Types of Threat Intelligence: Strategic, Operational, Tactical and Technical, With a Real Example of Each
By ScruteXPublished
Most threat intelligence that fails does not fail because it is wrong. It fails because it reaches the wrong person in the wrong form:
- A board receives a list of file hashes.
- A SOC analyst receives a geopolitical briefing.
- A firewall receives a PDF.
Splitting threat intelligence into types solves that problem. Each type answers a different question, for a different audience, over a different lifespan.
The model comes from guidance that MWR InfoSecurity wrote with the support of the UK's CPNI and CERT-UK in 2015 (Chismon and Ruks). It sorts intelligence by who uses it and what it is meant to achieve. Strategic and tactical intelligence are for long-term use. Operational and technical intelligence are for short-term, immediate use.
What is threat intelligence?
NIST's definition. Threat intelligence is threat information that has been aggregated, transformed, analysed, interpreted or enriched to provide the context needed for decision-making. Threat information is the raw material. NIST lists its major types as indicators, TTPs, security alerts, threat intelligence reports and tool configurations.
Why the difference matters. A list of IP addresses is threat information. The same list, with why it matters to you, how far you trust the source and what to do about it, is threat intelligence. Most of the cost of a threat intelligence programme sits in that gap.
Why intelligence is never complete. Intelligence seeks knowledge of things that others are working to hide. CPNI warns that the secrecy, price and non-disclosure agreements around commercial threat intelligence can create a false impression that the provider knows everything. A good analyst knows what a source cannot see.
What are the four types of threat intelligence?
| Type | Question it answers | Who uses it | Typical form | Useful for |
|---|---|---|---|---|
| Strategic | How is our cyber risk changing, and what should we decide differently? | Board, CEO, CISO, risk committee | Short written briefings, verbal updates | Months to years |
| Operational | Is a specific attack coming at us, from whom, and when? | Security managers, heads of incident response | Warnings and alerts | Hours to days |
| Tactical | How do the attackers likely to target us actually operate? | Security architects, system administrators, detection engineers | Technique write-ups, ATT&CK mappings, campaign reports | Months to years |
| Technical | What exact artefacts should we detect or block right now? | SOC staff, incident responders, firewalls, SIEM and EDR tools | Machine-readable indicators (STIX, CSV) | Days to weeks |
Two of CPNI's observations explain the "typical form" column. Strategic intelligence is almost always prose: reports, briefings or conversations. Technical intelligence is usually data consumed through technical means. It has a shorter usable lifespan, because attackers can easily change IP addresses or file hashes, so it should be consumed automatically.
How does the intelligence cycle produce each type?
Every type is the output of the same process. CPNI describes it as a cycle:
- Requirements. Decision makers state what they need to know. CPNI says this step is often overlooked.
- Collection. Gathering the information that should answer the requirement. It can dominate much of the budget.
- Analysis. Turning data into something actionable. Sometimes that is as simple as parsing a feed into a firewall deny-and-alert ruleset. Sometimes it means pulling relevant points out of a long report.
- Production and dissemination. Delivering a product in the right form for the consumer.
- Evaluation. Checking whether the product met the requirement. CPNI says this step is frequently neglected.
The product looks different for each type. In CPNI's framing, it might be a three-line report to the board, a white paper for defenders, or simply an approved rule added to defence hardware. Same cycle, four very different outputs.
Why do sources define tactical and operational differently?
If you have read three articles on this topic, you have probably seen three definitions of "tactical". The cause is history, not error.
The three-level model. Many sources use a three-level model borrowed from military intelligence:
- Tactical is the most technical level: indicators for immediate detection and response.
- Operational covers adversary behaviour and campaigns.
- Strategic is for executives.
The four-type model. The CPNI model splits the same material differently:
- Tactical means TTPs.
- Technical means indicators.
- Operational is reserved for intelligence about a specific impending attack.
FIRST's version. FIRST's CTI curriculum also uses four types. Its wording for operational intelligence is a little broader: intelligence specific to the organisation and its business operations, produced more often, that can warn defenders of an imminent attack or of behaviour already observed.
| What it describes | Four-type model (used here) | Common three-level usage |
|---|---|---|
| Board-level risk and trends | Strategic | Strategic |
| A specific attack expected against you | Operational | Often folded into operational |
| Attacker TTPs and campaign behaviour | Tactical | Operational |
| IPs, domains, hashes and other indicators | Technical | Tactical |
Neither model is wrong. When you write intelligence requirements, brief a board or compare providers, say which model you mean. "We need tactical intelligence" means two very different things depending on who hears it.
What is strategic threat intelligence? An example
Strategic threat intelligence is high-level, non-technical information on how cyber risk is changing. It is written for the people who decide budgets, markets, partners and acquisitions.
CPNI says it deals in risk and likelihood rather than technical detail. Its job is to help the board understand current risks and find the risks it does not yet know about.
Example: hacktivist activity moving from websites to operational technology
On 19 January 2026, the UK's National Cyber Security Centre (NCSC) warned that Russian-aligned hacktivist groups were still targeting UK organisations, especially local government and critical national infrastructure. The aim was to disrupt operations, take websites offline and disable services. The NCSC described the activity as driven by ideology rather than money, and carried out by groups operating outside the direct control of the state.
The alert also recorded a shift. These ideologically motivated attacks had evolved to target UK operational technology (OT), and the NCSC urged all OT owners to follow its recommended mitigation advice.
For the board of a water utility or a county council, that shift is the strategic message. A good strategic product turns it into three lines. An illustrative version:
How a requirement is worded decides whether the team can answer it. CPNI's example of a poor requirement asks the team, ahead of entering a new country, to report that country's capability and which groups will attack the company and how. That mixes intelligence types, and a private organisation cannot legally gather much of what it asks for.
What is operational threat intelligence? An example
Operational threat intelligence is actionable information about a specific attack coming at your organisation. Ideally it tells you the nature of the attack, who is behind it and when it will happen, so you can remove attack paths or harden services first.
It is also the rarest type. CPNI is blunt about why:
- For most attackers, only a government has the access needed to collect it.
- A private company cannot legally get inside the communication channels of a nation-state group.
- The realistic exceptions are groups that operate in the open, such as hacktivists, and attacks triggered by real-world events.
Example: a hacktivist DDoS warning for local government
The same NCSC alert named NoName057(16), active since March 2022, which has made frequent DDoS attempts against UK local government. According to the NCSC, the group operates mainly through Telegram channels, and has used GitHub and other sites to host its DDoS tool, DDoSia, and to share TTPs with its followers.
That detail is what makes operational intelligence possible here. A group that coordinates volunteers in open channels has to say, in public, what it wants hit. If one of those channels names your council, your sector or a date, you have operational intelligence.
The NCSC's denial of service (DoS) guidance in the same alert sets out the response:
| Area | What the NCSC recommends |
|---|---|
| Understand your service | Find every point where an attacker could exhaust resources, and decide whether you or a supplier is responsible for each |
| Upstream defences | Know the DoS mitigations your ISP has on your account; consider third-party DDoS mitigation and a content delivery network for web services; consider more than one provider |
| Scaling | Make sure services can scale quickly, using cloud auto-scaling or spare capacity in your own data centre |
| Response plan | Plan for graceful degradation, changing tactics, keeping administrative access during an attack, and a fall-back for essential services |
| Testing and monitoring | Test the types and volumes of attack you can absorb, and monitor so you know when an attack starts |
What is tactical threat intelligence? An example
Tactical threat intelligence describes how threat actors conduct attacks: their tactics, techniques, procedures and tools. Its purpose is to understand how attackers are likely to come at your organisation and map that to ways of preventing or detecting them.
CPNI called it one of the most useful forms of intelligence for protecting an organisation, and it lasts. In 2015, its example was attackers using Mimikatz derivatives to pull cleartext credentials and replay them through PsExec. The suggested response was to prevent interactive logins by admins and to make sure logging captured PsExec use.
Example: SafePay ransomware, joint advisory AA26-293A (20 October 2026)
Eleven years after CPNI's example, a joint advisory published on 20 October 2026 lists the same two tools.
The advisory was issued by:
- the FBI;
- CISA;
- the US Secret Service;
- Germany's Landeskriminalamt Rheinland-Pfalz;
- the UK's National Crime Agency;
- the North West Regional Organised Crime Unit.
It reports that SafePay has affected at least 600 victims across multiple critical infrastructure sectors and businesses in North America, South America, Europe and Australia since August 2024. It places SafePay among the most active ransomware groups of 2026.
