A SOC lead we work with once pulled up his dashboard to show us what he was collecting. Fourteen thousand indicators that month. Nice number, we said, and asked who in the company had done anything differently because of them. Long pause. Then he laughed and said probably the firewall.
Teams aren't short on intelligence, not really. They make lots of one kind, usually the machine-readable kind, and hand it to people who wanted something else. So the board gets IP lists, and the SOC gets a forty-page geopolitical PDF it can't do anything with on a Tuesday afternoon.
Sorting out the types of threat intelligence clears up more of this than you'd expect. Below: all four, who reads each, where the raw material comes from, and where narrative threats (what our analysts chase all day) fall through the gaps.
What Are the Types of Threat Intelligence?
Ask ten analysts and you'll mostly hear the same four types of threat intelligence: strategic, operational, tactical and technical. What really separates them is who ends up reading the thing and how far out they're looking. Strategic is the executive stuff, a year or more ahead. Operational chases particular campaigns and whoever's running them. Tactical is about how attackers behave, their TTPs, and technical is the raw IPs, domains and file hashes you pipe into your tools.
Or as we put it to new analysts: why us, who's at it now, how do they work, and what gets blocked before lunch?
You don't buy these as four separate things, by the way. One decent investigation into a phishing crew can give you a paragraph for the board, a campaign write-up, a couple of detection rules and a blocklist, all from the same evidence.
The Four Types at a Glance
Here's the cheat sheet. If you keep one column in your head, make it the reader one, since honestly it decides the rest of the row.
| Type | Who reads it | The question it answers | How far ahead | What it usually looks like |
| Strategic | Board, CISO, executives | Why would anyone target us, and what would it cost the business? | 6–18 months | Short risk briefs, yearly assessments |
| Operational | Intel leads, incident response, comms, trust & safety | Which campaign is running against us, and who's behind it? | Days to weeks | Actor and campaign reports |
| Tactical | SOC, detection engineers, threat hunters, moderators | How does this adversary usually work? | Weeks to months | TTP profiles, detection logic, playbooks |
| Technical | SIEM, SOAR, EDR, firewalls | What exactly do we block or alert on? | Hours to days | IOCs, STIX bundles, feeds |
Strategic Threat Intelligence
Strategic threat intelligence, put simply, is the long view. Who could realistically come after you in the next year or two, why they'd even want to, and what it'd do to the business if they pulled it off. The readers mostly don't sit in a SOC, so you'll see politics, regulation, sector gossip and attacker motives in it, and almost no indicators.
The good ones are a page, two at most. It's also the type that gets skipped most, and we kind of get why. Writing one means reading a ton, making a call, then putting your name under a forecast the whole leadership team can watch go wrong. Next to that, sending out another batch of indicators feels pretty cozy.
What a Strategic Report Looks Like
A strategic report, at least a decent one, says what the analyst thinks, how sure they are, and what the business ought to do about it. The topics tend to be things like some new group sniffing around your sector, a regulation that quietly changes your exposure, or a political event that suddenly makes your logo a handy target.
Our template has been the same three parts for years. What's changing. Why it matters to us specifically. What we'd do, with the confidence level (low, moderate or high) right up front. No IOCs, no ATT&CK IDs, on purpose.
Example: Pre-Election Narrative Pressure
Before a national election in Central Europe, we briefed a utility that had never thought of itself as a political target. Our read: energy prices would be a campaign theme, and foreign-linked channels had already tried out claims about "sold-off grids" in two neighboring countries.
The advice was boring. Prep pricing statements, pick a spokesperson, watch for that exact wording. Six weeks later the story turned up nearly word for word, and the company answered in hours, not days.
Operational Threat Intelligence
Operational threat intelligence is about specific campaigns, ones already running or about to kick off, and it tries to pin down who's behind them, what they're after, which infrastructure they're using and roughly when they'll move. The people reading it are intel leads, incident responders, comms and trust & safety teams, basically whoever has to decide what to do this week rather than this year.
A lot of our narrative work sits here. Fifty accounts pushing the same claim is just noise, more or less, until somebody notices it's the same crowd you saw back in spring.
Campaigns, Actors and Intent
An operational report should tell you which campaign this is, who's running it and what they're hoping to get out of it. You don't need a nation-state name for the attribution part, by the way. Something like "same operator cluster we tracked in March, lots of overlapping accounts" is usually plenty to act on.
Intent gets undervalued. Two phishing runs with the same kit, one at payroll and one at your press office? The second probably wants your media channels before something else lands, and that changes who you call first.
Where Dark Web Threat Intelligence Fits
Dark web threat intelligence feeds the operational layer more directly than pretty much anything else does. We're talking forum chatter, access brokers selling their way into networks, leaked credential dumps, and those closed Telegram groups where campaigns actually get planned. Often it's the earliest heads-up you'll ever get.
