The threat intelligence lifecycle is a repeating loop with six common stages: direction, collection, processing, analysis, dissemination and feedback. It turns raw data into decisions for a specific audience. The loop matters because most failures happen at its edges: unclear questions at the start and no feedback at the end.
Why a lifecycle at all?
NIST SP 800-150 defines cyber threat information as anything that helps an organization identify, assess, monitor and respond to threats, including indicators of compromise, adversary tactics and techniques, suggested actions, and findings from incident analysis. A feed of that material is not intelligence on its own. It becomes intelligence when someone has asked a question and an analyst has answered it for a reader.
Naming the stages keeps a small team honest about which one it is skipping.
What happens at each stage?
1. Direction. Decide what the consumers need to know. A good requirement is a question: which ransomware groups target regional hospitals, and which of their entry methods apply to us? NIST 800-150 starts sharing work the same way, with goals and scope before sources.
2. Collection. Gather from internal sources such as logs and incident notes, and external ones such as government advisories, sector sharing groups and open reports. Your own telemetry is often the most relevant and the most neglected.
3. Processing. Normalize and filter. Deduplicate indicators, strip expired ones, and put data in a common format. STIX and TAXII, maintained by OASIS, are the usual formats for structured exchange.
4. Analysis. Add judgment. What does this mean for us, how confident are we, and what are the alternatives? State confidence openly. Analysis is where a pile of facts becomes a claim someone can act on.
5. Dissemination. Deliver it in a form the reader can use, at the right time, with handling rules attached. The FIRST Traffic Light Protocol uses four labels, TLP:RED, TLP:AMBER, TLP:GREEN and TLP:CLEAR, to tell recipients how far they may share.
6. Feedback. Ask consumers whether it helped. Update the requirements. Close the loop, or the next cycle repeats the last one's mistakes.
A constructed example
A security lead at a mid-size hospital asks one question: how are attackers getting into organizations like ours this quarter? The team's requirement is written down. Collection pulls the last six months of internal phishing reports, a government advisory on ransomware, and a sector sharing group digest. Processing removes stale indicators. Analysis concludes that stolen remote access credentials are the likeliest entry for them, with moderate confidence. The report to IT is one page, marked TLP:AMBER, and asks for MFA on remote access. Feedback from IT notes that two legacy systems cannot support it, so the next cycle's question becomes how to protect those.
Where do teams go wrong?
Collecting before asking is the usual error. The second is stopping at processing: indicators are blocked, but nobody explains why they matter. The third is no audience: a report written for everyone is read by no one.
How big should the output be?
Smaller than most teams assume. A reader with ten minutes wants the conclusion, the confidence, the action and the deadline. Put the evidence in an appendix for those who want it. If a product cannot be summarized in four sentences, the analysis is probably not finished yet.
How to check or apply this
- Write three intelligence requirements as questions, each with a named consumer.
- List your collection sources and mark which are internal. Add at least one internal source if you have none.
- Set an expiry rule for indicators so stale data does not clog blocklists.
- Require each analytic product to state a confidence level and what would change it.
- Add TLP labels to everything you share, and agree on what each means in your team.
- Schedule a short feedback check with each consumer every quarter.
Quick check
Is a threat feed the same as threat intelligence?
No. A feed is collected and processed data. Intelligence adds analysis against a specific question and delivery to a specific reader.
Does a small team need all six stages?
Yes, but lightly. A one-page question, a short source list and a monthly note to your own IT team still count.
Sources
- NIST SP 800-150, Guide to Cyber Threat Information Sharing
- FIRST Traffic Light Protocol, version 2.0
- OASIS Cyber Threat Intelligence Technical Committee
Last reviewed: 18 October 2026.
