The Intelligence Cycle, Types of CTI, and Priority Intelligence Requirements

CTI is not a product you buy — it is a capability you build around specific organizational intelligence needs.

The Intelligence Cycle in Practice

Most CTI programs are strongest at Collection and weakest at Direction and Feedback — they know how to subscribe to feeds but not what questions those feeds are supposed to answer.

INTELLIGENCE CYCLE DIAGNOSTIC
==============================

Direction (are we doing this?):
☐ We have documented Priority Intelligence Requirements (PIRs)
☐ PIRs are linked to specific business decisions or stakeholder questions
☐ PIRs are reviewed and updated quarterly
☐ Each collection source maps to at least one PIR

Collection (are we doing this well?):
☐ We know the reliability of each source (single-source vs. corroborated)
☐ We distinguish raw data (IP addresses) from processed feeds (attributed campaigns)
☐ We are not collecting more than we can process and analyze

Processing:
☐ Raw data is normalized before analysis (common timestamp format, IOC format)
☐ Duplicates are identified and removed before analysis
☐ Translation/technical decoding is applied before analysis begins

Analysis:
☐ We distinguish collection (what we observed) from analysis (what we assess)
☐ We use structured analytic techniques (not just "read and summarize")
☐ We calibrate and state confidence levels explicitly

Dissemination:
☐ Different audiences receive appropriately tailored formats
☐ Intelligence is delivered when decision-relevant, not just when complete
☐ Tactical intelligence reaches operational teams in hours, not days

Feedback:
☐ We collect consumer feedback on every major intelligence product
☐ We track whether our predictions were correct (calibration tracking)
☐ Feedback informs next cycle's Direction

Priority Intelligence Requirements — Writing Workshop

EXAMPLE PIR DEVELOPMENT

BUSINESS CONTEXT:
A financial services organization has experienced phishing attacks targeting their 
Microsoft 365 tenant. The CISO wants to understand the threat.

BAD PIR: "What are threat actors doing to financial organizations?"
  Problem: Too broad, not linked to a specific decision, impossible to fully answer

BAD PIR: "Tell me about phishing."
  Problem: Not a question, no decision link, no timeframe

GOOD PIR: "Are threat actor groups known to use AiTM (Adversary-in-the-Middle) 
phishing techniques currently targeting financial services organizations' M365 
tenants? If so, what specific lures, infrastructure, and initial access techniques 
are they using?"
  
  Decision relevance: "This determines whether we prioritize Conditional Access 
  policy hardening for legacy auth, deploy Microsoft Defender for Cloud Apps 
  monitoring, or accelerate phishing-resistant MFA rollout in Q4."
  
  Consumer: CISO and Security Architecture lead
  Timeline: Required by September 15 for Q4 budget planning
  Current knowledge: We have seen 3 AiTM attempts against our own users 
  (internal incident data). We do not know if this is targeted or opportunistic.

RESULTING COLLECTION TASKS:
  - Search threat intel platforms for AiTM campaigns targeting financial sector 
    (Evilginx, Modlishka, indirect proxy phishing)
  - Review FS-ISAC alerts and member bulletins for the past 90 days
  - Search OSINT for public reporting on AiTM campaigns (Mandiant, Secureworks, 
    Microsoft MSTIC)
  - Correlate internal incident IOCs against threat intel databases

Strategic vs. Operational vs. Tactical: Matching Intelligence to Decision

INTELLIGENCE LEVEL DECISION TABLE

STRATEGIC INTELLIGENCE DRIVES:
  → Annual security investment allocation
  → Cyber insurance coverage decisions
  → M&A security due diligence
  → Board-level risk communication
  → Long-term security architecture decisions
  Example product: "2025 Threat Landscape Report: Key Risks for [Industry] Organizations"

OPERATIONAL INTELLIGENCE DRIVES:
  → Quarterly detection tuning priorities
  → IR team training and tabletop scenario selection
  → Vendor and supply chain risk assessment
  → Security control coverage gap analysis
  Example product: "Q3 Active Campaigns Targeting [Industry]: Threat Brief"

TACTICAL INTELLIGENCE DRIVES:
  → SIEM rule updates (add new IOC to blocklist)
  → Firewall ACL changes (block specific IP range)
  → Vulnerability patching priority adjustments
  → EDR exclusion review (is a newly observed technique evading our EDR?)
  Example product: IOC feed, YARA rule, Sigma detection, vulnerability advisory

MISMATCH EXAMPLES (what goes wrong):
  → Giving a C-suite exec a list of 500 IPs (tactical → strategic consumer = wrong)
  → Giving a SOC analyst a 40-page threat landscape report when they need an IOC list
  → Providing a vulnerability score without exploitation context (not actionable)

Retrieval Practice

A financial services CISO asks: 'We just heard ransomware groups are targeting banks. What do I need to know?' You have 48 hours and one analyst. What PIR do you write, what sources do you task, and what does your deliverable look like?

Reveal answer

PIR: 'Are ransomware groups known to target financial services organizations currently conducting active campaigns? If so, which specific groups, what initial access vectors are they using, and what defensive controls have been most effective in documented cases?' Decision relevance: informs whether the CISO activates incident preparedness, adjusts ransomware-specific detection priorities, or escalates to the board. Consumer: CISO. Timeline: 48 hours. Collection tasks: (1) Search threat intel platforms (Recorded Future, MISP) for ransomware campaigns tagged with financial sector or banking in the past 90 days. (2) Review FS-ISAC bulletins for ransomware alerts. (3) OSINT: search Mandiant, CrowdStrike, Secureworks, Sophos recent reporting for financial sector ransomware campaigns. (4) Query internal SIEM for any indicators from known ransomware groups. Deliverable format: 2-page tactical threat brief (operational level, not strategic). Sections: (1) Bottom Line Up Front (BLUF): current ransomware threat to financial sector — 1 paragraph, confidence level. (2) Active groups and their TTPs: 3-5 bullets per relevant group, initial access focus. (3) Indicators: if any are relevant to our environment, include immediately actionable IOCs. (4) Recommended actions: 3-5 specific controls or monitoring priorities. NOT a 40-page strategic report — the CISO needs a decision-quality brief in 48 hours, not a comprehensive survey.