What is Intelligence?
Learn the core definition of intelligence in a cyber context.
In this lesson, you will learn to:
- Understand the progression from data to intelligence.
What is Intelligence?
A foundational lesson explaining the concepts of data, information, and intelligence.
Data vs. Information vs. Intelligence
Many people - even seasoned IT professionals - use the words “data,” “information,” and “intelligence” interchangeably. But in the world of Cyber Threat Intelligence, treating these concepts as the same thing is a critical mistake. Let’s break them down.
Data is the lowest level of abstraction. It consists of raw, unfiltered facts and numbers. Imagine staring at a live feed of your firewall logs: thousands of IP addresses, timestamps, and port numbers scrolling by every second. That is data. It is voluminous, noisy, and on its own, it tells you almost nothing about whether you are under attack.
Information is what happens when you give data some context. If you take that massive firewall log and filter it to only show IP addresses that have attempted to log into your admin portal more than 50 times in the last minute, you have created information. It has shape and structure, but it still lacks the ‘why’ and ‘so what’.
Intelligence is the final, most valuable stage. It is information that has been rigorously analyzed to uncover meaning, context, and intent, allowing you to make a decision. If an analyst looks at that information (the repeated login attempts) and correlates those IP addresses with a known Russian cybercrime group preparing for a ransomware deployment, that is intelligence. It tells you who is attacking, why they are doing it, and crucially, gives you the insight needed to stop them before it’s too late.