Cyber Threat Intelligence (CTI)
1. Overview
Cyber Threat Intelligence (CTI) refers to a body of knowledge produced by collecting, processing, and analyzing data about the threat actors targeting an organization — their motives, capabilities, tools, and behaviors (TTPs) — and turning it into context and insight that can be put to practical use in defensive decision-making.
Traditional security stayed at passive, reactive defense that blocked traces of already-known threats, like firewalls, antivirus, and IDS. Attackers, however, use automated tooling to churn out hundreds of thousands of variants per day, and Advanced Persistent Threats (APTs) burrow into the interior stealthily over months. When defenders merely chase raw Indicators of Compromise (IoC), detection collapses the moment the attacker changes a hash, IP, or domain. Here the wisdom of Sun Tzu — "know the enemy to stop the enemy" — applies to the cyber domain. CTI moves beyond "what was attacked" to let an organization understand proactively "who is targeting us, why, and how," helping it allocate limited security resources to the most dangerous threats first.
Three structural shifts drove CTI's rise. First, the industrialization of attacks. Ransomware has been divided into labor as RaaS (Ransomware-as-a-Service), and on the dark web, initial access rights are traded. Second, the explosion of the attack surface. As the perimeter blurs across cloud, SaaS, supply chains, and IoT, defenders can no longer protect every asset uniformly. Third, data overload. A SIEM accumulates billions of logs a day, but context-free alerts only exhaust analysts. CTI acts as a filter that sifts this noise down to "threats that are actually meaningful to our organization."
CTI's core characteristic is being Actionable. Unlike mere threat data or information, intelligence must lead to concrete action guidance — for example, "this APT group is exploiting a specific vulnerability against our industry, so apply the patch immediately and deploy the related detection rules." The further one goes from data → information → intelligence, the higher the degree of processing and decision-making value, and this is the essence that distinguishes CTI from a simple threat feed subscription.
To see the difference among these three stages concretely: data is a context-free raw observation such as "10,000 connection attempts from 203.0.113.5." Adding the fact "this IP is a known ransomware C2 server" makes it information. Only when the judgment and recommendation "this C2 is operated by a group intensively attacking our industry, a similar campaign is under way, so block the range immediately and hunt for internal lateral-movement traces" is attached does it finally become intelligence. In short, a CTI deliverable must answer not "what is visible" but "so what should we do about it (So What)."
2. Types of CTI and Data Tiers
CTI is divided into four tiers — strategic, operational, tactical, and technical — according to who consumes it and for what purpose; the lower you go the more concrete and short-term it is, and the higher you go the more abstract and long-term.
flowchart TD
S["Strategic CTI: for executives - threat landscape/trends/risk(long term)"] --> O["Operational CTI: for security managers - campaigns/adversary intent(mid term)"]
O --> TA["Tactical CTI: for analysts - TTP/attack behavior patterns(short term)"]
TA --> TE["Technical CTI: for systems - IoC/signatures(immediate)"]
TE -.feedback/context.-> TA
TA -.feedback/context.-> O
O -.feedback/context.-> S
Strategic CTI is high-level information consumed by executives and the CISO, covering the impact of geopolitical tension on cyberattacks, threat trends targeting a specific industry, and regulatory changes. Delivered as reports and briefings, it grounds decisions on security investment, organizational strategy, and risk-acceptance levels. For instance, an analysis that "supply-chain attacks by a group linked to a specific nation and aimed at the financial sector are trending upward" leads directly to the board's judgment to increase the supply-chain security budget. Strategic CTI has the characteristic that it must be translated into the language of business risk rather than technical jargon to reach decision-makers.
Operational CTI is information about the intent, capability, and timing of a specific attack campaign or threat actor. It addresses "which group will target which organization, using which vulnerability, and when," and is used by threat-hunting and incident-response teams to build proactive defense plans. With high collection difficulty — dark-web monitoring, attacker-forum analysis — it requires specialized personnel.
Tactical CTI focuses on the attacker's TTPs (Tactics, Techniques, and Procedures). Often expressed with MITRE ATT&CK technique identifiers (T####), it is used directly by security analysts when writing detection rules or forming threat-hunting hypotheses. Being behavior-based information that is harder to change than IoC, it offers greater defensive durability.
