A Guide to Threat Intelligence for Businesses: Types, Cycle and Metrics
Threat intelligence became a budget line before it became a practice. The Cost of a Data Breach 2025 report, from IBM and the Ponemon Institute, put the average cost of a data breach in Brazil at R$ 7.19 million — 6.5% above the R$ 6.75 million recorded in 2024. In the same study, adopting threat intelligence tops the list of factors that pulled that cost down: R$ 655,110 less per breach, on average.
The trouble is that “having threat intelligence” and “subscribing to a feed” have become synonyms in the market. They are different things, and the difference is exactly what separates a programme that changes decisions from one that produces PDFs.
This guide is for anyone who has to build, fix or justify a threat intelligence programme: what it is and what it is not, the four types, the six phases of the cycle, how it differs from SIEM and antivirus, the mistakes that hollow out the operation, how to measure the result, and what changes when you operate in Brazil.
What threat intelligence is
Cyber threat intelligence (CTI) is the process of turning raw data about adversaries into a product that answers a question asked by someone who decides, with a stated confidence assessment, inside the window in which the decision can still be made.
Note that the definition carries three requirements, and all three are testable:
- It answers a question somebody asked. Intelligence does not start with collection; it starts with the requirement.
- It arrives before the decision. Correct analysis delivered after the patch is applied is history, not intelligence.
- It changes something. A block, a remediation priority, a contract clause, an investment, a customer notification.
If you cannot point to the decision a deliverable changed, what you have is content — possibly good content, but not intelligence.
What threat intelligence is not
- An IOC feed. A list of malicious IPs, hashes and domains is raw material. It becomes intelligence when somebody assesses its relevance to your environment, its context and its shelf life.
- A security newsletter. News about a vulnerability in a product you do not run is not intelligence for you.
- The output of a vulnerability scanner. That is internal posture. A threat is what exists on the outside, with intent and capability.
- Dark web monitoring without a requirement. If you have not defined what you are looking for and what you will do when you find it, the result is a good-looking dashboard and nobody accountable.
- Attribution. Knowing the group is called X rarely changes what your team does on Monday morning.
The four types of threat intelligence
| Type | Who consumes it | Shelf life |
|---|---|---|
| Strategic | Board, CISO | Months to years |
| Operational | SOC leadership, incident response | Weeks to months |
| Tactical | Detection and threat hunting | Months to years |
| Technical | Automation, blocking | Hours to days |
The boundary between “tactical” and “operational” is the most disputed line in the literature, and arguing about the label is wasted effort. What matters is knowing, for every product you generate, who consumes it and how long the data stays valid.
Strategic
Answers questions about investment and risk: what is our sector’s exposure to ransomware over the next twelve months? Does opening operations in that country change our threat profile? Should the security budget go to identity or to external attack surface?
Format: a short report, in business language, free of jargon. Quarterly or annual cadence. It is the only type that has to be readable by people who are not technical.
Operational
Answers “who, when and why”: campaigns under way, motivation, target sectors, seasonality. A Black Friday-themed phishing campaign aimed at Brazilian retail is operational intelligence.
Format: a campaign alert with context and a recommendation. Consumed within days or weeks.
Tactical
Describes the adversary’s tactics, techniques and procedures (TTPs) — how they get in, how they move, how they persist, how they exfiltrate. It is the raw input for the detection team and for threat hunting, and the natural place to map everything against MITRE ATT&CK.
It offers the best ratio of effort to durability: changing a technique is expensive for the adversary; changing a domain is not.
Technical
Indicators of compromise: IPs, file hashes, command-and-control domains, phishing URLs, certificates. Useful for automation and blocking, and it ages fast — sometimes within hours.
This is where the Pyramid of Pain, from David J. Bianco (2013), is worth remembering: at the base sit hashes, which the adversary swaps in seconds; at the top sit TTPs, which they change only with pain. A programme that consumes nothing but the base of the pyramid spends a lot and hurts very little.
The intelligence cycle: six phases
The cycle is inherited from intelligence doctrine — the U.S. Department of Defense’s Joint Publication 2-0 describes the same process in six steps. It works in cybersecurity for the same reason it works there: it forces you to start with the question and to finish with the critique.
1. Direction
This is where you write the PIRs (priority intelligence requirements) — the priority questions the programme exists to answer. It is the most frequently skipped phase, and the one that best explains failed programmes.
A bad PIR: “I want to know about ransomware.”
A usable PIR: “In the last 90 days, has any ransomware group actively exploited one of the five technologies exposed at our perimeter? Owner: vulnerability manager. Decision attached: priority for this month’s maintenance window.”
