Threat intelligence maturity runs from reading public advisories, through collecting and filtering sources, to linking intelligence to your own assets, and finally to using it in decisions and testing. Each level is defined by what you do with information, not how much you collect. The test: did it change something?
What is intelligence, at this level?
NIST's glossary describes threat intelligence as threat information that has been "aggregated, transformed, analyzed, interpreted, or enriched" to provide context for decisions. The model below follows that idea: raw data becomes useful when it is placed in context and acted on.
Level 1: Ad hoc
Someone reads news and vendor advisories when time allows. Items arrive by email or social media. Nothing is recorded. When an incident happens, you learn what was known only after the fact.
Self check: Can you list the three sources you rely on most? Do you know who reads them?
Move up by: choosing a short, fixed list of sources, such as your vendors' security pages and government advisories, and naming a reader with a regular slot each week. CISA's Known Exploited Vulnerabilities catalog is an easy anchor for software risk.
Level 2: Organized
Sources are chosen and logged. Items are triaged: relevant, not relevant, unsure. A simple record shows what was seen and what was done. Output reaches the right people through a channel or ticket.
Self check: Can you show last month's items and what happened to each?
Move up by: recording your technology stack and sector so relevance can be judged consistently, and adding a short weekly summary for engineering and leadership.
Level 3: Contextualized
Intelligence is matched against your assets and controls. When a campaign is reported, you can answer: do we use the targeted software, and would our controls catch the technique? Techniques are described in a shared vocabulary such as MITRE ATT&CK, which describes itself as a knowledge base of adversary tactics and techniques based on real world observations. Exploit probability data such as FIRST EPSS feeds vulnerability priority.
Self check: Pick a recent reported campaign. How long to say whether it applies to you?
Move up by: building a map of your detection and prevention coverage by technique, and connecting your asset and component inventory to the intelligence process.
Level 4: Decision driving
Intelligence informs budget, priorities and testing. Teams run exercises based on threats that match your profile. Findings from incidents flow back into what you collect. Leadership receives a short, regular view of top threats and control status. You can show decisions that changed because of intelligence.
Self check: Name three decisions in the past year that intelligence changed.
Move up by: continuing to measure value and pruning sources that never lead to action.
A constructed walkthrough
A report describes attackers abusing a popular build tool plugin. At level 1 nobody sees it. At level 2 it is logged as "maybe relevant" and forgotten. At level 3 the team checks its inventory, finds the plugin in two pipelines and removes it that day. At level 4 the team also adds a pipeline policy that blocks unreviewed plugins, schedules a rehearsal and tells leadership in the next summary.
What does not show maturity
- The number of feeds.
- A large store of indicators nobody uses.
- Dashboards without decisions behind them.
- Claims of predicting attacks.
A scope note
Safeguard does not provide threat intelligence. It works on the application and software supply chain side, where its dependency inventory helps you answer level 3 questions, such as which of your applications use a package that is reported as compromised.
Who should do what at each level?
Maturity is partly about roles. At level 1 one person reads and nobody owns the outcome. At level 2 name an owner for the weekly review, even if it is ten percent of someone's time. At level 3 bring in engineering and IT: they know the assets and can say fast whether a report applies. At level 4 add a leadership sponsor who receives the summary and asks what changed.
Avoid hiring ahead of need. A dedicated analyst makes sense once there is a steady stream of items that need judgment and a place for the output to go. Before that, a part time owner with a clear template, such as "source, why relevant, action, date," does more than a full time reader with no outlet.
Review roles yearly. A changing business, such as a new product that exposes an API, changes which threats matter and who needs to hear about them.
What to do
- Place yourself with the self check questions.
- Pick one move up action and finish it this quarter.
- Start a simple log of items seen and actions taken.
- Record your stack so relevance can be judged.
- In six months, list decisions intelligence changed.
Quick check
How do I know I am at level 3?
You can say, within hours, whether a reported campaign applies to your assets and whether your controls would catch it.
Do all companies need level 4?
No. Many do well at level 2 or 3. Move up when the decisions at stake justify the effort.
Sources
- NIST glossary: threat intelligence
- MITRE ATT&CK
- CISA Known Exploited Vulnerabilities Catalog
- FIRST EPSS
Last reviewed: 18 October 2026.
