Ask a threat intel lead what keeps them up at night, and you'll rarely hear "not enough data." You'll hear about the alert that sat in a shared inbox for four days. The phishing domain marketing spotted before security did. The fake press release that was all over Telegram while the SOC was still triaging tickets.
That's the real job of digital threat intelligence. Not more collection. Better judgment about what's already out there, beyond your firewall, and who put it there.
We learned this the hard way. After one narrative attack we investigated in Eastern Europe, our analysts went back through two weeks of data. Everything was there. Forty-odd accounts created within the same 72 hours. A forum post asking for staff emails. A lookalike domain registered on a Sunday night. Three different teams had each seen a piece of it. Nobody saw the whole picture.
What Is Digital Threat Intelligence?
Asked for one line, we'd say digital threat intelligence is about spotting threats that start outside your network and figuring out who's behind them and what they want. Most of that happens on Telegram or forums or the dark web, and now and then at a domain registrar. We'd add one thing. It only counts if somebody can make a decision off it, and an alert feed on its own doesn't get you there.
Here's the difference in one example. A feed flags a suspicious IP. An analyst doing real intelligence work notices that the same hosting provider sits behind three new lookalike domains, that a fake "data leak" story is being pushed through 40 Telegram channels, and that the timing lines up with your earnings call on Thursday. Same raw signal. A completely different conversation with your CISO.
A quick test we run with new teams: can your program say what's being built against you right now, who's likely behind it, and what happens if nobody responds for 48 hours? If the answer to the third question is a shrug, you have monitoring. Not intelligence.
Digital Threat Intelligence vs. Cyber Threat Intelligence vs. Digital Risk Protection
Short version? CTI watches people trying to break into your systems. DRP finds the stuff that exposes you and gets it taken down. Digital threat intelligence is the bit in the middle that keeps asking who's actually running this and what they'll try next, and it doesn't much care whether the campaign ever touches your servers.
| Cyber Threat Intelligence | Digital Threat Intelligence | Digital Risk Protection | |
| Core question | Who is attacking our systems, and how? | Who is targeting us outside the perimeter, and why? | What exposure exists, and how do we remove it? |
| Typical inputs | Malware samples, IOCs, TTPs, internal logs | Social platforms, Telegram, forums, news, domains, dark web | Domain registrations, marketplaces, leaked data, fake profiles |
| Main output | Detections, ATT&CK mapping, hunting leads | Actor and campaign assessments, narrative maps, early warnings | Alerts, takedown requests, exposure reports |
| Usual owner | SOC, CTI team | Threat intel, trust & safety, risk and comms | Brand protection, security operations |
| Blind spot | Threats that never reach the network | Depends on analyst judgment; harder to automate | Coordinated networks: one takedown rarely stops the campaign |
Org charts make this messier than it needs to be. We've sat in meetings where the SOC had CTI, marketing had the social listening contract, legal did the takedowns, and when we asked who watches for coordinated campaigns, three people looked at each other. Nobody owned it. That's where the campaigns were.
The Four Levels of Threat Intelligence
You'll see threat intelligence split four ways in most textbooks, into strategic, operational, tactical and technical. We think of it more simply, as who's reading and how far ahead they're looking. A board member wants next year. A firewall wants the next five minutes. You'll end up needing all four, though never in equal amounts, and you shouldn't try.
| Level | Main audience | Time horizon | Typical output |
| Strategic | Board, CISO, executives | 6–18 months | Short briefs, risk assessments |
| Operational | Intel leads, incident response, comms, T&S | Days to weeks | Campaign and actor reports |
| Tactical | SOC, detection engineers, moderators | Weeks to months | TTP profiles, response playbooks |
| Technical | SIEM, SOAR, blocklists | Hours to days | IOCs, STIX bundles |
Strategic Threat Intelligence
Strategic threat intelligence is the slow stuff. Who's likely to come after you over the next year or so, and why? A lot of it comes from reading politics and regulation, and from watching what happens to companies like yours. Executives are the readers, so we try to keep it to two pages, and we always say how sure we are.
Picture a company about to launch somewhere the politics are messy. Nobody on that board wants a list of bad IPs. They want to know which state-backed outlets will start writing about them and what spin those outlets are going to put on it.
Operational Threat Intelligence
Operational intelligence looks at one campaign at a time. You want to know who's behind it and what they're after, and roughly when the next push is coming. It's what the people handling the response this week actually end up reading.
