Ransomware appeared in 44 percent of the breaches Verizon investigated for its 2025 report. Read that number as a board member and it is a budget argument. Read it as a firewall and it is worthless, because a firewall cannot block a statistic. Everyone else in a security team sits somewhere between those two poles.
That gap is the whole reason threat intelligence comes in types. The same threat has to be cut and repackaged for readers who could not be more different: an executive deciding where next year's money goes, a SOC lead tracking a live campaign, a detection engineer writing a rule, and an automated tool that only understands hashes and IP addresses.
This guide walks through the four types of threat intelligence: strategic, operational, tactical, and technical. For each one you get a plain definition, who actually reads it, how long it stays useful, a real 2025 example, and an honest note on where the labels get muddy. And they do get muddy, which most explainers quietly skip.
What "Types of Threat Intelligence" Actually Means
Threat intelligence is evidence-based knowledge about adversaries, their capabilities, their infrastructure, and their intent, produced so that someone can make a better security decision. If you want the full picture of the discipline before going deeper, start with our guide to what cyber threat intelligence is. The word that matters in that definition is decision. Data that informs no decision is not intelligence, no matter how much of it you have.
The four types are not four different datasets. They are the same body of knowledge pitched at four altitudes, sorted by three things: who reads it, how far ahead it looks, and how directly you can act on it. Here is the one-line version of each.
Strategic intelligence informs leadership decisions about risk and investment. Operational intelligence tracks specific threat actors and their campaigns. Tactical intelligence describes the techniques and behavior attackers use. Technical intelligence is the atomic indicators, the hashes, domains, and IP addresses, that security tools consume directly.
Hold onto the altitude idea. Strategic sits highest and looks furthest out. Technical sits at ground level and acts right now. Operational and tactical fill the middle, and the middle is exactly where the naming arguments start.
A Quick Word on Why the Count Is Messy
Ask three vendors how many types of threat intelligence there are and you will get at least two answers.
CrowdStrike describes three types: strategic, operational, and tactical, and treats them as a maturity curve. Plenty of others, us included, split out a fourth, technical, because the raw indicators a tool ingests behave so differently from the human-readable techniques that lumping them together hides something useful. Neither camp is wrong. The four-type model just draws one more line.
It gets stranger. Some vendors swap the definitions entirely. Palo Alto Networks, for example, calls the IOC-level feed "tactical" and the real-time monitoring layer "operational", which is the reverse of how CrowdStrike and most incident responders use the words. So when you read that "tactical intelligence is a list of malicious IPs," check which model the author is using before you argue with them.
Treat the four types as a lens, not a law. The value is in the questions they force you to ask, who is this for, how long will it hold, can they act on it, not in the labels themselves. This article uses the most common analyst convention: tactical means behavior and techniques, technical means atomic indicators. With that settled, let us take them one at a time.
The same threat landscape, seen at four altitudes. Note the lifespan column, which is where most programs go wrong.
Strategic Threat Intelligence
Strategic intelligence answers the question a CISO carries into a board meeting: where is our risk going, and where should we spend to get ahead of it?
The audience is leadership. Executives, the board, risk committees, sometimes the general counsel. The time horizon is long, months to years. And the content is almost entirely free of technical detail. Nobody in a board meeting wants a file hash. They want to know whether the company is exposed to a trend that is genuinely growing, and what it would cost to do something about it.
A concrete example. Verizon's 2025 Data Breach Investigations Report found that the share of breaches involving a third party doubled, from 15 percent to 30 percent. That single finding is strategic intelligence in its purest form. It does not tell anyone what to block. It tells a CISO that supply-chain and vendor risk is not a hypothetical worry anymore, it is a measured and accelerating one, and it hands them the evidence to justify a vendor-risk-monitoring budget to people who control the money. The same report noted espionage-motivated breaches rose sharply year over year, another data point a defense contractor's leadership needs long before any specific attack lands.
Strategic intelligence is built from things that look nothing like a malware sample: geopolitical analysis, sector breach trends, regulatory shifts, mergers and acquisitions activity that changes a company's attack surface. It is the type most often outsourced to reports and briefings, and the type most often ignored by technical teams because it is not "actionable" in the SOC sense. That is a mistake. It is fully actionable, just at the altitude of strategy rather than the altitude of a detection rule. What drives which strategic questions matter to your specific organization is a separate discipline worth understanding on its own: priority intelligence requirements.