It's also full of scammers bragging about stuff they don't have. Our rule of thumb: anything from there is a lead, not a finding, until we see it confirmed on the open web or in the client's own logs.
Tactical Threat Intelligence
Tactical threat intelligence is basically the how. How attackers actually run their operations, meaning their tactics, techniques and procedures (TTPs, if you're into acronyms). It's what SOC analysts, detection engineers, hunters and even content moderators reach for when they're writing detection rules, figuring out what to hunt, or patching up a playbook after a bad week.
Why bother with it? Because it keeps. Of all the types of threat intelligence, this is the one that ages slowest, and it's not even close. Swapping an IP takes an attacker about a minute, but changing how they run things (how they build fake personas, set up infrastructure, or wash a claim through some fake local news site) takes them weeks and costs real money.
Mapping TTPs to MITRE ATT&CK and DISARM
Most teams write it down in shared taxonomies. For intrusions that's usually MITRE ATT&CK, for influence operations it's DISARM. Same words on both ends, so a detection someone wrote in Kyiv still reads fine to a hunter in Toronto.
We tag every narrative campaign we track with DISARM techniques. Sounds like paperwork, and a bit of it is. But when a new campaign runs the same three moves as an old one (forged "leaked documents," a few fake experts, a push from accounts bought last week), moderators get a decent idea of what's next.
Technical Threat Intelligence
Technical threat intelligence is the machine-readable layer, things like IP addresses, domains, URLs, file hashes, bits of email headers and malware signatures. It's meant for your SIEM, SOAR, EDR and firewalls rather than for people, and it's both the quickest kind to produce and the quickest to go out of date.
Nobody really reads technical intelligence. Machines do. Which is fine, as long as somebody is checking what the machines are being fed every now and then.
IOCs and Threat Intelligence Feeds
Threat intelligence feeds are how most of this technical stuff arrives, as streams of indicators, usually STIX/TAXII or plain CSV, that your security tools pull in on their own. Commercial, open-source, ISAC ones from your sector... quality's all over the place, frankly.
We once looked at a team paying for four feeds that overlapped by something like 60%. That's not coverage, that's a duplicate invoice. So before buying one more, check how often it's refreshed, how much of it you already get elsewhere, and whether anything in it is about your sector or it's the same global list everybody's got.
Why Indicators Expire So Fast
IOCs go stale fast because swapping infrastructure is cheap for attackers. A phishing domain might last a few hours, and an IP on some bulletproof host maybe a couple of days. Blocking yesterday's domain very rarely does much about today's campaign.
David Bianco's old Pyramid of Pain makes the same point, and we still pull it up in training: hashes and IPs cost an attacker next to nothing to change, while TTPs actually hurt. So we'd let the technical stuff run on autopilot with an expiry date baked in, and push analyst time further up where it lasts longer.
The Missing Layer: Narrative Threats
Narrative threats, the way we use the term, are organized pushes to change what people believe about a company, a person or sometimes a whole country, and they usually come with fake accounts, claims recycled from some older campaign, and the same story getting shoved across four or five platforms in one afternoon. They hurt, sometimes badly, and yet the classic four types barely notice them, mostly because there's no malware in the picture and nothing an indicator could catch.
A disinformation campaign against a bank never goes near its network. It goes after customers, and customers who believe some liquidity rumor at nine on a Friday night are standing in line at the ATM on Saturday morning.
Why the Classic Types of Cyber Threat Intelligence Miss Them
The classic types of cyber threat intelligence grew up around intrusions, and you can still tell, since the way they collect, the tools they lean on and the numbers people report upstairs all kind of assume something happens on a network. A coordinated narrative doesn't give your SIEM anything to grab, no hash and no bad IP, just thousands of posts that look harmless enough when you read them one at a time.
You only see it when you look at the whole pile together. Accounts that were all made the same week. Posts going out at weirdly identical intervals. The same clumsy translated phrase hopping from Telegram over to X in less than an hour. Spotting that needs bot detection and narrative clustering rather than one more IOC feed, which is exactly the gap narrative intelligence was built for. The usual patterns are in our post on five types of social media attacks.
Good news, though, the four levels still work here. Which narratives come for us next year, which network pushes this claim now, which DISARM techniques it uses, which accounts to report. That's roughly how our team at Osavul runs narrative work, and it slots into an existing CTI program fine.