A PIR works if it has an owner, a deadline, a decision hanging on it, and can be answered with the sources you actually have.
2. Collection
External sources: OSINT, commercial and open feeds, closed forums and marketplaces, messaging channels, sector sharing communities, vendor reports.
Internal sources: your own logs, past incidents, fraud tickets, endpoint telemetry, phishing reported by employees. This is the single most relevant source for your environment, and the most ignored. Whoever has already attacked you is the best predictor of who will attack you next.
3. Processing
Normalization, deduplication, translation, enrichment and format standardization (STIX, MISP). Without this step the analyst becomes a data janitor and the programme does not scale.
4. Analysis
The one phase you cannot outsource. This is where somebody assesses relevance, correlates against the environment, forms hypotheses and states confidence. Use a standard scale — the Admiralty Code (source reliability from A to F, information credibility from 1 to 6) is the easiest to adopt and already removes much of the ambiguity.
Analysis without a stated confidence level forces the reader to guess whether you are right, and readers who guess stop reading.
5. Dissemination
The same finding becomes three different products depending on the audience: one page for the board, a detection rule for the SOC, a timeline for the response team. Sending the 40-page report to all three is the same as sending it to none of them.
6. Feedback
The phase almost nobody executes. Ask every consumer: did you use it? what did you decide? what was missing? what was superfluous? Without this the PIRs never improve, and the cycle becomes a straight line that ends in a dead archive.
Threat intelligence is not SIEM and is not antivirus
| Layer | Question it answers | Where it fails on its own |
|---|---|---|
| Antivirus / EDR | Is this malicious on this machine? | Does not know who is attacking you, or why |
| SIEM / detection | Did something anomalous happen in my logs? | Only sees what is already inside |
| Threat intelligence | Who is likely to attack me, with what, and what do I do first? | Does not act; it needs the other two |
The confusion is common because all three consume indicators. The difference is the vantage point: EDR looks inside the host, SIEM looks inside the network, CTI looks outside the organization.
And the relationship is one of feeding, not of replacement. The technical indicator flows down into the SIEM and the EDR. The TTP becomes a detection rule and a hunting hypothesis. Strategic analysis becomes budget. An intelligence programme with no exit path into the detection tooling is a reading programme.
Five mistakes that hollow out a CTI programme
1. Buying an IOC feed and calling it intelligence. Volume is not quality. Before signing up to any feed, ask: where does the indicator come from, what is the measured false positive rate, what is the average shelf life, does it cover Portuguese-language sources, and does it deliver in a format your stack ingests without manual work?
2. Collecting without a PIR. Collection without a requirement produces volume, and volume produces the feeling of work being done. It is the mistake that burns the most budget for the least effect.
3. Chasing attribution. A group name is interesting and almost never actionable. A TTP is actionable almost always.
4. Ignoring internal sources. Plenty of companies pay handsomely for external intelligence and have never read their own incident history.
5. Not closing the loop. A report nobody reads is pure cost. If the consumer is never asked, the producer never finds out they are missing the target.
How to tell whether the programme is working
There are two families of metric, and one of them lies to you.
Avoid production metrics: number of reports published, number of IOCs ingested, number of feeds subscribed. All of them go up when you work harder, and none of them go up when you get things right more often.
Prefer effect metrics:
- PIR coverage — the share of live requirements with an up-to-date answer delivered on time.
- Time to operationalize — hours between the arrival of a relevant indicator and the block or rule reaching production.
- Intelligence-originated detections — how many of the quarter’s detections exist because CTI spotted it first.
- Source precision — the share of indicators that produced a useful alert, measured per feed. A feed that only generates noise should be cancelled with the number in hand.
- Decisions influenced — a named record of decisions (remediation prioritized, supplier reassessed, project deferred) that cite an intelligence product.
- ATT&CK coverage — which techniques in your threat model you detect today, compared with the previous quarter.
- Consumption — who opened it, who answered the feedback request. Low readership is a sign of the wrong product, not of an inattentive reader.
Pick three to five, measure them quarterly, and publish them alongside what you were unable to measure. A metric without a caveat is internal marketing.
The Brazilian context: what changes here
The legal clock runs for three business days
Article 48 of the LGPD (Law 13,709/2018) — Brazil’s data protection statute — requires the controller to report any incident that may create relevant risk or harm to data subjects. ANPD Board Resolution No. 15/2024 nailed down the deadlines:
- Three business days to notify the ANPD, Brazil’s data protection authority (Article 6), and the data subject (Article 9), counted from the moment the controller learns that the incident affected personal data.
- Twenty business days to complete the information with a reasoned filing (Article 6, §3).
