What Cyber Threat Intelligence Is—and Is Not

A vocabulary ladder: observation to intelligence

Cyber threat intelligence begins with observations, but it does not end there. An analyst creates intelligence by interpreting evidence in context so that a person can make a better decision.

Use this vocabulary ladder to keep the stages distinct:

Stage	Meaning	Example
Observation	Something noticed or recorded	A server logs a connection to an external domain.
Data	Recorded representations of observations	Timestamp, source host, destination domain, port, and byte count.
Information	Data organized with context	The same domain was contacted by four finance workstations shortly after users opened similar attachments.
Evidence	Information used to support or challenge a proposition	The timing, affected hosts, and attachment telemetry support the proposition that the connections share a cause.
Analytic judgment	A reasoned conclusion that goes beyond directly observed facts	The activity was likely initiated by a coordinated phishing campaign.
Intelligence	A communicated assessment tailored to a decision	An assessment helps the incident lead decide whether to isolate hosts, widen the investigation, or monitor further.

These stages are related, but information does not automatically become intelligence merely because it is collected, enriched, or placed in a report. A list of domains may be useful data. A dashboard may organize information. Neither tells a decision-maker what the activity probably means, why the analyst thinks so, how certain the judgment is, or what decision the assessment supports.

A practical definition for this course is:

Cyber threat intelligence is evidence-based knowledge about cyber threats, produced through analysis and communicated with enough context and uncertainty to support a decision.

This definition has five tests:

Relevant: It answers an expressed or reasonably understood need.
Analytic: It contains reasoned interpretation, not only collected facts.
Evidence-based: Its judgments can be traced to supporting and conflicting information.
Transparent: It distinguishes what is known, assumed, assessed, and still uncertain.
Useful: It reaches a person or system able to make a security decision in time to matter.

A product can be technically correct yet fail as intelligence. For example, a detailed malware report delivered after an incident has closed may be too late for the intended decision. A confident attribution without adequate evidence may be memorable but not defensible. A feed containing thousands of artifacts may create work rather than reduce uncertainty.

Analyst habit: Before collecting more data, complete this sentence: The intelligence will help [named consumer] decide [specific choice] by [relevant time]. If you cannot complete it, the task probably needs clearer direction.

Classify the statement before drawing the conclusion — Observation, data, information, evidence, analytic judgment, and intelligence carry different claims and require different context.

Worked example: one event, different products

Imagine a fictional company, Northbridge Services. At 09:12, its monitoring platform records a finance workstation connecting to sync-example.invalid. The domain is newly registered. A message with an attached archive reached the user six minutes earlier.

The same event can produce several legitimate outputs:

Output	Example	What it does
Alert	“Newly registered domain contacted by finance workstation.”	Brings an observation to an operator’s attention.
Incident note	“User opened an archive before the connection; endpoint review is underway.”	Records known facts and response activity.
Threat report	“Recent campaigns have used archives and newly registered domains.”	Supplies external context about a pattern.
Intelligence assessment	“We assess the workstation was likely affected through the email attachment, with moderate confidence. Isolating it now is proportionate because similar activity could expose payment workflows.”	Interprets evidence for a decision and states uncertainty and implications.

The assessment is not “better” simply because it is longer. It is intelligence because it connects evidence to a live decision. Its reasoning can be inspected:

Observed: email arrival, attachment access, outbound connection, domain age.
Assumed: the recorded times are accurate and the user action preceded the connection.
Judged: a common cause is more likely than unrelated coincidence.
Uncertain: no payload execution or credential use has yet been confirmed.
Decision served: whether to isolate the workstation immediately.

Now suppose the audience changes. The network team may need the destination, time window, affected systems, and a detection query. The finance director may need the plausible business effect, current exposure, confidence, and available choices. The underlying evidence can remain the same while the useful intelligence product changes.

This leads to an important principle: intelligence is defined partly by its relationship to a consumer and decision. There is no universally perfect report. There is only a product that is more or less suitable for a particular need.

What CTI is not

CTI is not synonymous with any of the following:

a commercial feed or platform;
a list of indicators;
vulnerability management;
incident response;
malware analysis;
open-source research;
a claim about who conducted an operation.

Each can contribute to CTI or consume it. For instance, incident response supplies internal evidence; CTI can place that evidence in a broader pattern; the response team can then use the assessment to scope investigation. The practices overlap, but their purposes are not identical.

Boundary check: If a product contains no judgment, it may still be valuable reporting. If it contains judgment but no evidence trail, it is an opinion. If it contains evidence and judgment but serves no identifiable decision, it may be research awaiting direction—not yet finished intelligence.

One email event can produce several valid products — The same event is transformed into a factual record, contextual pattern, evidential claim, and decision-ready assessment without blurring observed, assumed, and judged.

Analyst check: classify before you conclude

Consider these statements about the Northbridge event:

“The destination domain was registered recently.”
“Recently registered domains are always malicious.”
“The connection occurred six minutes after the attachment was opened.”
“The attachment caused the connection.”
“The workstation should be isolated while the cause is investigated.”

Classify each before reading the discussion.

Statement 1 is a factual claim if supported by a registration record and recorded with its lookup time. It is information that may become evidence.
Statement 2 is an unjustified generalization. Domain age can change suspicion, but it does not prove maliciousness.
Statement 3 is a factual claim if the clocks and logs are reliable. It establishes sequence, not causation.
Statement 4 is an analytic judgment. The timing supports it, but alternative causes remain possible.
Statement 5 is a recommended action based on risk tolerance, potential impact, reversibility, and the assessment—not a fact about the threat.

The exercise exposes three distinctions that protect analytical quality:

Distinction	Question to ask
Fact vs. judgment	Could this be directly verified, or does it require inference?
Correlation vs. causation	Do events merely occur together, or is there evidence of a causal mechanism?
Assessment vs. recommendation	What is likely true, and what should the consumer do about it?

Recommendations should follow from intelligence, but analysts must label them clearly. A consumer may agree with the assessment and choose a different action because the consumer owns operational constraints and risk.

A reusable quality check

Before calling a product intelligence, ask:

Consumer: Who will use this?
Decision: What choice or action does it inform?
Evidence: Which observations support and challenge the judgment?
Reasoning: How did we move from evidence to conclusion?
Uncertainty: What do we not know, and how confident are we?
Timeliness: When does the answer stop being useful?
Feedback: How will we learn whether the product helped?

Key takeaways

Data becomes intelligence through analysis, context, communication, and use—not through volume.
Facts, assumptions, judgments, and recommendations play different roles and should be labeled.
A cyber artifact is not inherently an indicator, and an indicator is not inherently intelligence.
CTI is successful when it reduces relevant uncertainty for a decision without pretending uncertainty has disappeared.

Keep the first sentence of this lesson close: useful intelligence is evidence interpreted for a decision. The remaining modules develop each part of that sentence.

What Cyber Threat Intelligence Is—and Is Not

In this lesson, you will learn to: