How threat intelligence is collected and used
Threat intelligence is collected from multiple source categories: open-source intelligence (OSINT) — publicly available information from news, social media, academic publications, and government releases; human intelligence (HUMINT) — information from individuals with relevant knowledge or access; technical intelligence — information derived from technical collection methods; and third-party intelligence reports from specialist providers and government agencies.
For corporate and personal security purposes, the most practically useful threat intelligence typically comes from OSINT and specialist provider reporting. Open-source monitoring of threat actor communications, tracking of geopolitical developments relevant to the organisation's operating environments, and monitoring of specific individuals or groups that have indicated targeting interest provides the foundation of an intelligence-driven security posture.
Actionable threat intelligence answers specific questions: Is there specific intelligence that our premises are being surveilled? Are there indications that a particular individual is being targeted? Has a threat actor group indicated interest in organisations in our sector? These answers drive proportionate decisions — sweep the boardroom, increase the CPO team for this trip, adjust the travel advisory for this destination.