Technical CTI is the most concrete and shortest-lived Indicators of Compromise (IoC) — malicious IPs, domains, file hashes, URLs. Automatically fed into SIEM, firewalls, and EDR, it is used for immediate blocking and detection. However, because attackers swap it out easily, it is limited in effect on its own and reaches its maximum value when combined with higher-tier intelligence.
| Tier | Consumer | Content | Lifespan | Example |
|---|---|---|---|---|
| Strategic | Executives/CISO | Threat trends/risk | Months–years | Industry threat report |
| Operational | Security manager | Campaigns/adversary intent | Weeks–months | APT campaign analysis |
| Tactical | Security analyst | TTP/attack patterns | Weeks–months | ATT&CK technique mapping |
| Technical | Security systems | IoC/signatures | Hours–days | Malicious IP/hash |
The four tiers are not independent but feed back into one another. As patterns in technical indicators accumulate, tactical TTPs emerge; as TTPs gather, they are attributed to a specific campaign or actor (operational); and as this accumulates, it becomes an industry-wide threat trend (strategic). Conversely, strategic judgment determines which TTPs and indicators to collect first (PIR). A mature CTI organization therefore does not stay in one tier but focuses on designing the connections between tiers.
3. The Intelligence Cycle and the Sharing Ecosystem
CTI is not one-off data collection but follows an intelligence cycle that starts from defining requirements and loops back through feedback. It applies the traditional intelligence-cycle model of U.S. intelligence agencies to the cyber domain and consists of six stages.
flowchart LR
subgraph CYCLE["Intelligence Cycle"]
direction LR
P1["1.Direction/planning(define PIR)"] --> P2["2.Collection(OSINT/dark web/feeds)"]
P2 --> P3["3.Processing/normalization(dedup/standardize)"]
P3 --> P4["4.Analysis(correlate/contextualize)"]
P4 --> P5["5.Dissemination(reports/feeds/API)"]
P5 --> P6["6.Feedback(effectiveness review)"]
P6 -.improve.-> P1
end
EXT["external sources: ISAC/commercial feeds/CERT"] --> P2
P5 --> SIEM["SIEM/SOAR/EDR integration"]
The intelligence cycle is not a straight line that runs once and ends, but a spiral improvement process in which feedback leads into the next round of planning. Because each cycle reviews the hit rate of the PIR and the effectiveness of the intelligence and adjusts collection sources and analysis techniques, an organization's CTI capability becomes more refined with each iteration.
In the Direction stage, the organization defines the PIR (Priority Intelligence Requirements) — what it needs to know. If this stage is weak, every subsequent activity loses direction, so the key is to clarify "what is the most important question in our industry, assets, and threat model." Collection gathers raw data from diverse sources such as OSINT (open-source intelligence), commercial threat feeds, the dark web, honeypots, and ISAC/CERT shared information. The source's reliability and timeliness drive quality.
Collection sources split into several strands by nature. OSINT is public information such as security blogs, CVE databases, and social media — low cost but noisy. Commercial feeds are high-quality intelligence curated by vendors — timely but expensive. Community sharing (ISAC/CERT/MISP) exchanges battle-tested indicators within the same industry, so relevance is high. Dark web and HUMINT are high-difficulty sources that capture leaked credentials or initial-access deals in attacker forums and markets. Finally, internal telemetry — your own SIEM/EDR/honeypot logs — is the most contextually accurate source, and when combined with external intelligence it best explains "what actually happened to us." The more mature an organization, the less it relies on a single source and the more it cross-validates these.
Processing normalizes, deduplicates, translates, and structures the heterogeneous collected data; since this is impossible by hand, a TIP (Threat Intelligence Platform) automates it. Analysis converts the processed information into actionable intelligence by correlating and contextualizing it against the organization's context. Analysis frameworks such as the Diamond Model (adversary, capability, infrastructure, victim) or ATT&CK mapping are used at this stage. Dissemination delivers it in a form suited to the consumer (an executive report, an analyst's ATT&CK matrix, a system's IoC feed), and in the final Feedback stage, "did the intelligence provided actually contribute to defense" is evaluated to improve the next cycle's PIR.