Operational Threat Intelligence
Operational intelligence answers a sharper, nearer question: who is coming for organizations like ours right now, and how do they work?
The audience is SOC managers, threat hunters, and incident response leads. The time horizon is medium, weeks to months, roughly the lifespan of an active campaign. Where strategic intelligence describes trends, operational intelligence describes actors: specific groups, their motivations, their targeting patterns, and the shape of their campaigns.
Scattered Spider's 2025 activity is a near-perfect case study. Through the year the group ran a sector-by-sector sweep. UK retail first, where the attack on Marks and Spencer alone cost the retailer an estimated 300 million pounds in lost profit and hammered its share price, then US retail, then a wave against insurers including Aflac, then aviation, with confirmed incidents at Hawaiian Airlines, WestJet, and Qantas. Google's threat intelligence team tracks the same cluster as UNC3944, which overlaps with the names Octo Tempest and 0ktapus, a naming tangle we cover in our piece on how threat actors get their names.
Here is why that is operational intelligence and not just news. The group's defining pattern is that it hits several companies in one industry before moving on, and its initial access is overwhelmingly help-desk voice phishing rather than a software exploit. If you run security at an insurer and you know a group is sweeping your sector using help-desk impersonation, you do something with that this week. You brief your service desk, you tighten identity-verification steps before any password or MFA reset, you hunt for the reconnaissance that precedes their intrusions. Operational intelligence turns "a scary group exists" into "prepare this specific control before they call."
Much of this intelligence is collected by watching adversaries where they operate: underground forums, leak sites, Telegram channels, the places actors advertise access and coordinate. Doing that safely, without touching live criminal infrastructure or burning your own operational security, is a skill in itself. It is exactly what CTI Academy's NullBase, a simulated underground environment, exists to train, so analysts can practice HUMINT and channel monitoring against a realistic forum instead of learning on a real one.
There is a downstream thread here worth pulling. Verizon's 2025 report put credential abuse at 22 percent of initial access, the single most common method, much of it fed by infostealer malware harvesting corporate logins. Operational intelligence increasingly means tracking that pipeline, from the stealer log where a credential first appears to the ransomware affiliate who buys it days later. Working with that kind of breach and stealer-log data as an analyst would is the domain of tools like LeakLens.
Tactical Threat Intelligence
Tactical intelligence answers the "how" at the level of behavior: what techniques does this adversary actually use once they are inside, and how do we detect them?
The audience is detection engineers, threat hunters, and security architects. The time horizon is longer than most people expect, often months, because behavior is expensive for an attacker to change. The common language for this layer is MITRE ATT&CK, which gives every technique a shared name and ID so teams can talk about "credential dumping from ntds.dit" without ambiguity.
Back to Scattered Spider, one altitude lower. Beyond "they use social engineering," CrowdStrike's incident responders documented the group's hands-on-keyboard techniques in detail: extensive Active Directory reconnaissance with tools like ADExplorer and scripts such as ADRecon.ps1 and Get-ADUser, dumping the Active Directory database to grab ntds.dit, and standing up unmanaged virtual machines inside compromised VMware vCenter environments to run without endpoint visibility. Those are tactical intelligence. Each one is a behavior you can hunt for and write a detection around, and crucially, each one survives a change of infrastructure. The group can burn every server it owns overnight; it cannot as easily stop dumping ntds.dit, because that behavior is baked into how it achieves its goals.
That durability is the whole argument for investing here. This is also where the difference between an IOC and a TTP stops being academic. A tactical detection built on behavior keeps working across campaigns. A technical detection built on a hash breaks the moment the attacker recompiles. Which brings us to the final and most perishable type.
The consuming side of tactical intelligence, sitting at a console and deciding whether an alert about suspicious AD enumeration is a hunt lead or noise, is a muscle you build by doing it. CTI Academy's SOC Simulator puts learners on the receiving end of exactly those alerts, which is where tactical intelligence either turns into a caught intrusion or gets missed.
Technical Threat Intelligence
Technical intelligence is the most granular layer: the atomic indicators of compromise. Malicious IP addresses, domains, URLs, file hashes, command-and-control servers. The digital fingerprints an attack leaves behind.
The "audience" here is often not a human at all. It is a firewall, a SIEM correlation rule, an EDR blocklist. Technical intelligence is the type most suited to automation, because a machine can ingest a hash and act on it with no analyst in the loop. Where a human does consume it, it is usually a tier-1 analyst enriching an alert or running a retroactive hunt against a fresh indicator list. The time horizon is short. Hours to days, sometimes less.
That short shelf life is the defining property of this layer, and the reason it needs a caveat. David Bianco's Pyramid of Pain, a model from 2013 that has aged remarkably well, ranks indicators by how much it hurts an attacker when you deny them. Hashes sit at the very bottom, because flipping a single bit of a file, or changing one character in a comment, produces an entirely new hash and sails past your blocklist. IP addresses and domains sit just above, still cheap to rotate; adversaries keep large pools of infrastructure precisely so they can burn and replace it. Indicators expire. Behavior, up at the top of the pyramid, is the one thing on the list that does not, which is exactly why the tactical layer outlasts the technical one.
One actor, three altitudes. Scattered Spider's campaign pattern, its ntds.dit and ADRecon techniques, and its C2 indicators are the same intrusion described at three different heights.
So a word of honesty about feeds. A threat feed with two million indicators in it is not a threat intelligence program. It is a very large list with a subscription attached, and most of the entries in it were stale before they reached you. Technical intelligence is genuinely valuable, it powers real-time blocking at a scale no human could match, but only when it is curated, current, and tied back to the campaigns it came from. Volume is not the metric. Relevance and freshness are.
How the Four Types Fit Together
The types are not a ranking, and they are not a ladder you climb and leave behind. They are one intelligence process viewed from four heights, and a single intrusion feeds all four at once.
Take one Scattered Spider incident and watch it split. Leadership gets strategic intelligence: identity-based attacks against our sector are rising, and our vendor and help-desk exposure needs investment. The SOC lead gets operational intelligence: this specific group is sweeping companies like ours, using help-desk vishing, and we are plausibly next. The detection team gets tactical intelligence: watch for ADRecon activity and ntds.dit access, here are the ATT&CK techniques to cover. And the SIEM gets technical intelligence: block these C2 domains and hashes now. Same event. Four products. Four readers.
Same incident. Four products. Four readers.
Good intelligence flows in both directions across those altitudes. Technical indicators pulled from an incident roll up into tactical patterns once you notice the same behavior behind different infrastructure. Tactical patterns roll up into an operational picture of an actor. That operational picture, aggregated across many actors, becomes the strategic trend a CISO reports upward. And it flows back down: strategic priorities decide what you bother collecting at the bottom, so you are not drowning in indicators nobody asked for. This circulation is the threat intelligence lifecycle in motion, and it is why mature teams do not pick one type. They produce all four from the same raw material.
The dwell-time numbers show why the whole stack matters. Mandiant's median time between an attacker's first foothold and detection has fallen from over 200 days a decade ago to 11 days in its 2025 report, and its 2026 report put the 2025 figure at 14 days, with voice phishing now the second most common initial access vector behind exploits. Two weeks is not much room. Closing it means strategic intelligence told you where to look, operational intelligence told you who was looking back, tactical intelligence gave you the behavior to catch, and technical intelligence let a machine block the obvious the instant it appeared. Miss any one altitude and the gap widens.
Common Mistakes When Using the Four Types
A few errors show up again and again, in teams of every size.
Buying a feed and calling it a program. Technical indicators are the easiest type to purchase and the least valuable in isolation. A subscription is a start, not a strategy.
Confusing more indicators with more intelligence. Ten thousand fresh, relevant, contextualized indicators beat two million stale ones. Volume flatters vendors and buries analysts.
Sending technical detail up the chain. Put a hash in front of a board and you have wasted everyone's time. Strategic readers need risk and money, not artifacts. Matching the type to the audience is most of the job.
Dismissing strategic intelligence because it is not "actionable." It is actionable, at the altitude of budget and priority. The teams that skip it end up perfectly instrumented to detect last year's threat.
