NIST defines threat intelligence as threat information that has been "aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes" (NIST glossary, based on SP 800-150). The definition is dry, but the last part matters most. A feed with a million indicators is not intelligence until it changes what someone blocks, patches, reports or takes down.
That gap is the main problem in practice. In the SANS 2026 CTI survey, 91% of CISOs rated CTI valuable or extremely valuable, yet only 26% said it significantly influences their decisions. This guide is about closing that gap, including for teams that have no dedicated analyst.
What are the four types of threat intelligence?
CTI is usually split by audience and time horizon. Some frameworks use three levels and fold technical into tactical; the four-way split below is the more common one today.
| Type | Question it answers | Audience | Typical output |
|---|---|---|---|
| Strategic | Which threats matter to our business, and how is that changing? | Board, management, risk | Quarterly briefing, risk register input |
| Operational | Which campaign or actor is targeting us or our sector right now? | Security lead, incident response | Campaign report, response plan |
| Tactical | How do these attackers work, and can we detect it? | SOC, detection engineers | Techniques mapped to MITRE ATT&CK, detection rules |
| Technical | What exactly do we block or look for? | Firewalls, mail filters, EDR, SIEM | Domains, IPs, URLs, file hashes |
Technical indicators are the easiest to collect and the quickest to expire. David Bianco's Pyramid of Pain makes the point well: blocking a hash or an IP costs an attacker almost nothing, while detecting their techniques forces them to change how they work. Good programs use all four levels and know which one a given piece of work belongs to.
How does the threat intelligence lifecycle work?
The intelligence cycle comes from military and government intelligence work and translates well to security. It has six steps, and the first one is the one most teams skip:
- Direction. Write down the questions the program has to answer, the so-called intelligence requirements. "Are criminals preparing phishing against our customers?" is a requirement. "Collect threat data" is not. Executive input matters here: in the SANS 2025 CTI survey, the share of organizations where executives contribute to intelligence requirements rose from 33% in 2023 to 52%.
- Collection. Gather the data that can answer those questions, and only that data.
- Processing. Normalize, deduplicate and enrich it, for example with WHOIS, DNS and hosting data, so analysts are not reading raw logs.
- Analysis. Judge relevance and confidence, connect the dots and decide what it means for you.
- Dissemination. Deliver the result in the form each audience needs: a block list for the mail filter, a one-page summary for management, a takedown request for the host. Mark how widely it may be shared using the Traffic Light Protocol (TLP 2.0).
- Feedback. Ask whether the output led to action and whether the requirements still fit. Then start again.
Where does threat intelligence come from?
Most of what a small or mid-sized company needs is free. The paid market mostly sells curation and speed.
- Your own telemetry. Phishing reports from staff, mail filter logs, failed logins, EDR alerts. This is the most relevant source you have, because it shows who is already trying.
- OSINT. Open-source intelligence: new domain registrations, certificate transparency logs, passive DNS, public sandboxes and URL scanners, social media, paste sites and security researchers' reports.
- Government and community sources. National CERT advisories, sector ISACs, and sharing communities. In the US, CISA's Automated Indicator Sharing is free. In Germany, membership of the BSI's Allianz für Cyber-Sicherheit is free and includes situation reports and warnings.
- Commercial feeds and services. Curated indicators, actor reports, dark web monitoring and brand monitoring. Worth paying for where they save analyst hours.
- Peers. Informal exchange with security teams in your sector often produces the most specific warnings. Agree on TLP labels before sharing.
For storing and sharing, the open-source platforms MISP and OpenCTI are widely used and speak STIX and TAXII, the standard formats for machine-readable threat data. To describe attacker behavior, MITRE ATT&CK is the common language. Version 19, released in April 2026, lists 15 tactics, 222 techniques and 475 sub-techniques for enterprise environments, and adds new coverage for AI and social engineering (MITRE ATT&CK v19).
External and brand threat intelligence: the part many teams miss
Most CTI programs look inward: what hits our firewall, our mail server, our endpoints. A large share of attacks is prepared somewhere else. Before a phishing campaign against your customers starts, someone registers a lookalike domain, requests a TLS certificate, sets up a mail server and copies your login page. Before a fake shop takes orders in your name, someone copies your catalog. None of this touches your network, so internal tools cannot see it.
That is what external or brand threat intelligence covers, also called digital risk protection. The signals are public and early:
- New domains that resemble your brand, including typos, added words and lookalike characters.
- Certificates issued for those domains, visible in certificate transparency logs.
- MX records on a lookalike domain, a strong hint that it will send email.
- Pages that copy your logo, layout or login form.
- Social media profiles and ads that use your name or your executives' names.