| Stage | What SafePay actors do, per the advisory | What a defender changes |
|---|---|---|
| Initial access | Exposed credentials, brute force (T1110), VPN access, and five known CVEs: two in edge devices, three exploited across internet-exposed systems through automated scripts (T1190) | Enforce MFA on VPNs; prioritise those CVEs on internet-facing systems; alert on repeated failed VPN logins |
| Persistence | Gaining admin rights on existing accounts (T1098) or creating new ones (T1136), using built-in admin tools | Review new and unexpected admin accounts; alert on privilege changes |
| Execution and movement | Living off the land with PsExec (T1021.002), WinRM (T1021.006) and RDP (T1021.001); share-enumeration scripts to find valuable data | Restrict PsExec and WinRM to admin hosts; log and alert on share enumeration |
| Privilege escalation | User Account Control bypass (T1548.002) and token impersonation (T1134.001) | Keep UAC at its highest setting; monitor for elevated processes from unusual parents |
| Defence impairment | Disabling security software; in some cases changing users' passwords so legitimate logins fail | Alert on tamper events from endpoint security tools |
| Exfiltration and impact | RClone and WinSCP for exfiltration (T1048); halting the Volume Shadow Copy Service and resetting network-attached backup storage to factory settings (T1490) | Flag uploads to unfamiliar cloud storage; keep offline, immutable backups and test restores |
| Tools | Mimikatz for credentials; commercial remote access tools (AnyDesk, TeamViewer, ScreenConnect) for access and file transfer | Allow-list remote access tools; hunt for unapproved installs |
This is also where tactical intelligence and vulnerability management meet. CPNI draws the line clearly:
- A vulnerability existing in a product you use is important information that needs action, but it is not information about a particular threat.
- A specific group exploiting that vulnerability is tactical threat intelligence.
The five CVEs in AA26-293A are the second kind. Read them as the doors SafePay is known to use, not as routine patch-list items:
| CVE | Product | How the advisory groups it |
|---|---|---|
| CVE-2020-3259 | Cisco ASA Software | Edge device |
| CVE-2023-20269 | Cisco ASA and Firepower Threat Defense Software | Edge device |
| CVE-2023-27532 | Veeam Backup & Replication | Internet-exposed system, automated scripts |
| CVE-2024-40711 | Veeam Backup & Replication | Internet-exposed system, automated scripts |
| CVE-2024-40766 | SonicWall SonicOS | Internet-exposed system, automated scripts |
The advisory lists the CVE IDs only. The product names come from the CVE records.
What is technical threat intelligence? An example
Technical threat intelligence is the specific technical detail of an attacker's assets: file hashes, IP addresses, domain names, hostnames, C2 endpoints and phishing email subjects. CPNI puts the distinction neatly:
- Knowing that an attacker uses a particular piece of malware is tactical intelligence.
- An indicator for one specific compiled sample of that malware is technical intelligence.
Example: the indicators in the same SafePay advisory
AA26-293A includes STIX XML and STIX JSON files of indicators observed between November 2024 and August 2026. They include:
- 9 IP addresses, labelled by role (intrusion, exfiltration, client login panels and C2);
- 30 file entries, some of them legitimate tools;
- 4 SHA-1 hashes and 6 SHA-256 hashes;
- 4 hostnames.
Three entries, defanged, as the advisory lists them:
| Indicator | Type | Role given in the advisory |
|---|---|---|
| 88.119.167[.]239 | IP address | soc.dll command and control |
| 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae | SHA-256 | soc.dll |
| WIN-SBOE3CPNAL | Hostname | IOC hostname |
The advisory itself warns against blocking these blindly:
- Some of the listed files are legitimate tools and should not be treated as malicious without analytical evidence.
- Organisations should investigate or verify IP addresses before acting on them.
- Infrastructure on cloud platforms can be reassigned to benign services, so the indicators should be read as historical and checked against current telemetry.
That warning is the whole case for treating technical intelligence as an investigation lead, not a blocklist.
Why indicators age so fast
CPNI's guidance ranks indicators by how hard they are for an attacker to change.
- Malware indicators: a hash is trivial to change, because altering one bit anywhere in a file produces a new hash. Dropped file names, registry keys and well-written YARA rules are progressively harder to evade.
- Network indicators: an IP address is the easiest to swap. Domain names, exact URLs and the structure of a command channel each cost the attacker more effort. A domain produced by a domain generation algorithm has little value as an indicator at all.
SafePay can rebuild locker.dll quickly. Abandoning PsExec, RClone and edge-device exploitation would mean changing how the whole operation works.
There is also the coverage problem. CPNI cited research that found as little as 1% overlap between three popular feeds of flagged IP addresses, covering more than 20,000 addresses in total. Its conclusion was that either attackers use huge numbers of addresses and each feed sees a small part, or many listed addresses have little intelligence value, and probably both. That research dates from 2015. The lesson still holds: no single feed is complete.
How to set technical requirements
CPNI warns that collection easily drives technical requirements. "Process and react to feed X" puts all your faith in feed X. Better requirements state the outcome:
- identify phishing emails sent to other companies in our sector, and check whether they are also reaching our staff;
- identify IP addresses seen in attacks on organisations like ours, and confirm we are not connecting to them.
