Insights

Practical thinking for intelligence-led security.

Short guidance for organisations developing cyber threat intelligence capabilities and decision-ready reporting.

CTI capability

What should a CTI capability assessment examine?

A useful assessment goes beyond tooling. It considers the decisions intelligence supports, the stakeholders who consume it, the processes that produce it and the controls that sustain quality.

Requirements and stakeholder needs
Collection and source governance
Analysis, confidence and review
Dissemination, feedback and metrics
People, skills, technology and integration

The result should be a prioritised improvement plan—not just a maturity score.

Requirements

Good PIRs begin with decisions.

Priority Intelligence Requirements are strongest when they identify what a stakeholder must decide or protect. Broad questions such as “What threats affect us?” usually create broad, low-value collection.

Define the decision, timeframe, scope, indicators and audience before collecting more data.

MISP

Five signs a MISP health check is overdue

Tags are inconsistent or poorly understood.
Distribution settings are applied without governance.
Duplicate or low-context indicators dominate searches.
Feeds are added without measuring value.
Users cannot explain how MISP supports a decision or workflow.

Reporting

Separate evidence from assessment.

Decision makers should be able to distinguish sourced information, analytical judgement, assumptions and uncertainty. This improves trust and makes reports easier to challenge and update.

Apply the thinking

Need help turning these principles into a working capability?

Explore services