book

The Art of Cyber Threat Intelligence: A Comprehensive Understanding

Name: The Art of Cyber Threat Intelligence: A Comprehensive Understanding
Author: Crawford Thomas
ISBN: 9798868817397

by Crawford Thomas

January 2026

Intermediate to advanced

248 pages

4h 8m

English

Apress

Read now

Unlock full access

The Art of Cyber Threat Intelligence
Disclaimer
Introduction
What Is Cyber Threat Intelligence?Understanding the CTI LayersOperational Threat IntelligenceTactical Threat Intelligence
Acknowledgments
Table of Contents
About the Author
About the Technical Reviewer
1. The Intelligence Life Cycle—From Unknowns to Understanding
The Imperative of Effective Intelligence DistributionThe Rumsfeld Reference: Known UnknownsPhase 1: DirectionPhase 2: CollectionPhase 3: ProcessingPhase 4: Dissemination (and Feedback)
2. Building the CTI Capability That Suits You
Leading with ClarityCTI IssuesWhy Routine MattersAvoiding the SOP TrapThe Disruption of Endless ProjectsProjects vs. Programs
3. Distinguishing Technical Intelligence?
What Is Technical Intelligence?Why Distinction MattersL3 SOC and the Use of Technical IntelligenceA Critical but Complementary RoleOperational Observations on Implementing Technical IntelligenceThe Engineer vs. the OperatorOperational Integration: Ownership by UsersAutomation and Integration: The Next EvolutionDesign Intelligence for UseA Note on Scale: Intelligence Must Fit the Business