CTI's value is multiplied by sharing and standardization, because an attack suffered by one organization becomes a preventive asset for another. The machine-readable standards for this are STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information). STIX is a data model that expresses threat information as objects (indicators, attack patterns, threat actors, campaigns, etc.) and relationships, while TAXII is the transport protocol that exchanges that STIX data securely. When sharing, the TLP (Traffic Light Protocol) — RED/AMBER/GREEN/CLEAR — is also used to mark the handling level by sensitivity. TLP:RED means only the specific individual who received it, AMBER within the member organization, GREEN with the community, and CLEAR without restriction; this simple color signal serves as the trust-based convention of the sharing ecosystem that prevents misuse of sensitive information. Arbitrarily relaxing the level and re-sharing breaks trust and ultimately makes the whole community reluctant to provide information, so strict adherence is a premise. The open-source MISP is widely used as a representative sharing platform, and domestically, sector-specific ISACs for finance, telecom, and so on, together with KISA's C-TAS, serve as hubs for sharing threat information.
4. CTI Analysis Frameworks
Turning collected and processed information into actionable intelligence requires a structured analysis model. Because relying solely on an individual analyst's intuition introduces bias and omissions, the community has established several standard frameworks. The most widely used is the Diamond Model of Intrusion Analysis, which decomposes every intrusion event into the four vertices Adversary, Capability, Infrastructure, and Victim and their relationships.
flowchart TD
A["Adversary: who, why"] --- C["Capability: which tool/malware"]
A --- I["Infrastructure: C2/domain/IP"]
V["Victim: target org/asset"] --- C
V --- I
A -.target.-> V
C -.use.-> I
The Diamond Model's strength lies in Pivoting across axes, because a fact learned at one vertex lets you trace another. For example, analyzing a malware sample (capability) finds a C2 domain (infrastructure), the domain's registration details identify the attack group (adversary), and the group's past targets (victims) reveal commonalities with your own organization. This weaves fragmentary indicators into a single attack narrative, elevating them into operational and tactical intelligence.
That said, while the Diamond Model is useful for Attribution of an event, one must be cautious about pinning down the adversary. Attackers deliberately mimic the tools and infrastructure of other groups to induce misattribution (False Flag). CTI analysis therefore does not conclude from a single indicator but states the Confidence Level of multiple pieces of evidence, as a principle describing conclusions in probabilistic language, such as "associated with a specific group at medium confidence."
Where the Diamond Model looks at "what is connected to what and how," the Cyber Kill Chain looks at the attack's temporal flow (reconnaissance → weaponization → delivery → exploitation → installation → C2 → actions on objectives), and MITRE ATT&CK systematizes the concrete techniques (How) inside each stage. A mature CTI organization uses the three models complementarily — pinpointing attack stages with the kill chain, mapping each stage's TTPs with ATT&CK, and tracing links between events with the Diamond Model. Only intelligence organized with such a common framework can be compared and shared across organizations.
5. Comparison with Similar Concepts and Application Cases
In practice CTI is often confused with a threat data feed, but the two differ. A threat feed is closer to an unprocessed list of IoCs (data), whereas CTI is the result of adding to that data the analysis and context of "what does this mean for our organization." Subscribing to feeds en masse in bulk only causes Alert Fatigue, where false positives, duplicates, and irrelevant indicators exhaust analysts instead. The essence of the difference lies not in "the amount of data" but in "the contribution to decision-making."
CTI's relationship with MITRE ATT&CK also matters. If ATT&CK is the common language (dictionary) that systematizes attack behavior, CTI uses that language to describe "who is using this technique right now." From the perspective of David Bianco's Pyramid of Pain, technical CTI (hashes, IPs) is easy for attackers to change and so offers little defensive effect, while tactical CTI (TTPs) forces a large redesign cost on attackers and so offers great defensive effect. The more mature an organization, therefore, the more it shifts weight from IoC-centric to TTP-centric CTI.
