Threat Intelligence (TI) is evidence-based, contextualised knowledge about cyber threats — who is attacking, how, why, what tools they use, what infrastructure they own — that helps an organisation make better security decisions and proactively defend itself. TI transforms raw data (logs, news, leaks) into actionable knowledge: blocking specific IP addresses (IoCs), recognising attack patterns (TTPs), understanding which threat actors target your industry. TI is consumed by SOC analysts, threat hunters, executives, and automated security tools (SIEM, EDR, SOAR). Mature programmes integrate TI into every detection rule, every blocking decision, every executive risk briefing.

Threat Intelligence pyramid: (1) **Strategic** — high-level analysis for executives: geopolitical trends, threat actor motivations, industry-targeted campaigns; informs board-level risk decisions, (2) **Tactical** — TTPs (Tactics, Techniques, Procedures) of attackers; mapped to MITRE ATT&CK framework; informs detection engineering and architecture, (3) **Operational** — specific campaigns, threat actor activities; helps SOC tune detections during active campaigns, (4) **Technical (IoC-based)** — concrete indicators (IPs, domains, file hashes, URLs); ingested directly into security tools for blocking. Different audiences consume different levels: executives see strategic, SOC managers see operational, analysts see tactical, automation consumes technical.

Five enterprise leaders: (1) **Mandiant Threat Intelligence** (Google Cloud) — premium, deep nation-state and APT coverage, integrated with Mandiant IR, (2) **Recorded Future** — broad coverage, strong vulnerability intelligence, comprehensive analyst portal, (3) **CrowdStrike Falcon Intelligence** — strong if you use CrowdStrike Falcon EDR, (4) **Microsoft Defender Threat Intelligence (Defender TI)** — comprehensive infrastructure intelligence, integrated with Microsoft Defender XDR, (5) **Palo Alto Unit 42 Threat Intelligence** — strong APT and ransomware coverage, integrated with Cortex XDR. Open source: MISP, OpenCTI (storage and sharing), AlienVault OTX, abuse.ch (URLhaus, ThreatFox, Feodotracker), CISA AIS, US-CERT bulletins. ISAC-specific feeds: FS-ISAC (financial), H-ISAC (health), MS-ISAC (US state/local government). Selection: integration with security stack, sector relevance, analyst quality.

MITRE ATT&CK is the de facto industry framework cataloguing real-world adversary Tactics, Techniques, and Procedures (TTPs) observed in cyberattacks. Structure: 14 tactics (Initial Access, Execution, Persistence, Privilege Escalation, etc.), each with multiple techniques (e.g., Spearphishing, PowerShell), each with sub-techniques. ATT&CK gives the security community a common language for: (1) Threat reports — every modern TI report maps activities to ATT&CK techniques, (2) Detection engineering — SOC writes rules per ATT&CK technique, then measures coverage, (3) Red team / pentest — adversary emulation via Atomic Red Team, Caldera, MITRE Engenuity testing, (4) Defensive maturity — measure your detection coverage against ATT&CK matrix. ATT&CK Navigator (free tool) visualises coverage. Required reading for any SOC, threat hunting team, or security architect in 2026.

IoCs are observable artefacts of an attack — concrete data points that can be matched against environmental data to detect compromise. Common types: (1) **Network indicators** — IP addresses, domains, URLs, JA3/JA4 fingerprints, (2) **File indicators** — MD5/SHA-1/SHA-256 hashes, file paths, file names, (3) **Email indicators** — sender addresses, subject patterns, attachment hashes, (4) **Behavioural indicators** — registry keys created, processes spawned, mutex names, (5) **YARA rules** — pattern-matching for malware, (6) **Sigma rules** — generic SIEM detection logic. IoCs have a short shelf life — IPs and domains rotate frequently. Modern detection emphasises **TTPs over IoCs** (David Bianco's Pyramid of Pain) because changing TTPs costs attackers far more than rotating infrastructure. Effective TI programmes consume both layers.

Five integration patterns: (1) **SIEM/XDR detection rules** — ingest TI feeds directly; auto-block known-bad IPs, domains, hashes; alert on matches, (2) **EDR allow/block lists** — push high-confidence IoCs to endpoint protection, (3) **DNS filtering** — block known malicious domains at DNS layer (Cisco Umbrella, Cloudflare 1.1.1.1, Quad9, NextDNS), (4) **SOAR playbooks** — automate response: TI hit triggers enrichment, lookup, containment workflows, (5) **Threat hunting** — analysts proactively search for IoCs and TTPs in environmental data, validating detection coverage. Mistakes to avoid: (1) ingesting too many feeds without quality filtering — generates noise, (2) treating all IoCs equally — distinguish high-confidence (Mandiant) from crowdsourced (OTX), (3) no expiry — old IoCs become false positives. Automation via TIP (Threat Intelligence Platforms) — Anomali, ThreatConnect, EclecticIQ, OpenCTI.

Pricing varies dramatically by depth and integration: (1) **Free** — CISA AIS, abuse.ch, AlienVault OTX, MISP communities; useful but require analyst time to filter, (2) **Mid-tier** ($25K-100K/year) — Recorded Future Lite, Anomali, ThreatConnect, individual ISAC memberships, (3) **Enterprise** ($100K-500K/year) — Mandiant Advantage, Recorded Future Premium, CrowdStrike Falcon Intelligence Premium, (4) **Strategic / consulting** — Mandiant strategic intelligence, Mandiant retainers; can run $250K-1M+/year. Many SIEM vendors include basic threat intel (Microsoft Defender TI with M365 E5, Splunk, Sentinel). Best practice: start with free + native vendor TI, add paid feeds as analysts can usefully consume them. ROI is hard to measure but real — TI-driven detections catch attacks that pure signature/behavioural detection misses.