- Double the deadlines for small-scale processing agents (Article 6, §8, and Article 9, §6).
- Article 5 lists the criteria for relevant risk: sensitive data, data of children, adolescents or the elderly, financial data, system authentication data, data protected by legal or professional secrecy, or data at large scale.
- Article 10 requires keeping a record of every incident — including the ones that were not reported — for at least five years.
The practical consequence for intelligence is direct: finding out early has legal value, not just technical value. A credential leak identified through external monitoring before the attacker makes contact changes who controls the clock. And the notification required by Article 6, §2 asks for exactly what a mature programme already produces — the nature and category of the data affected, the risks, the possible impacts and the measures taken.
The financial sector has rules of its own
CMN Resolution No. 4,893/2021 requires a cybersecurity policy and an incident response and action plan from financial institutions and others authorized to operate by Brazil’s Central Bank. Payment institutions, brokerages and consortium administrators fall outside it and follow their own Central Bank rules — worth checking which one applies before designing the process.
The attack vectors measured here
Still from IBM’s 2025 figures for Brazil: phishing was the most common initial vector at 18% of breaches (average cost R$ 7.18 million); third-party compromise came in at 15% — and was the most expensive at R$ 8.98 million; vulnerability exploitation at 13% (R$ 7.61 million). By sector, healthcare led with R$ 11.43 million, followed by finance (R$ 8.92 million) and services (R$ 8.51 million).
Two of the top three vectors sit outside your perimeter: the brand used to deceive your customer, and the compromised supplier with access to your environment. Neither shows up in your SIEM before the damage is done. Both show up in external collection.
Language is a coverage barrier
International feeds are anglophone by default. A phishing kit written in Portuguese, a messaging channel selling a database of Brazilian tax IDs, an advertisement offering access to one specific Brazilian company: none of that arrives translated, and much of it never arrives at all. Portuguese-language coverage is not a regional preference — it is a collection requirement for anyone operating in Brazil.
A minimum programme in 90 days
- Days 1–30. Write three to five PIRs, each with an owner and an attached decision. Inventory your exposed assets: domains, brands, IP ranges, apps, critical suppliers. Decide who the three consumers of the intelligence are.
- Days 31–60. Switch on the minimum collection that answers those PIRs. Create a dissemination channel per consumer, each with its own format. Open the exit route into SIEM and EDR.
- Days 61–90. Measure three effect metrics. Hold the feedback meeting with every consumer. Cut whatever nobody read.
A small programme that closes the loop delivers more than a large one that only collects.
Where the OODA Intelligence platform fits
The platform has 41 modules, and the useful way to look at them is through the phases of the cycle, not through the catalogue:
- Collection: Collection (messaging channels, clearnet and darknet forums, feeds), Threat Monitoring (keyword monitors with multi-channel alerting), EASM and Recon for the external attack surface.
- Collection aimed at brand, infrastructure and exposure: Threat Intelligence, with sub-modules for domain, network, phishing and brand abuse, and Data Leak Detection for credentials and exposed databases.
- Processing and analysis: Search Intelligence for unified search across whatever has been collected, and Investigate for investigations with a forensic trail.
- Dissemination: SIEM Bridge, MISP Sync, Intelligence Reports and the REST API.
- Record-keeping and feedback: Incident Management and Audit & Compliance — the latter tied directly to the record-keeping obligations imposed by ANPD Resolution No. 15/2024, a subject we cover in detail in the article on the LGPD and cybersecurity.
There is also a dedicated line of press collection and fact-checking — 76 registered press sources feed News Intelligence, and Disinfo Verify cross-references claims against an archive of fact-checks published by fact-checking organizations. It is the layer that answers reputational risk and disinformation aimed at the brand.
One honest caveat to close on: no tool writes your PIR or decides what is relevant to your business. A platform shortens collection, processing and dissemination, which is where the manual labour sits. Direction and analysis remain human work — and that is exactly why the cycle, and not the module catalogue, should organize your programme.
Sources
- IBM and Ponemon Institute. Cost of a Data Breach Report 2025 — Brazil figures, IBM Newsroom, 30 July 2025.
- Brazil. Law No. 13,709/2018 (LGPD), Article 48.
- ANPD. Board Resolution No. 15, of 24 April 2024 — Security Incident Notification Regulation. See also the official incident notification page.
- CMN. Resolution No. 4,893, of 26 February 2021.
- BIANCO, David J. The Pyramid of Pain, 2013.
- MITRE ATT&CK.
- U.S. Department of Defense. Joint Publication 2-0, Joint Intelligence — the six-step intelligence process.