As a concrete case, when the Log4Shell (CVE-2021-44228, 2021) vulnerability was disclosed, CTI was decisive. Within hours of the announcement attackers began mass scanning, and the CTI community shared exploit payload patterns, scanning IPs, and exploitation TTPs in real time. Organizations subscribed to this were able to respond proactively with automatically deployed detection rules. By contrast, the SolarWinds supply-chain attack (2020) also shows CTI's limits. A sophisticated APT exploited a trusted update channel to evade detection for months, and only through post-incident analysis were the TTPs organized and then converted into a defensive asset against similar future attacks. Likewise, operational CTI analyzing the RaaS ecosystem of a ransomware group such as LockBit reveals which initial access vectors (e.g., exposed RDP, unpatched VPN) are mainly exploited, contributing directly to setting defensive priorities.
The fact that the threat landscape differs by industry also shows CTI's value. The financial sector is exposed to organized groups seeking monetary theft and to supply-chain intrusion; manufacturing and energy to availability and safety attacks aimed at industrial control systems (ICS); and public institutions relatively more to intelligence gathering by state-backed APTs. Even for the same vulnerability, response priority changes depending on "whether a group actually targeting our industry is exploiting it," so industry-tailored (operational) CTI yields far higher value than a uniform feed. This is why sector-specific ISACs become the core unit of CTI sharing.
| Category | Threat data feed | CTI (intelligence) |
|---|---|---|
| Essence | Raw IoC list | Knowledge with analysis/context added |
| Focus | Amount of data | Contribution to decisions |
| Consumption | Automatic blocking | Human judgment/system integration |
| Lifespan | Short (IoC) | Varies by tier |
In the domestic context, too, CTI sharing is being institutionalized. C-TAS (Cyber Threat Analysis & Sharing system), operated by KISA, is a hub where private and public institutions mutually share indicators of compromise and analysis results, and sector-specific sharing systems such as the Financial Security Institute and the telecom ISAC operate alongside it. As supply-chain and web-shell attacks aimed at the public and financial sectors occurred in succession around 2023, cases are accumulating in which one institution's detection information propagated across all sectors within hours via C-TAS and proactively blocked the same kind of attack. This is a concrete example demonstrating the value of CTI sharing, where "one organization's damage becomes the community's immunity."
6. Deep Dive — Recent Trends and Automation
The CTI field is evolving rapidly around automation and AI. First, CTI–SOAR integration automation is becoming the standard. When a TIP delivers STIX indicators it has collected and normalized to a SOAR via TAXII, the SOAR automatically performs firewall blocking, EDR isolation, and ticket creation according to playbooks. Humans concentrate on high-level judgment while machines handle repetitive response. Second, the use of generative AI. LLMs summarize vast threat reports and dark-web posts, automatically extract ATT&CK techniques and IoCs from unstructured reports, and a "CTI copilot" that answers analysts' natural-language queries has emerged. However, because of hallucination and false-positive risk, Human-in-the-loop review is essential.
The automation effect is clear in actual figures, too. In industry incident-response statistics, the attacker's average dwell time has shortened from the order of months a few years ago to recently the order of days to a couple of weeks, interpreted as the combined result of CTI-based detection/response automation and the spread of XDR and threat hunting. Conversely, the later detection comes, the more the damage cost grows exponentially, so "how quickly you know" directly translates into cost savings.
Third, combination with CTEM (Continuous Threat Exposure Management) is rising. When CTI tells you "what external threats are targeting," CTEM links this to the organization's actual exposure surface and vulnerabilities to prioritize "threats actually exploitable against us." Fourth, the importance of supply-chain and third-party threat intelligence and dark-web monitoring is growing. Detecting leaked credentials and initial-access deals early to respond proactively before a breach has become a core practical task. Fifth, discussion of privacy-preserving sharing (anonymization, strict TLP application) is also advancing, to prevent exposure of personal data and trade secrets in threat-information sharing while maintaining usefulness.
