Threat Intelligence 101: What It Is and Why It Matters

Vendors sell threat intelligence as a feed. It works as a filter. What follows covers what it actually is, the four types and which ones a 200-person company ever touches, where it plugs into tools you already own, and the free sources you can start with this afternoon. It also covers when paying for it is a mistake.

Threat intelligence is analyzed information about attackers, their methods, and their targets, turned into decisions your security team can act on. It answers which threats are real, which ones apply to you, and what to fix first. Raw indicators aren't intelligence. Analysis makes them useful. Companies buy it as a subscription, inherit it through a security provider, or pull it free from government and community sources.

Something shifted in 2026 that should change how you think about this. For the first time in 19 years of the Verizon Data Breach Investigations Report, vulnerability exploitation passed stolen credentials as the number one way attackers get in, at 31% of breaches. Over that same stretch, the median time to patch went from 32 days to 43.

Read those two numbers together. Attackers got faster at walking through known holes. Defenders got slower at closing them. That gap is where threat intelligence earns its keep, and not by naming which nation-state crew has the cleverest logo. It earns it by telling you which of the 40 unpatched items on your list is being exploited right now.

All of it has to land somewhere, though. In practice it lands in a 24/7 security operations center, in a detection tool, or with the person who owns patching. Land it nowhere and you've bought a newsletter with a security budget attached.

What is threat intelligence?

Threat intelligence is the practice of collecting information about cyber threats, analyzing it, and turning it into guidance someone can act on. Data becomes intelligence only once analysis adds context, relevance, and a recommendation.

That distinction sounds academic until you live it. A list of 50,000 malicious IP addresses is data. Knowing that three of those addresses spent last Tuesday probing manufacturers who run the same ERP system you run is intelligence. One is a file. The other changes what your team does Monday morning.

NIST Special Publication 800-150 defines cyber threat information broadly, as anything that helps an organization identify, assess, monitor, and respond to threats. That covers indicators of compromise, which are the technical fingerprints an attack leaves behind such as a malicious IP address or a file hash. It also covers what the industry calls TTPs, meaning the tactics, techniques, and procedures a given attacker tends to reuse. Microsoft and most security vendors land in roughly the same place.

Strip the vocabulary away and intelligence answers three questions. Who is likely to come after a company built like yours, and are they after customer data, wire transfers, or the production line? How do they get in? And what should you change because of it? Answer the first two, skip the third, and you've written a research paper. Interesting reading. Not intelligence.

Why does threat intelligence matter more in 2026 than it did three years ago?

Because the window between a vulnerability going public and getting exploited keeps shrinking while patching keeps slowing down. Intelligence tells you which gap to close first when you can't close all of them. Speed is the whole story.

The 2026 DBIR analyzed more than 22,000 confirmed breaches, the largest dataset in the report's history. Exploitation of known vulnerabilities rose from 20% to 31% of initial access, a 55% jump, while credential abuse fell from 22% to 13%. Median time-to-patch climbed 34%, from 32 days to 43. Nobody planned that. It happened because the volume of published vulnerabilities outgrew the number of people available to fix them, and that math hasn't reversed in any of the last four years, or shown a sign that it plans to.

Cost moved too. IBM put the 2026 global average breach cost at $4.99 million, and $11.5 million for US organizations. One in four malicious breaches involved AI somewhere in the attack chain, and those ran about $1 million higher than average.

Now translate that for a company with 200 employees and two people in IT. You aren't going to patch everything. You never were. What intelligence does is take the 40 open items in your vulnerability management program and tell you which four are being actively exploited against companies that look like yours. Fix those four this week. The rest can wait for next quarter.

Two more numbers worth sitting with. Human error showed up in 62% of breaches, and 48% involved a third party in some capacity, a 60% increase year over year. Your vendors are part of your attack surface whether you've budgeted for that or not.

The four types, and which ones you'll actually use

Four types, split by who reads them and how fast they expire. Strategic for executives, operational for campaign context, tactical for the technical fingerprints an attack leaves behind, and technical for malware-level detail. A 200-person company consumes two directly and inherits the rest through tools it already runs.

Vendors disagree on whether there are three types or four, mostly because tactical and technical overlap. Not a fight worth having. What matters is who reads each one and how fast it goes stale.

Look at the right-hand column. Two of the four rows say the intelligence reaches you through something you already bought, not through a portal you log into. That's the normal outcome. It's also fine. The failure mode is buying a subscription that produces a type of intelligence nobody at your company has the time or the training to consume, which happens more often than the subscription price would suggest.

How intelligence actually gets made

Six phases, run as a loop rather than a line. Not a checklist. Recorded Future describes the standard model, and almost everyone else echoes it.

1. Direction. Decide what you actually need to know, based on what you're protecting.
2. Collection. Pull raw material from feeds, logs, government advisories, dark web monitoring, and your own environment.
3. Processing. Clean it up. Deduplicate, normalize the formats, drop the noise.
4. Analysis. A human decides what it means and what to do about it. This is the only phase that produces intelligence.
5. Dissemination. Get it to whoever can act on it, in a format they will read.
6. Feedback. Ask whether it helped, then adjust phase one.

Phase six is the one everybody drops. Programs die there. Not from bad data, and not from bad tooling, but from nobody in the building ever asking whether any of the reports changed a single decision in the previous six months of running the thing.