This is the level where a narrative attack stops looking like random noise. Fifty accounts saying the same thing could be anything. Fifty accounts posting on the exact rhythm of an operator you watched last spring, reusing two of the same Telegram channels? That's a campaign, and you can start guessing the next step.
Tactical Threat Intelligence
Tactical intelligence is about how the other side works, the TTPs. Phishing lures. How they build a fake persona. That trick where a claim gets washed through some "local news" site until it looks like independent reporting.
Nobody has to invent the vocabulary anymore. MITRE ATT&CK has intrusions covered and DISARM does roughly the same job for influence operations. And tactics last. They'll swap a burned domain before lunch. The routine behind it, though, where they rent aged accounts, test the story on fringe sites and then push, we've seen run almost unchanged for years.
Technical Threat Intelligence
Technical intelligence is the stuff machines read, the IOCs. Domains, IPs, hashes, the odd account handle. It goes stale fast, sometimes in hours, and it should flow straight into blocklists, SIEM and SOAR, usually as STIX over TAXII.
Don't skip it. Just be honest about what it is. If nine out of every ten things your team sends out are indicators, you're paying senior analysts to be a feed.
What Digital Threat Monitoring Actually Covers
Digital threat monitoring, in plain terms, is keeping an eye on the places where attacks against you get prepared before they ever reach your network. For most teams that means watching Telegram and the big social platforms, plus a few forums and paste sites, the dark web, and whoever is registering domains that look like yours. When we take on a new client we sort what turns up into three buckets. The first one is nearly always handled. The third one usually lands on somebody's desk after a journalist has already called.
Infrastructure and Credential Exposure
Credential and infrastructure exposure is anything an attacker could use to get in. Leaked passwords count, so do API keys sitting in a public repo, lookalike domains, and the access brokers on criminal forums selling a way into your VPN. If you already have a CTI team, they're probably on this already, at least partly.
What we'd push on is how fast you react. We once saw a few hundred corporate logins sit in a Telegram leak channel for nine days before anyone reset them. The alert had fired on day one. It went to a shared mailbox that nobody opened over the holidays.
Impersonation and Fraud
Impersonation and fraud is people pretending to be your company, or someone who works there, so they can con somebody else. Usually that somebody is a customer or a job seeker. Fake support accounts, cloned exec profiles on LinkedIn, phishing pages wearing your logo and bogus job ads all end up here.
The awkward bit is who owns it. Security tends to think it's marketing's problem because the brand is involved, and marketing figures it's security's because there's fraud. Meanwhile the fake profiles keep going. Our piece on how fake accounts operate lists the signs we check first.
Narrative Attacks and Coordinated Inauthentic Behavior
A narrative attack is someone deliberately spreading a false or twisted story about your organization. It nearly always rides on coordinated inauthentic behavior (CIB), which is a fancy way of saying a bunch of accounts that pretend not to know each other while working off the same script.
Nothing gets hacked, so it's easy to shrug off. We followed one made-up claim about contaminated products that started in two small Telegram channels. About 36 hours later it was in the comments under national news stories, and by then it was mostly real people repeating it because they believed it. Bot detection would have caught the early accounts. It wouldn't have told anyone where the story started or where it was going.
Why Narrative Signals Get Missed
They get missed because no single post looks dangerous. There's no malware and no indicator, so a SIEM rule has nothing to grab onto. You only see it when you look at a pile of posts together and notice the accounts were all made the same week, they post at the same minute, and they keep using the same badly translated phrase.
It doesn't help that social listening usually sits with marketing and is tuned for sentiment, while most security tools never look at Telegram at all. Digital threat protection for this bucket needs something that groups posts into narratives and follows them back to whoever's pushing them. That's what narrative intelligence is for.
Sources: Feeds, OSINT and Closed Communities
Digital threat intelligence pulls from three kinds of sources. There are threat intelligence feeds, commercial or community ones. There's OSINT from public platforms. And there are closed communities like invite-only Telegram groups and dark web forums. Which mix you need depends on what you're protecting.
We tell new teams to start with the question and pick sources after. If ransomware crews are your main worry, feeds will get you a long way. If it's a smear campaign before a merger, you'll be living in OSINT and closed channels, and the feed won't help much.
What Threat Intelligence Feeds Can't Tell You
Threat intelligence feeds are what vendors and communities publish so your tools can pull in bad IPs, domains and hashes automatically. They're good at telling you something is bad. They're a lot worse at telling you why it matters to you.