Threat Intelligence Sources Behind Each Type
Each type has its own threat intelligence sources, more or less. Strategic people read geopolitics, government advisories and the odd industry study. Operational folks live in OSINT, dark web forums and closed Telegram channels. Tactical gets built out of incident reports and those shared taxonomies we mentioned, and technical is feeds, sandboxes and whatever your own telemetry spits out.
| Type | Main sources | Who usually collects | What to watch out for |
| Strategic | Geopolitical reporting, government advisories, industry studies, long-running narrative trends | Senior analysts | Opinion dressed up as evidence |
| Operational | OSINT, Telegram and forum monitoring, dark web markets, social platforms | Intel analysts, OSINT team | Unverified claims, fake sellers |
| Tactical | Incident reports, malware analysis, ATT&CK and DISARM mappings, sharing with peers | Detection engineers, hunters | TTP profiles nobody has updated |
| Technical | Commercial and open feeds, sandboxes, internal telemetry, ISAC sharing | Automated pipelines | Overlap, false positives, stale indicators |
Open sources carry more of the load than people guess (here's our guide to OSINT methods). Getting it all into one place instead of six browser tabs is what intelligence analysis software is for.
Threat Hunting vs Threat Intelligence
The short answer: intel looks outward at what attackers do, hunting looks inward for traces of it on your own systems. Intel hands over a hunch, hunters go and check it. Have only one and you're either guessing or just reading.
Most of the handoff happens at the tactical level. Say a TTP profile mentions an actor that likes scheduled tasks for persistence, then the hunter goes digging for odd scheduled tasks. Narrative work runs the same way, honestly. If the DISARM profile says this operator plants claims in small local Facebook groups first, our analysts check the local groups before they bother with the national ones.
Even an empty hunt tells intel something: the technique isn't there, or you can't see it. Write both down.
Making Threat Intelligence Actionable
Actionable threat intelligence, in our book, is anything a real person with a name can do something about before the window closes, because it showed up with enough context for them to make the call. We'd keep the definition that simple. In practice it means every type has one reader, one format and one decision it's meant to feed, and whatever doesn't fit is reading material, which is fine, just don't call it intelligence.
There's a reason the threat intelligence lifecycle opens with requirements and not with collection, and it's a pretty simple one. When nobody asked a question in the first place, the answer has nowhere to land and just sits in a shared drive.
Match Each Type to One Consumer
We'd pick one main reader per type and send it in whatever format they already open on a normal day, rather than inventing a new portal they'll ignore. In our own setup the CISO gets a one-page strategic note once a month, the intel lead and comms get an operational update every week, detection engineering gets the tactical material as rules and playbooks, and the technical feed goes straight into the SIEM without anyone touching it.
Then don't count pages. Count what changed. Did those indicators fire any alerts, and were the alerts real? Did a single decision upstairs move because of the strategic note? If one did this quarter, honestly, that's a good quarter.
Three Mistakes We See Most Often
- All technical, nothing strategic. Judge yourself by IOC count and you get a very busy SIEM and a board with no clue what's coming.
- One report for everybody. The same 30-page PDF to the CISO, the SOC and comms means nobody reads it. Split it.
- Nobody says what helped. Then collection drifts toward what's easy to grab, and away from what people needed.
FAQ
What are the 4 types of threat intelligence?
Strategic, operational, tactical and technical, those are the four types of threat intelligence most teams use. Very roughly, that's the long-term risk picture for executives, who's running which campaign at the moment, how attackers tend to work (their TTPs), and the IPs and hashes your tools end up blocking.
Which type of threat intelligence matters most for a SOC?
Day to day it's mostly tactical and technical, since those feed straight into detections and blocklists. Still, we've noticed that SOCs which get even a short operational note each week tend to triage faster, and it's mainly because they already know which campaigns are live when the alerts come in.
Is strategic threat intelligence only for executives?
No, not really. Execs are the main readers, sure, but the same work tells your analysts which regions, languages and actors deserve their hours, and without that the lower levels slowly drift toward whatever data happens to be easiest to collect.
What is the difference between threat hunting and threat intelligence?
Intel mostly watches attackers out in the wild and writes down how they work. Hunting is the other half, where someone goes through your own systems looking for that same behavior and then tells the intel team what turned up, or what they just couldn't see with the telemetry they've got.
Does threat intelligence cover disinformation?
Classic cyber threat intelligence mostly doesn't, since disinformation leaves no malware or network indicators. You need narrative and network analysis across social platforms and messengers, ideally mapped to DISARM. Our NATO virtual manipulation brief shows what that work looks like at scale.
Where to Start
We usually tell people to start with a list of who in the organization actually uses intelligence, and which decisions they make with it, even if it's just a few names in a notebook. Then go person by person and check which of the four types of threat intelligence each of them really gets. Most teams find one level stuffed and another more or less empty, and the empty one is where we'd begin.
Don't fix all four at once. Give the emptiest level one analyst and ship something rough within 30 days. If you're also setting up sharing with peers, NIST SP 800-150 is a solid reference on how to exchange threat information.
And if narrative threats are your blind spot, which they are for most teams we talk to, that's honestly the level we'd start with.