The scale can be large. In our DoppelCart investigation we connected around 119,000 domains to a single fake-shop network that copies real stores. Brand intelligence also has a clear action at the end, which makes it easy to measure: block the domain internally, warn customers, and get the site removed through a takedown. Our phishing statistics for 2026 show how much of today's phishing depends on borrowed brands.
How can a small team start with CTI?
Small teams rarely fail for lack of skill. In the SANS 2026 survey, lack of time and lack of funding were the top barriers, each named by 44% of respondents, ahead of lack of expertise. So the plan has to be cheap in hours. A workable start for an organization without a security operations center:
- Week 1: write five questions. For example: Who would profit from attacking us? Which of our systems are exposed to the internet? Is anyone imitating our brand? Which vulnerabilities in our software are being exploited? Which suppliers could be a way in?
- Week 2: subscribe to the free basics. Your national CERT's advisories, the vendor advisories for software you run, and a sector community if one exists.
- Week 3: map your external attack surface. List your domains, public IPs, cloud services and social accounts. You cannot protect an attack surface you have not listed.
- Week 4: switch on brand monitoring. Watch for lookalike domains and fake profiles, either with your own scripts against certificate transparency or with a service such as domain monitoring.
- Every week: one hour of triage. Go through new findings, decide on an action for each, and write down what you did. That log is your first CTI report.
- Every quarter: one page for management. What changed, what you did about it, what you need. This is your strategic intelligence.
AI tools help with the reading. SANS found 45% of organizations already use AI in CTI, mainly to summarize reports, draft write-ups and automate workflows. Treat AI output as a draft that needs checking, especially when it drives a block or a takedown.
Do NIS2 and DORA require threat intelligence?
Not by name, but both are hard to meet without it. DORA, which has applied to EU financial entities since 17 January 2025, expects them to gather information on vulnerabilities and cyber threats (Article 13) and explicitly allows the exchange of cyber threat intelligence within trusted communities (Article 45). In Germany, the NIS-2 implementation law came into force on 6 December 2025 (BSI). It requires risk management measures and reporting of significant incidents within 24 hours. Knowing which threats are relevant to you is the basis for both.
Sharing needs rules, too. SANS found that 55% of organizations have no legally reviewed process for sharing CTI. If you plan to exchange indicators with peers, agree on TLP labels and check with your data protection officer first, because indicators such as email addresses can be personal data.
How do you know your CTI is working?
Count decisions, not data. "Indicators ingested" grows with every feed and says nothing. Better measures:
- How many intelligence requirements you answered this quarter.
- Time from first signal to action, for example from domain registration to block or takedown.
- Number of detections, blocks or takedowns that came from intelligence rather than from an incident.
- Incidents where intelligence warned you in advance, and incidents where it should have.
Where nebty fits
nebty is not a general CTI platform. We cover the external, brand-related part: lookalike domains, phishing sites, fake shops and fake profiles that target your organization, with the evidence and the takedown to remove them. If you work with AI agents, our MCP server brings those findings into your own workflows. To check a single suspicious site, the free website scan and who is hosting lookup are a good start.
Frequently asked questions
What is the difference between threat data and threat intelligence?
Threat data is raw: a list of IP addresses, a malware hash, a newly registered domain. Threat intelligence is that data after someone has checked it, put it in context and tied it to a decision. "This domain imitates our login page, was registered yesterday and already has a mail server, so we block it and request a takedown" is intelligence.
What are the four types of threat intelligence?
Strategic intelligence informs leadership about threat trends and risk. Operational intelligence describes specific campaigns and actors. Tactical intelligence covers attacker techniques, often mapped to MITRE ATT&CK. Technical intelligence is the machine-readable layer of indicators such as domains, IPs and file hashes. Some frameworks merge tactical and technical into one level.
Is OSINT enough for a small company?
For a start, yes. Free government advisories, certificate transparency logs, new domain registrations, public sandboxes and community feeds cover a lot. What a small team usually lacks is not data but the time to sort it, so the limiting factor is a clear list of questions and a routine for acting on the answers.
What is brand threat intelligence?
Intelligence about threats that use your name outside your own network: lookalike domains, phishing pages, fake shops, impersonating social media profiles and fraudulent ads. It is often called external threat intelligence or digital risk protection, and it is the part of CTI that firewalls and endpoint tools cannot see.
Do NIS2 or DORA require cyber threat intelligence?
Neither prescribes a CTI program by name, but both assume one. DORA expects financial entities to gather information on vulnerabilities and cyber threats and allows them to share threat intelligence in trusted communities. NIS2 and the German implementation law require risk management and fast incident reporting, which is hard to do without knowing what threatens you.
How much does cyber threat intelligence cost?
Anything from staff time only to six-figure platform contracts. A small team can start with free sources, an open-source platform such as MISP and a few hours a week. Paid services make sense where they save analyst time, for example by filtering lookalike domains or handling takedowns.