A feed won't flag a new domain as part of a campaign against your brand until someone's reported it, and by then the phishing emails are usually out. It's got almost nothing to say about narratives either, since a misleading Telegram post doesn't come with a hash. And a lot of feeds share the same upstream sources, so your third or fourth subscription may just be the same indicators with new labels. Check the overlap before you renew.
Open Source Threat Intelligence in Practice
Open source threat intelligence is intelligence you build out of public information, whether that's social media, news, forums, public code, domain records or government documents. Nearly everything a narrative attack does early on happens in public, which is why OSINT ends up doing most of the heavy lifting.
Finding data isn't the hard part. Keeping it usable is. Posts vanish within days as accounts get suspended, so we archive early, note when and where every item came from, and write down why an analyst thought two things were linked. Three weeks later, nobody remembers.
How the Threat Intelligence Lifecycle Works for Digital Threats
Pretty much every intel shop we've worked with runs on some flavor of the threat intelligence lifecycle. You start with a question, chase it until you've got an answer, and the answer usually kicks up the next question. If you took a course on it, you probably learned the stages as direction, collection, processing, analysis, dissemination and feedback. Fine. None of that changes for digital threats. What changes is the speed. We've watched narrative attacks get decided in the first two or three days, so when a campaign is live we go round the loop every day, and once it calms down we go back to weekly.
From Direction to Dissemination
Here's roughly how each stage looks on our side when the threat is out on the open web rather than inside a network.
Direction is a conversation more than a document. We sit down with whoever is asking and find out which questions matter this quarter and what they'd do with the answers.
Collection, for us, is mostly Telegram and X and TikTok, plus regional news and a few forums nobody outside the region has heard of. We read it in whatever language it was posted in, because machine translation has a habit of smoothing over the odd phrasing that gives an operator away.
Processing is the dull part. We translate it, throw out duplicates, archive it and timestamp it before the posts vanish, and believe me, they vanish.
Analysis is what people imagine when you say "intel analyst." In real life it's someone grouping posts into narratives and tracing the accounts and channels behind them, then putting a call on intent down in writing, with a confidence level.
Dissemination changes with the reader. The comms folks we work with usually get two lines in Slack. A board gets two pages.
Feedback is us going back a week later to ask if any of it changed what people did. When it didn't, we ask why, and yes, that conversation can get a bit awkward.
That last step gets skipped more than any other, at least in the teams we've worked with. There's a longer write-up on the threat intelligence lifecycle on our blog if you want to go stage by stage.
Writing Intelligence Requirements That Survive Contact
A good intelligence requirement is basically a question with a decision hanging off it, worded so the analyst knows when they're done. One client's first draft said "monitor threats to our brand," which can't ever be answered. The version we ended up with was closer to "is anyone coordinating claims that our product is unsafe in the three markets where we launch in Q1, and if so, who?"
Here's a trick we picked up early on. Read the requirement out loud, then ask whoever wrote it what they'd do differently depending on the answer. If they can't say, it'll turn into reports nobody opens. We also keep the list to somewhere around five to eight. Once a client handed over thirty, and the analysts treated that as none at all.
From Intelligence to Digital Threat Management
Digital threat management covers whatever happens after the analysis, meaning who responds, how fast, and with what. Sometimes it's a password reset. Sometimes a takedown request, sometimes a public statement. If intelligence never turns into one of those, it was a nicely written report and not much more.
What goes wrong most often in our experience isn't the analysis. It's an analyst spotting a coordinated campaign on a Tuesday, dropping it into a shared channel, and spending the next two days chasing down who is allowed to act on it.
Playbooks by Threat Type
For each type of digital threat, a playbook just says who owns the response, what they do first, and how quickly. Ours aren't long. Most fit on a single page, and the table below is close to the version we start clients with.
| Threat type | First owner | First actions | Suggested response time |
| Leaked credentials | Security operations | Force resets, check logs for use, notify affected staff | Within 4 hours |
| Lookalike or phishing domain | Security and legal | Preserve evidence, block internally, file registrar and hosting takedowns | Within 24 hours |
| Executive or brand impersonation | Brand protection and security | Report to the platform, warn customers if fraud is active, watch for new copies | Within 24 hours |
| Coordinated narrative attack | Threat intel and comms | Map the network, assess reach and intent, prepare a holding statement, brief leadership | First assessment within 12 hours |
| Recruitment fraud | HR and security | Report fake profiles, post a warning on the careers page, alert job boards | Within 48 hours |
The narrative row is the odd one out, since removal usually isn't the main move. We've seen 200 accounts taken down and the story carry on anyway, because by then real people were repeating it. Getting accurate information out quickly matters more. Our overview of the five types of social media attacks goes into this.
