What are the types of cyber threat intelligence and who uses each?

Threat intelligence comes in several forms. NIST SP 800-150 lists indicators of compromise, the tactics, techniques and procedures of attackers, suggested actions, and findings from incident analysis. Practitioners often sort these into strategic, operational and tactical intelligence by audience. Each reader needs a different form to make a different decision.

What does NIST count as threat information?

NIST SP 800-150 defines cyber threat information as any information that helps an organization identify, assess, monitor and respond to cyber threats. Its list is a good base:

• Indicators of compromise, such as addresses, domains and file hashes.
• Tactics, techniques and procedures (TTPs), meaning how an actor operates.
• Suggested actions to detect, contain or prevent attacks.
• Findings from incident analysis.

NIST notes that information may be used operationally, for example to update continuous monitoring with new indicators and configurations, and strategically, such as when shared threat information feeds planning for major changes to security architecture.

What do the common labels mean?

The three label grouping is an industry convention, not part of the NIST document, so definitions vary by author. A widely used reading:

Tactical. Fast, technical, machine readable: indicators and detection rules. Reader: the SOC and the detection engineer. Decision: what to block or alert on today. Short shelf life.

Operational. About campaigns and attacker behavior: how an actor gets in, moves and what they want. Reader: incident responders and hunters. Decision: where to look and what to harden. Medium shelf life. MITRE ATT&CK is the shared vocabulary for TTPs.

Strategic. High level trends and risks for leaders: which sectors are targeted and why, what changes in the threat mean for investment. Reader: executives and risk owners. Decision: what to fund and what to accept. Long shelf life.

Some teams add a fourth, technical, for deep malware and infrastructure analysis. Others fold it into tactical.

A constructed example of one event, three forms

A regional hospital group learns of a ransomware campaign against healthcare providers.

• Tactical: a list of domains and file hashes goes to the email gateway and endpoint tools within hours.
• Operational: a short note says the actors enter through an exposed remote access service and then move to backup servers. Responders check their remote access logs and backup server permissions.
• Strategic: a one page brief tells the board that the sector is under sustained targeting and that offline backups and a tested recovery plan have funding priority this year.

Same event, three outputs, each shaped by the reader's decision.

What goes wrong?

Sending indicators to executives, who cannot use them. Sending trend reports to the SOC, which needs something it can act on. Treating old indicators as current. Collecting without a customer.

How should the types flow through a team?

Use a simple handoff. Tactical items go straight to automated controls with an expiry date. Operational items go to a weekly hunt or detection review, where someone decides whether to build a new rule. Strategic items go into a short quarterly note for leaders. Having an owner for each flow stops intelligence from piling up unread.

How to check or apply this

1. List your intelligence consumers and the decision each one makes.
2. For each, say which form they need and how often.
3. Pick sources per form: sharing groups and advisories for tactical, incident reports for operational, sector assessments for strategic.
4. Tag every item with a type, a date and an expiry.
5. Map operational intelligence to ATT&CK and compare with your detection coverage.
6. Ask each reader twice a year whether the product helped a decision. Drop what did not.

Quick check

Sources

• NIST SP 800-150, Guide to Cyber Threat Information Sharing
• MITRE ATT&CK

Last reviewed: 18 October 2026.