer and a real decision.
Strategic, operational, and tactical describe connected perspectives, not organizational rank.
The same evidence may support different products because different consumers face different choices.
Timeliness, scope, and usable detail are part of analytic quality.

The same incident changes meaning at three altitudes — Tactical CTI serves immediate controls, operational CTI supports campaign and incident choices, and strategic CTI informs long-horizon risk decisions.

Consumers, Decisions, and Levels of Intelligence

In this lesson, you will learn to: