Skip to content
←Back to glossaryCyber

Threat intelligence (cyber threat intelligence)

Cyber threat intelligence, encompassing the collection and analysis of indicators of compromise and attacker tactics to anticipate and detect intrusions.

Definition

On June 7, 2023, CISA and the FBI issued advisory AA23-158A on the Cl0p ransomware gang's exploitation of the MOVEit Transfer flaw (CVE-2023-34362): IP addresses, file hashes, the LEMURLOOT web shell, techniques mapped to MITRE ATT&CK. That is threat intelligence in its most common form: collecting, analyzing and sharing what is known about malicious actors, their tools and their traces, to detect earlier and get ahead of attacks. It comes in three levels. Tactical intelligence delivers indicators of compromise (IOCs) ready to use: IP addresses, file hashes, domain names. Operational intelligence describes live campaigns and the TTPs (Tactics, Techniques and Procedures) of active groups. Strategic intelligence tracks trends and motives to steer security budgets. An IOC goes stale fast, since an IP address can change within the hour; TTPs are far more expensive for the attacker to change, which is what makes them valuable. Sharing runs on STIX (the description format) and TAXII (the transport protocol), both OASIS standards, and on platforms such as MISP. Insurers use it at two points: in underwriting, to see whether an applicant is being targeted or exposes a flaw exploited in the wild; and in claims, to attribute the attack and gauge the risk of a second incident.

Its 5 cross-references, woven across the glossary's 18 categories
Threat intelligence (cyber threat intelligence): Cyber glossary illustration, AlgoPolis
Example

Textbook case: through a threat intelligence feed it subscribes to, a cyber insurer receives new IOCs from an APT group known to target health insurers. It alerts its 40 healthcare insureds right away. Three of them find a matching IP address in their logs and contain the intrusion before the ransomware goes off.

Read next
CyberAdvanced persistent threat (APT)A sophisticated attacker, often state-sponsored, conducting targeted, discreet and long-lasting intrusions for espionage or sabotage.Read the entry →CyberSOC / CIRT (Security Operations Center / Cyber Incident Response Team)Security monitoring and cyber incident response team, whose existence and maturity are a cyber underwriting criterion.Read the entry →CyberSIEM and SOARLog correlation and incident-response automation platforms that reduce threat detection and handling times.Read the entry →
Put it to work
SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Also known as

CTI, cyber threat intelligence, IOC, STIX, TAXII

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.