Threat intelligence vocabulary is full of near synonyms. The mix ups that cost real money are indicator versus intelligence, feed versus platform, and vulnerability versus threat. This glossary defines each term in plain words, using NIST and MITRE definitions where they exist.
Data, information and intelligence
Cyber threat information. NIST SP 800-150 describes it as any information that can help an organization identify, assess, monitor and respond to cyber threats. It includes indicators of compromise, tactics, techniques and procedures, suggested actions and incident findings.
Cyber threat intelligence (CTI). NIST's glossary defines it as threat information that has been aggregated, transformed, analyzed, interpreted or enriched to provide the context needed for decisions. The test: could someone make a decision from it without more work? If not, it is information.
People say "intel" for both. When a vendor says "we deliver intelligence", ask which one they mean.
Indicators and behavior
Indicator of compromise (IoC). NIST describes technical artifacts or observables suggesting an attack is imminent, underway or that a compromise may already have occurred. Think file hashes, domains, IP addresses. They are specific and short lived. An address used last month may belong to someone else today.
Tactics, techniques and procedures (TTPs). NIST defines these as the behavior of an actor: a tactic is the highest level description, techniques are more detailed within a tactic, and procedures are lower level and highly detailed within a technique. Behavior lasts longer than indicators, because changing how you operate is harder than changing an address.
Indicator versus TTP. Block a hash and the attacker recompiles. Detect the behavior and you catch the next version. Mature programs use both, and weight detection toward behavior.
MITRE ATT&CK. A knowledge base of adversary behavior. MITRE's FAQ says tactics represent the "why" of a technique, the adversary's goal, while techniques represent the "how". It is a shared vocabulary, not a feed and not a score.
Formats and sharing
STIX. A language and serialization format for exchanging cyber threat intelligence. It describes the content.
Threat feed. A stream of items, usually indicators, delivered on a schedule or by API. Feeds vary widely in context and age.
Threat intelligence platform. Software that collects feeds, deduplicates, enriches and distributes them to other tools. A platform is plumbing. It does not make your feeds relevant.
Information sharing community. A group whose members exchange threat information under agreed rules. NIST SP 800-150 covers setting goals, choosing sources and scoping sharing activity.
The four levels people mention
Many sources describe strategic, operational and tactical intelligence, and some add technical. These labels are conventions rather than a single standard, so confirm what a vendor means.
Strategic usually serves executives: trends and who might target the sector. Operational describes campaigns and actor behavior. Tactical covers TTPs for defenders. Technical covers indicators.
Threat, vulnerability and risk
Vulnerability. A weakness in software or configuration.
Threat. Something with the intent and ability to exploit a weakness.
Exploited in the wild. A vulnerability with observed real world exploitation. CISA's Known Exploited Vulnerabilities catalog is a public list of these. EPSS, run through FIRST, is different: it estimates the probability of exploitation in the next 30 days, and FIRST says plainly it is not a complete risk score.
Severity versus risk. The CVSS user guide says Base scores measure severity and should not be used alone to assess risk. Risk needs threat information and environment on top.
Hunting, detection and response
Threat hunting. A human led search for activity that existing detections missed, usually starting from a hypothesis, often drawn from CTI.
Detection. Rules or models that raise alerts automatically.
Attribution. Naming who is behind activity. It is hard, often uncertain, and rarely needed to defend. Be wary of any report that treats it as settled.
What to do
- Ask vendors whether they sell information or intelligence, and for an example.
- Track indicators with an expiry date, and favor behavior based detections.
- Use ATT&CK terms when you describe detection coverage.
- Treat KEV as a list of confirmed exploitation, and EPSS as a probability.
- Use a platform only after you know which feeds matter to you.
- Write definitions into your reports so readers share one meaning.
Quick check
Is an IP address threat intelligence?
On its own it is an indicator, which is information. It becomes intelligence when someone adds context such as who uses it, for what, and how confident they are.
Is EPSS the same as the KEV catalog?
No. KEV lists vulnerabilities with observed exploitation. EPSS gives a probability estimate for every CVE.
Sources
- NIST SP 800-150
- NIST glossary: cyber threat intelligence
- NIST glossary: indicator of compromise
- NIST glossary: tactics, techniques, and procedures
- MITRE ATT&CK FAQ
- Introduction to STIX
- CISA KEV
- FIRST EPSS FAQ
- CVSS v4.0 User Guide
Last reviewed: 18 October 2026.