Which Metrics to Track
We care about two kinds of metrics, ones that show how quickly threats get found and dealt with, and ones that show whether anybody's decisions changed because of the intelligence. Indicator counts and mention volumes mostly show that the team was busy.
Four numbers that actually tell you something:
- the gap between the first signal and detection, measured against when the campaign really began
- the gap between detection and the first response
- the share of incidents spotted before a customer, journalist or platform told you
- the number of reports that led to a decision somebody wrote down
Number three is usually the one that makes a room go quiet. Leadership gets it instantly though, so we put it first in every quarterly review.
Choosing a Digital Threat Intelligence Platform
A digital threat intelligence platform needs to collect from the sources your requirements depend on, show how posts and accounts and domains connect, and get findings to whoever acts on them. In the demos we've sat through, most products do the first part fine. The other two are where they start to differ.
Evaluation Checklist
When a team asks us to help pick a vendor, we end up asking the same handful of things.
- Is it actually on Telegram and TikTok and the regional sites your adversaries use, and can it read them in the original language?
- Will it show you coordination — shared timing, recycled content, clusters of accounts — or does it stop at volume and sentiment?
- Do deleted posts stay in the archive?
- Can an analyst see why two items were grouped together?
- Will it send things to the tools you already have — your SIEM, ticketing or Slack, with STIX if you need it?
Our favorite test is boring. Take a real incident from the last six months, run every vendor against it, and see who'd have caught it. If a lot of your work is narrative stuff, have a look at how Osavul maps that same campaign across languages and platforms while you're running the trial.
Red Flags in a Vendor Demo
A few things make us wary in a demo. A vendor who'll only show a canned dataset and won't type your brand into the search box. Alerts stamped "AI-detected" with nothing underneath. Telegram coverage that's "on the roadmap." And per-keyword pricing, which sounds harmless until you notice your team monitoring fewer things to save money.
FAQ
What is digital threat intelligence?
In short, digital threat intelligence is finding threats that start outside your network and figuring out who's behind them and what they're after. Most of the time you're looking at social media, Telegram, forums and the dark web, plus the odd domain registrar. Our rough test is whether the person reading the report knows what to do next.
Isn't this just cyber threat intelligence?
CTI is mostly about people breaking into your systems. That's why it lives in malware samples, indicators and attacker techniques. Digital threat intelligence goes wider and looks outside the perimeter too, at fake accounts using your name, fraud aimed at your customers, and campaigns telling lies about you. The two teams we see working best swap notes every week, since the same actor keeps turning up on both sides.
Do threat intelligence feeds detect disinformation campaigns?
Very rarely. Feeds are built around technical indicators like IPs, domains and file hashes, and a misleading post in a Telegram channel doesn't have any of those. To spot a campaign you have to look at how accounts behave together and how a story moves, which means social and OSINT collection and a person reading it. It's not a niche worry anymore either, since ENISA's annual threat report ranks information manipulation among the main threats facing the EU.
Is OSINT enough for a digital threat intelligence program?
Often it covers most of what you need, since impersonation and the early stages of narrative attacks play out in public. It stops helping once you need closed forums, invite-only channels or criminal marketplaces. Getting into those takes time, and you'll want legal in the loop before anyone sets up a research account.
How do we know the program is working?
Two numbers tell us most of it. How fast you find threats and act on them, and how often your team spots something before a customer, journalist or platform does. If both get better over a couple of quarters, it's working, whatever the indicator count says.
Where to Start This Week
The cheapest first step we know of doesn't need a platform or new hires. Grab one incident from last year that blindsided you. Then walk it back, day by day, until you hit the first public sign. Where was it, and who should've seen it? Every time we've done this with a client, the answer pointed straight at a missing source or a missing owner.
From there we'd write down five priority requirements, put a name next to each threat type in the playbook table, and set up a weekly half-hour call with security, comms and legal on it. Most of the value we've seen from digital threat intelligence showed up once those three groups started looking at the same information together.