4. Understanding the Cyber Landscape
Implications for OrganizationsIdentifying What Needs ProtectionThe Primacy of Data ProtectionPreventing Network IntrusionSteps to Protect Your Network and DataConclusion
5. Understanding the Business
Understanding the Service and Operational GeographyIdentifying Critical Data and Crown JewelsPrioritizing Services and DataAligning Security Strategy with Business PrioritiesFrom Understanding the Business to Intelligence Requirement ManagementStep 1: Requirement Planning—What Does the Business Need to Know?Step 2: Requirement Tasking—Who or What Can Answer This Question?Step 3: Requirement Brokering—Executing the Intelligence RequestIRM Process DiagramThe Art of Predictive PosturingLearning from Others’ EncountersPreemptive Control EnhancementsThe Virtue of Preparing for the “What Ifs”The Synthesis of Response and PredictionThreat PostulationConclusion
6. Create the Vectors: Vector First—Actor Second
The Primacy of TTPsThe Challenge of AttributionLearning from ExperienceThe “Big 5” Threat VectorsPhishingMalwareRansomware: A Weaponized Evolution of MalwareThe Growth and Proliferation of RansomwareRansomware Methodology: From Access to EncryptionWhat Makes Ransomware UniqueDetecting RansomwareWhy Ransomware Matters to CTI TeamsKey PIRs for Ransomware IntelligenceDDoS (Distributed Denial of Service)HackingInsiderThe Big 5—Understanding and Reporting Threat VectorsWhy the Big 5 MattersSingle-Page Reporting with the Big 5 TableHow to Use This TableThe Analyst’s Role in Impact and UnderstandingOverlapping Vectors
7. Geopolitics
Applying Geopolitical Intelligence to Cyber Threat ReportingConclusion
8. Fraud
Key Types of Cyber FraudTen Best Practices for Combating Cyber FraudConclusion
9. Spheres of Influence
The Three Spheres of Influence1. The Business Sphere (Innermost)2. The Micro Sphere (Middle)3. The Macro Sphere (Outermost)Applying the Spheres of Influence in PracticeConclusion
10. Fusion
Understanding Fusion: Beyond Data AggregationThe Process of Fusion: A Strategic ApproachConclusion: The Essence of Fusion in CTI
11. PIRs (Prioritized Intelligence Requirements)
Introduction to Prioritized Intelligence Requirements (PIRs)Understanding Intelligence RequirementsThe Challenge of PrioritizationPIRs Focused on Threats, Not Internal ControlsStanding Tasks and Their ImportanceLayering PIRs with Essential Elements of Intelligence (EEIs)1. Stay Focused on the Threat2. A PIR is a Question, Not a Statement3. Use Essential Elements of Information (EEIs)4. Prioritize PIRs and EEIs5. Classify PIRs as Sensitive Information6. Align PIRs with Key Threat Vectors7. Establish Metrics Around PIRs8. Regularly Review and Update PIRs9. Incorporate Business Unit (BU) PIRs Without Bias10. Label Intelligence Reports with the Relevant PIRsConclusion: The Role of PIRs in Cyber Threat Intelligence
12. Intelligence Collection Plans (ICPs)
Populating the ICP: The Fusion of PIRs and Collection AssetsUnderstanding Collection Asset CapabilitiesBenefits of a Well-Executed ICPConclusion: The Strategic Importance of ICPs
13. Requests for Information (RFIs)
Conclusion
14. Vendors
1. What Is the Budget and Are There Any Hidden Costs?2. Run a Clear and Well-Thought-Out RFP3. Can They Answer Specific Prioritized Intelligence Requirements (PIRs)?4. Reputation and Proven Expertise5. Integration with Existing Security Tools and Scalability6. Threat Coverage and Breadth of Intelligence7. Data Accuracy and Relevance8. Customization and Flexibility9. Support and Service Level Agreements (SLAs)10. Compliance with Industry Standards and Vendor LongevityConclusion
15. Intelligence Sources
Ten Fundamentals of Managing Intelligence SourcesApplying These Fundamentals in PracticeConclusion
16. Internal Control Data
Ten Fundamentals for Leveraging Internal Control Data in CTIConclusion
17. Intelligence Sharing
Ten Fundamentals of Intelligence Sharing in CTIConclusion
18. The Cyber Criminal
Ten Key Considerations for Navigating the Cyber EnvironmentRansomware: The Criminal Weapon of ChoiceConclusion: A Criminal Ecosystem, Not Just a Battlefield
19. Scenarios for Testing
Ten Best Practices for Writing Cyber Threat ScenariosConclusion
20. End to End Process
Ten Fundamentals for CTI Within an End-to-End Cybersecurity StrategyIntelligence As the Catalyst in End-to-End StrategyDeception As a Defensive TacticConclusion
21. Heat Maps
Ten Fundamentals for Using Heat Maps Effectively in Threat IntelligenceEnhancing Threat Heat Maps with Scenarios and Control MonitoringVisualizing Control Effectiveness and Residual RiskCyber Threat Heat MapConclusion
22. Inherent Threat vs. Residual Risk
Ten Key Points to Remember When Assessing and Reporting Inherent Threat and Residual RiskExample: Phishing as Inherent Threat vs. Residual RiskIntegrating Inherent Threat and Residual Risk with Risk AppetiteConclusion
23. AI Emerging Technology
Understanding the Basics: AI, Machine Learning, and LLMWhat Is Artificial Intelligence (AI)?What Is Machine Learning (ML)?What Is a Large Language Model (LLM)AI’s Evolution in Cybersecurity: From ML to AIThe Role of Context in AIThe Pros and Cons of AI in CybersecurityProsConsThe Evolving Role of AI VendorsAI Use Cases in CybersecurityAgentic AI: The Next FrontierThe Role of the CISO: From Gatekeeper to Digital Trust ArchitectImplementation StrategyChallenges in Securing AI-Driven SystemsFive Best Practices for Integrating AI in Cyber Threat IntelligenceThe Cyber Skills Gap and the Role of AIWhat the Skills Gap Really MeansEnter Artificial IntelligenceThe Gen Z Cyber Education IssueImplications and the Path ForwardConclusion
24. The Attack Surface
Ten Common Attack SurfacesTen Fundamentals of Attack Surface ManagementConclusion
25. The MITRE ATT&CK Framework in CTI
From Reference to Real-Time RelevanceWhy TTPs Matter More Than ActorsOperationalizing ATT&CK for Detection EngineeringConclusion: Make the Framework Work for You
26. The Stakeholders
Core Stakeholders in the Intelligence EcosystemBusiness Stakeholders Often OverlookedBuilding an Intelligence-Led Culture of Partnership
27. Intelligence Report Writing—The CTI Output
The Art of Writing IntelligenceAvoiding Bespoke OverloadCadence and Format of Periodical ReportingPull vs. Push Reporting CultureReport Format and ConsistencyTeam Alignment and ResponsibilityThreshold for Ad Hoc ReportsConclusion
28. Intelligence Maturity—Balancing Growth with Purpose
What Is a Capability Maturity Model (CMM)?CTI Maturity LevelsLevel 1—Ad Hoc/ReactiveLevel 2—Defined, but IsolatedLevel 3—Integrated and OperationalLevel 4—Intelligence-LedLevel 5—Optimized and AdaptiveApplying the ModelConclusion
29. The Near Future—What Else Is Going On
Quantum Computing: The New Crypto Threat, Without the Vendor Hysteria1. Quantum Safety Awareness Workshops2. Framing “Safety” in Safety-Critical Industries3. Governance Before Gadgets4. EU and Regulatory TimelinesDefense Spending and the Cyber Crossroads1. What Is the Actual Threat to the Nation?2. Where Is the Crossover Between Military and Civilian Cyber Threats?3. How Does Defense Cyber Spending Translate into Corporate Reality?4. Cyberwar or Cybercrime?Final Thought: Aligning Vision, Not Just ResourcesImplications for Cyber Threat Intelligence (CTI) Teams1. Reframing the Threat Landscape2. Data Classification and Prioritization Intelligence3. Reporting with Precision, Not Panic4. Supporting Cross-Domain Fusion: Military and Corporate5. Internal Threat Alignment6. Preparing for Policy and Regulatory Pressure
30. Final Thoughts of Significance: Lessons Beyond the Page
Noise, Trust, and TimelinessThe Stakeholder DisconnectData Models, Standards, and SharingThe Economics of ThreatHuman Factors and TrainingAsymmetric Adversaries and Adaptive DefenseTechnical Intelligence and Operational ControlThe SME RealityVendor VigilanceMeasuring Intelligence ValueThreat Hunting and Campaign TrackingRevisit the Big 5Mitre ATT&CK and AttributionConclusion
Bibliography
Index

Content preview from The Art of Cyber Threat Intelligence: A Comprehensive Understanding

C. ThomasThe Art of Cyber Threat Intelligencehttps://doi.org/10.1007/979-8-8688-1739-7_6

6. Create the Vectors: Vector First—Actor Second

Crawford Thomas¹

(1)

Leatherhead, Surrey, UK

All the business of war, and indeed all the business of life, is to endeavour to find out what you don’t know from what you do.
—The Duke of Wellington

This chapter introduces the methodology of focusing on the nature of the threat itself before considering who might be behind it, emphasizing the importance of understanding attack methods over attribution.

In the evolving field of CTI, a long-standing debate continues: should efforts prioritize tracking specific threat actors, or ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9798868817397

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

The Art of Cyber Threat Intelligence: A Comprehensive Understanding

by Crawford Thomas

6. Create the Vectors: Vector First—Actor Second

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.