What is cyber threat intelligence (CTI)?

Definition

Cyber threat intelligence (CTI) is data about current or potential attacks against an organisation that has been analysed and put into context. Raw data alone is not intelligence: an IP address, a domain or a listing on a dark web market becomes intelligence only when it answers "does this concern us, how urgent is it, and what should we do?"

Why it matters

Security teams mostly look inward: network traffic, endpoint logs, SIEM alerts. Yet an attack usually leaves traces outside long before it touches the network. A stealer on an employee's personal laptop harvests the corporate VPN password and the log goes on sale. A look-alike domain is registered and a phishing page goes live a few days later. A forgotten test server stays exposed to the internet.

Threat intelligence aims to catch these external traces before they become an incident: resetting leaked credentials before they are used, spotting fake domains the day they go live, surfacing forgotten assets and knowing the TTPs of ransomware groups targeting your sector.

The four types of threat intelligence

Strategic

Written for leadership and the CISO: sector trends, geopolitical developments and shifts in the ransomware ecosystem that inform long-term risk decisions.

Tactical

Describes attacker tactics, techniques and procedures (TTPs), mapped to MITRE ATT&CK, to prioritise detections and defences.

Operational

Details about a specific campaign or threat actor — targets, infrastructure, timing — used in incident response and threat hunting.

Technical

Indicators of compromise (IOCs) such as malicious IPs, domains, hashes and URLs, fed straight into firewalls, proxies and the SIEM.

Sources

• OSINT: certificate transparency, DNS data, code repositories, social media.
• Dark and deep web: underground forums, leak sites, ransomware blogs, Telegram channels.
• Stealer logs: browser passwords, session cookies and device data harvested by infostealers.
• Threat feeds: commercial and community IOC lists.
• External scanning: continuous discovery of your domains, IP ranges, services and certificates.

The intelligence lifecycle

1. Requirements — what you need to protect.
2. Collection — pulling relevant data continuously.
3. Processing — deduplication, normalisation, enrichment.
4. Analysis — relevance, reliability and impact.
5. Dissemination — cases, alerts, SIEM events, executive summaries.
6. Feedback — refining requirements based on outcomes.

What to look for in a CTI platform

• Findings specific to your domains, brands and people — not generic news.
• Transparent sources and confidence levels.
• Case management with an owner and a closing reason for every finding.
• Concrete next steps such as takedown requests and password reset flows.
• Integrations with SIEM, SOAR, ticketing and messaging, plus a REST API.
• Clear data residency and tenant separation.

How InsightGuard approaches CTI

InsightGuard is a cyber threat intelligence platform built by LastGuard in Türkiye. It works entirely from the outside, with no agents on your network, and brings dark web and stealer log monitoring, look-alike domain and phishing detection, brand and VIP protection, attack surface management and a threat feed into a single command screen. Every finding becomes a case with an owner, a severity and a recommended action.