Cyber Threat Intelligence (CTI) is both a discipline and its output. As a discipline, it follows the intelligence cycle: a structured process of directing collection priorities, gathering data, processing and analysing that data, disseminating finished intelligence, and incorporating feedback. As an output, CTI is the assessed, contextualised product of that cycle: not raw data or unfiltered alerts, but intelligence with stated confidence levels that decision-makers can act on.
CTI strengthens security operations by adding layers that detection tools alone cannot provide: context about who is behind an attack and why, attribution that links activity to known threat actors, and anticipation that highlights what an adversary is likely to target next. This intelligence feeds into defensive tooling, incident response, vulnerability prioritisation, and executive risk decisions.
The discipline operates across four levels: strategic intelligence gives senior leaders assessments of threat landscapes and geopolitical factors; tactical intelligence details adversary TTPs for detection tuning; operational intelligence contextualises specific campaigns and imminent threats; and technical intelligence delivers indicators of compromise for ingestion by security tools.