Where does threat intelligence show up in your stack?

Intelligence is an ingredient, not a product. It feeds detection rules in your logging platform, blocklists in your endpoint tools, and triage decisions in whatever team watches your alerts. You rarely touch it directly.

In a typical mid-market setup it flows into four places. A SIEM platform, which collects logs from across your environment and correlates them, uses intelligence to decide that a connection to a particular IP address is worth flagging instead of ignoring. Endpoint tools use it to block known-bad files before they run. Managed detection and response teams use it during triage to answer the question that actually matters at 2am, which is whether this alert belongs to a campaign they have seen before. And analysts inside a security operations center use it to decide what to escalate and what to close. Four places, one ingredient.

That last one deserves more space than it usually gets. Enterprises average 4,330 security alerts a day and investigate just 37% of them, according to Ponemon Institute research across 649 security practitioners in North America, which means the clear majority of what your tools flag every day is never read by a human being at all. Good intelligence doesn't add to the pile. It shrinks it. The analyst gets a defensible reason to close 20 alerts and dig into one.

What free threat intelligence can you actually use?

Quite a lot, and more of it than you'd expect. Government advisories, community feeds, and sector sharing groups cover the fundamentals at no cost. Paid intelligence buys speed, curation, and support. Not access to secrets.

Start with these.

• The CISA Known Exploited Vulnerabilities catalog. Every entry is a vulnerability confirmed to be exploited in the real world, not theoretically exploitable. Cross-reference it against your own patch backlog and you've built a prioritization model. No cost.
• CISA also runs a cyber threat information sharing program and publishes joint advisories with detailed indicators and detection guidance.
• MITRE ATT&CK. The reference catalog of how attackers behave, and probably the vocabulary your provider already uses in its reports.
• Cisco Talos and AlienVault OTX publish open feeds and advisories, though community-sourced quality varies more than the government material does.
• Your sector's information sharing group, with one catch.

One catch on that last bullet. MS-ISAC, the sharing center these lists usually name first, is limited to US state, local, tribal, and territorial government entities plus public education. Privately held manufacturer in Torrance? You're not eligible.

What you can join, if you make things, is MFG-ISAC, a nonprofit sharing community built for US manufacturers of every size, including service and maintenance providers. Members trade phishing data, malware signatures, and vulnerabilities in the operational technology that runs production equipment, and they can contribute anonymously when the details are sensitive enough that attribution would create its own problem. For a company running production equipment alongside office IT, that peer intelligence often beats a commercial feed. Threats hitting a metal finishing shop look nothing like threats hitting a bank. Same logic drives our manufacturing cybersecurity work.

When is threat intelligence a waste of money?

When you have no way to act on it. Buying a feed before you have centralized log collection, patching discipline, and one named person accountable for alerts produces more noise, more cost, and exactly no reduction in the risk you were worried about.

Commercial programs typically run $20,000 to $200,000 a year depending on scale and features. The wider market sits around $10.38 billion in 2026, with large enterprises accounting for two-thirds of it, according to Mordor Intelligence. The small and mid-sized segment is the fastest growing, at nearly 15% compound annual growth. Fast growth, not smart spend.

Skip a paid feed for now if any of these describe you.

• You have no centralized logging, so there's nothing for the indicators to match against
• Nobody is on call after 6pm
• Your patch backlog runs past 90 days and the constraint is people, not information
• You already pay a provider for managed detection, which means you'd be paying for intelligence twice

False positives are the tax you pay for getting this wrong. The 2025 SANS Detection and Response Survey found 73% of security teams naming false positives as their top detection challenge, up sharply on the prior year. Pour unfiltered indicators into an untuned platform and it gets worse. More data. Same two people. Longer queue.

Intelligence multiplies whatever capability you already have. Zero times anything is zero.

Where to start if you have no security team

Inherit it. In the 20 to 500 user range, this almost always arrives bundled into a detection service rather than bought as a standalone product, and at that size it's the right call.

Ask your current provider four questions. Which intelligence sources feed your detection rules? How often do those rules update? When CISA adds something to the exploited vulnerabilities catalog, what happens on our systems, and how fast? And can you show me one alert from the last 90 days where intelligence changed your response? That last one matters. It separates the providers who genuinely wire intelligence into their detection stack from the ones who put the word on a proposal. Vague answers are an answer. An MDR service with documented intelligence sourcing is the shortest path out.

What to take away

Three things worth keeping. Threat intelligence is analysis, not data, and the analysis is the whole value. Its job in 2026 is prioritization, because exploitation of known vulnerabilities is now the leading way in and your patch list is longer than your capacity. And the free sources, starting with the CISA exploited vulnerabilities catalog, cover more ground than most companies realize before anyone signs a contract. Start there.

Consilien is a security-first managed IT and cybersecurity provider for companies running 20 to 500 users, largely manufacturers, distributors, and professional services firms. On this particular topic, what we do differently is document where detection intelligence comes from and how fast it updates, so the answer to that fourth question is written down before a client thinks to ask it.

Trying to work out whether the detection you already pay for includes real intelligence or just the word? That's a 20-minute conversation, not a project. Speak to a SOC expert and bring your last three security reports. For the tooling side of the same question, our breakdown of EDR, MDR, and XDR compared covers what each layer actually detects.