Requirements should also look backwards. CPNI recommends checking whether you connected to a listed address at any time in the past year, not only this week.
How can one report contain several types of threat intelligence?
CPNI observed that a single report on an attack group can contain almost every type:
- the sector under attack is strategic;
- the modus operandi is tactical;
- the hash appendix is technical.
Such reports rarely contain operational intelligence, because that would need details of a specific impending attack.
AA26-293A fits that pattern exactly:
| Part of AA26-293A | Type | Who should receive it |
|---|---|---|
| A prolific group has hit at least 600 victims, including critical infrastructure, across four continents since August 2024 | Strategic | CISO, with a line to the board if your sector is named |
| Initial access methods, living-off-the-land tools, exfiltration and backup destruction mapped to ATT&CK | Tactical | Architects, administrators, detection engineers |
| STIX files of IPs, hashes, file names and hostnames | Technical | SOC, SIEM, threat intelligence platform |
| Nothing saying SafePay will hit your organisation next week | Operational (absent) | Not applicable |
The NCSC alert splits the same way:
- the move towards OT is strategic;
- the group's tooling and its use of open channels are tactical;
- a channel post naming your organisation would be operational.
Here is what one CTI analyst might send out in the week after reading both documents:
| Product | Type | Recipient | Form |
|---|---|---|---|
| Three-line brief on hacktivist targeting of OT and ransomware pressure on critical infrastructure | Strategic | Board risk committee | Email or slide |
| Watch list of open channels for mentions of the organisation, plus a rehearsed DDoS escalation path | Operational | Head of incident response | Runbook update |
| SafePay technique table mapped to current controls, with three prioritised fixes | Tactical | Infrastructure and identity teams | Short memo plus tickets |
| AA26-293A STIX loaded, retro-hunt from November 2024, matches routed to an analyst | Technical | SOC | SIEM content and a hunt ticket |
Splitting reports this way is the analyst's job. Forwarding the whole PDF to everyone is how intelligence ends up unread.
Which type of threat intelligence should your team start with?
Start with requirements, not feeds. CPNI warns against "collection-focused" threat intelligence: teams formed because leadership felt it needed one, which then consume whatever providers sell. It says this rarely delivers significant benefit. Decision makers should first state what they actually need to know. One of CPNI's example requirements is to be told about publicly known, widely exploited vulnerabilities within one day of them becoming known.
A small team can do this well. CPNI found that some organisations get real value from threat intelligence without any dedicated staff or specific budget. In those cases, people who read widely, take part in sharing forums and act directly on what they learn are already running the cycle.
CPNI's quick wins map onto the four types:
- Strategic: work with senior management to list the cyber threats they perceive, then use open sources to check whether those threats have been realised.
- Operational: prepare a contact list, including out-of-hours details, of everyone you would need if you received notice of an impending attack.
- Tactical: when a new campaign report is released, pull out the entry method, movement techniques and exfiltration methods, then run a paper exercise to see how exposed you would be.
- Technical: take a free daily list of C2 addresses, put it in an alert list on your main firewall or IDS, and start incident response if you see outbound connections to them.
For most organisations, the first two products to build are tactical and technical intelligence tied to the systems you actually run. National CERTs and cyber agencies such as CERT-In, the NCSC and CISA publish plenty of both, free. Add a short strategic brief for leadership each quarter. Treat operational intelligence as a bonus where your attackers are likely to operate in the open.
How do the four types connect to your external attack surface?
Intelligence becomes actionable when it meets your assets.
- Tactical intelligence on SafePay is only urgent if you run the edge devices and internet-facing software it exploits. Answering that question is external attack surface management.
- Operational warnings of hacktivist DDoS matter most for your public websites and citizen- or customer-facing services. Those are the assets you need to know about and harden first.
- Technical indicators need somewhere to land. If you don't know which systems face the internet, you can't be sure your detection covers them.
This is the prioritisation step in Continuous Threat Exposure Management (CTEM). Threat intelligence tells you which exposures attackers are using now. Your asset inventory tells you which of those you actually have. Without the second, the first stays academic.
Key takeaways
- The four types. Strategic, operational, tactical and technical. The 2015 CPNI and CERT-UK model sorts them by who uses them and how long they stay useful.
- The labels are not standard. In three-level models, "tactical" means indicators. In the four-type model it means TTPs. Say which model you mean.
