Glossary · OT security engineering
Threat intelligence
Also known as: Cyber threat intelligence (CTI), Threat information
German: Bedrohungsinformationen
In cybersecurity, threat intelligence is evidence-based information about threat actors, their capabilities, targets, tactics, techniques and indicators of compromise, collected and analyzed to support security decisions such as prioritizing vulnerabilities, tuning detection and preparing incident response.
- Security engineering
- OT security
In one sentence
Threat intelligence is analyzed information about threat actors, their tactics and indicators of compromise that supports security decisions.
Example
A threat intelligence report on malware targeting a specific safety controller family prompts the plant to check its controllers' key switch positions and to add detection rules for the malware's network traffic.
How it applies
- Operation: Threat intelligence helps decide which vulnerabilities matter most, for example those known to be exploited in the wild, and which attack techniques detection should cover. Frameworks such as MITRE ATT&CK for ICS describe tactics and techniques against industrial systems.
- Engineering: Threat intelligence informs Security risk assessment and Threat modeling with realistic attacker profiles instead of assumptions.
- Organization: Sources include national authorities and CSIRTs, sector information sharing groups, vendors and commercial providers. Standards such as STIX and TAXII are used to exchange it in machine-readable form.
- Documentation: Threat intelligence should be traceable to its source and date, and its confidentiality marking respected when sharing. Product security teams can use it to update security guidelines when new attack techniques affect how a product should be configured.
Threat intelligence vs. security advisory
A Security advisory describes a vulnerability in a product and how to fix it. Threat intelligence describes attackers and their behavior, which may or may not involve known vulnerabilities.