Sixth, the virtuous cycle with Threat Hunting is strengthening. Based on TTP hypotheses provided by tactical CTI, analysts actively search internal logs, and the new indicators and behaviors discovered in the process are fed back into CTI. This combines "intelligence received from outside" with "intelligence produced inside" to accumulate the organization's own threat knowledge, and it becomes an indicator of maturity that gradually lowers dependence on external feeds.
7. Considerations and Implications
When adopting and operating CTI from the perspective of a professional engineer, the following must be considered in a balanced way.
First, a maturity-based phased adoption strategy is needed. If an organization of low maturity subscribes in bulk to expensive commercial feeds first, it falls into alert fatigue and operational overload. It is realistic to advance gradually in step with organizational capability, in the order of clear PIR definition → use of free OSINT and ISAC sharing → internalization of tactical CTI (TTPs) → operational and strategic expansion.
Second, the trade-off between quality and cost must be managed. A feed's timeliness, accuracy, and relevance (fit with our industry and assets) are the core quality indicators, and a low-reliability feed instead undermines defense through false positives. Cross-validate multiple sources (confidence scoring), while managing ROI by jointly evaluating source cost and the total cost of ownership (TCO) including analyst labor.
Third, the integration of process, people, and technology decides success or failure. CTI is not completed by the TIP tool alone; it must be backed by governance and skilled analysts who define the PIR and consume and feed back the intelligence. Value is realized only when the integration architecture with SIEM, SOAR, EDR, and vulnerability management, together with analyst capability development, proceed in parallel. Whether to maintain an in-house CTI team or outsource to a managed security service (MDR/MSSP) depends on organization size, maturity, and budget; most converge on a hybrid model where core PIR definition and decision-making stay internal while collection and first-pass analysis leverage external specialist capacity.
Fourth, legal, ethical, and sharing governance must not be overlooked. Dark-web collection can cross legal boundaries, and violating TLP when sharing threat information can leak sensitive information. An attitude of wanting only to receive benefits without participating in the sharing ecosystem (give and take) lowers the CTI quality of the whole community, so the principle of mutual contribution and an internal sharing policy must be clearly established.
Fifth, measurable effectiveness management (Metrics) is needed. Whether a CTI program actually contributed to defense must be evaluated quantitatively in the feedback stage to enable continuous improvement and budget justification. Representative indicators include the number of detection rules generated and deployed based on CTI, the proportion of incidents for which CTI provided an advance alert, the reduction in mean time to detect/respond (MTTD/MTTR), and the reduction in false-positive rate. Value is not proved by the mere fact of "subscribing to many feeds" without metrics, and fulfillment against the PIR must be re-evaluated periodically.
Sixth, in the long run CTI must be organically combined with zero trust, CTEM, and supply-chain security. When it establishes itself not as a standalone function but as the common language and the brain of proactive defense that links threat intelligence–detection–response–validation, intelligence-driven defense that concentrates limited security resources on the most dangerous threats is completed.
Finally, the point to emphasize from a professional-engineer perspective is that the success of CTI adoption depends not on expensive tools or feed subscriptions but on the organization's culture of consuming information. No matter how good the intelligence, if it is not reflected in decisions it is merely shelved as a report. Only when a tier-by-tier consumption routine — executives consuming strategic CTI in the language of risk, analysts forming hunting hypotheses with tactical CTI, and systems responding automatically with technical CTI — is internalized in the organization does CTI finally prove its value against the investment.
References
- MITRE ATT&CK — https://attack.mitre.org/
- OASIS STIX/TAXII — https://oasis-open.github.io/cti-documentation/
- MISP Threat Sharing — https://www.misp-project.org/
- FIRST, "Traffic Light Protocol (TLP)" — https://www.first.org/tlp/
- Gartner, "Continuous Threat Exposure Management (CTEM)" — https://www.gartner.com/
In one line: CTI is data about threat actors' motives, capabilities, and TTPs processed through the intelligence cycle into actionable knowledge, consumed across strategic, operational, tactical, and technical tiers and shared via STIX/TAXII and MISP; evolving from IoC-centric to TTP-centric, it serves as the brain of proactive, intelligence-driven defense combined with zero trust, CTEM, and SOAR.