- One cycle, four outputs. Every type comes from the same cycle: requirements, collection, analysis, production and evaluation. Requirements and evaluation are the steps most often skipped.
- Operational intelligence is the rarest. For private organisations, a warning of a specific attack usually comes from groups that operate in the open.
- TTPs last; indicators decay. The same two tools appear in CPNI's 2015 tactical example and in a 2026 ransomware advisory.
- Split every report by audience. One advisory can feed the board, the architects and the SOC in one week.
Check your own programme
- ☐ Do you have written intelligence requirements, and does each one name a consumer?
- ☐ Have you checked the five AA26-293A CVEs (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766) against your internet-facing Cisco ASA and FTD, Veeam Backup & Replication and SonicWall devices?
- ☐ Has someone loaded the AA26-293A STIX file and searched your logs back to November 2024?
- ☐ Do PsExec, WinRM and RClone use outside approved admin hosts raise an alert?
- ☐ Is there a rehearsed escalation path if an open hacktivist channel names your organisation?
- ☐ When did the board last receive a strategic brief of three lines or fewer?
What ScruteX finds here
- Technical: ScruteX collects and correlates indicators of compromise from multiple sources and scores IP addresses by reputation and associated malicious activity.
- Tactical, tied to patching: it maps exploited CVEs to your environment, with exploitation intelligence, so a group's known entry points become a short patch list for the assets you actually expose.
- Tactical and operational: it monitors ransomware groups and leak sites, profiles threat actors and their TTPs, and tracks hacktivist activity and coordinated campaigns aimed at your brand, industry or region. It also watches Telegram channels for mentions of your brand and planned attacks.
- The asset side: it discovers the internet-facing systems an advisory could apply to, including the ones missing from your register.
What that looks like
At one ASX-listed financial services client, the first ScruteX scan returned 30+ internet-facing assets against a 20-asset manual register. Nine were unknown, including a staging environment for a client-facing app. An advisory like AA26-293A only helps if it reaches those nine as well as the twenty on the register.
The image shows the finding format, redacted. The values are placeholders.
Which of your systems does AA26-293A apply to?
Run the free attack surface scan to see the subdomains, open ports, certificates and exposed services an attacker can see, then compare them with the five CVEs above. It starts from your domain on the free tier: you sign up, with no credit card.
ScruteX looks from the outside only. It will not search your internal logs for the AA26-293A indicators. That retro-hunt still runs in your SIEM or EDR.
Where to go next
- If you need intelligence matched to your sector: Threat Insights covers ransomware, hacktivism and threat actor intelligence for your industry and region.
- If the tactical question is which exposed systems to patch first: Vulnerability Insights finds them and ranks them by real-world exploitability.
- To put tactical ransomware intelligence to work: How to Track Ransomware Groups Before They Hit Your Sector.
- To see how attackers trade access in open channels: Initial Access Brokers on Telegram.
Frequently asked questions
What are the four types of threat intelligence?
Strategic (high-level risk for the board), operational (a specific impending attack, for security managers and incident response leads), tactical (attacker TTPs, for architects and defenders) and technical (indicators of compromise, for the SOC and automated tools). The model comes from 2015 guidance supported by the UK's CPNI and CERT-UK.
What is the difference between tactical and operational threat intelligence?
In the four-type model, tactical intelligence describes how attackers operate in general and stays useful for months. Operational intelligence warns of a specific attack against you and is useful for hours or days. Some three-level models use "operational" for TTPs and "tactical" for indicators, so check which model a source uses.
Is a feed of IP addresses threat intelligence?
It is technical threat information. It becomes intelligence once someone adds context, such as why it matters to you and how reliable it is. CPNI notes that technical intelligence has a short usable lifespan. The SafePay advisory itself warns that IP indicators should be verified before blocking.
Is vulnerability information the same as threat intelligence?
No. A vulnerability in a product you use needs action, but CPNI does not count it as information about a threat. A specific group exploiting that vulnerability is tactical threat intelligence.
How do you measure whether threat intelligence works?
Check each product against the requirement it was meant to answer. For strategic intelligence, ask whether it was accurate, supported a decision and arrived in time. For tactical intelligence, ask whether the recommended hardening prevented or detected attacks. For technical intelligence, count the attacks it caught that other controls would have missed.
Which type of threat intelligence should a small security team focus on?
Tactical and technical intelligence tied to systems you actually run, much of it free from national CERTs and cyber agencies. Add a short strategic brief for leadership each quarter.
What is an example of strategic threat intelligence?
A three-line board brief explaining that the UK NCSC reports hacktivist groups now targeting operational technology, and recommending that planned OT segmentation work be brought forward.