Treating the types as a maturity ladder. You do not graduate from technical to strategic. A working program produces all four simultaneously, from the same intrusions, for different readers. If your "threat intelligence" is only ever one type, you have a feed or a newsletter, not a program.
From the Four Labels to Actual Judgment
Learning the four labels takes an afternoon. Knowing which one a given stakeholder actually needs, and being able to pull all four out of one messy, half-attributed intrusion, takes reps. That is the gap between reading about threat intelligence and doing it.
The analysts who close that gap are the ones who have practiced the whole flow: watched an actor in a realistic underground environment, worked real breach data, sat on the receiving end of the alerts their own tactical intelligence generates, and written the strategic summary a non-technical reader can act on. CTI Academy's Hunter track is built around exactly that progression, from fundamentals in Hunter I to advanced tradecraft in Hunter IV, so the four types stop being definitions to memorize and become products you can produce on demand.
Frequently Asked Questions
What are the four types of threat intelligence?
The four types of threat intelligence are strategic, operational, tactical, and technical. Strategic intelligence informs leadership decisions about long-term risk and investment. Operational intelligence tracks specific threat actors and their campaigns. Tactical intelligence describes the techniques and behavior attackers use, and technical intelligence is the atomic indicators, such as hashes, domains, and IP addresses, that security tools consume directly.
What is the difference between tactical and technical threat intelligence?
Tactical intelligence describes attacker behavior, the techniques and procedures a group uses once inside a network, usually mapped to MITRE ATT&CK. Technical intelligence is the raw indicators of compromise, like file hashes and malicious IPs, that tools block automatically. The key difference is durability: behavior is expensive for an attacker to change and stays useful for months, while indicators can be rotated in hours. Note that some vendors swap these two labels, so always check which model an author is using.
What is the difference between operational and strategic threat intelligence?
Strategic intelligence is high-level and looks months to years ahead, telling leadership where risk is growing and where to invest. Operational intelligence is more immediate, tracking specific active threat actors and campaigns over weeks to months so security teams can prepare defenses against a group likely to target them. Strategic is about trends and money, operational is about actors and campaigns.
Who uses each type of threat intelligence?
Strategic intelligence is consumed by executives, the board, and risk committees. Operational intelligence is used by SOC managers, threat hunters, and incident response leads. Tactical intelligence goes to detection engineers and security architects who build detections. Technical intelligence is consumed mostly by automated tools such as firewalls, SIEMs, and EDR platforms, and by tier-1 analysts enriching alerts.
Are there three or four types of threat intelligence?
Both models are common and neither is wrong. Some vendors, including CrowdStrike, describe three types: strategic, operational, and tactical. Others split out a fourth type, technical, to separate the raw atomic indicators that tools ingest from the human-readable techniques that analysts hunt with. The four-type model simply draws one additional line at the most granular level.
Which type of threat intelligence is most actionable?
It depends on who is acting. Technical intelligence is the most immediately actionable for machines, because a tool can block a malicious hash or domain instantly. Tactical intelligence is the most actionable for detection teams. Strategic intelligence is fully actionable for leadership, just at the level of budget and priority rather than a firewall rule. There is no single "most actionable" type, only the right type for the reader.
How long does each type of threat intelligence stay useful?
Useful lifespan increases as you move up the altitudes. Technical indicators like hashes and IPs can go stale within hours or days because attackers rotate them cheaply. Tactical intelligence about behavior lasts months, since techniques are costly to change. Operational intelligence tracks campaigns over weeks to months, and strategic intelligence about trends and risk stays relevant for months to years.
Sources
- Verizon 2025 Data Breach Investigations Report, Verizon Business
- M-Trends 2025, Mandiant / Google Cloud
- M-Trends 2026 coverage: faster attacks and dwell-time findings, CSO Online
- SCATTERED SPIDER escalates attacks across industries, CrowdStrike
- How Scattered Spider TTPs are evolving in 2025, Push Security
- Pyramid of Pain, AttackIQ
- What Is Cyber Threat Intelligence? (three-type model), CrowdStrike
- Types of Cyberthreat Intelligence, Palo Alto Networks