A Guide to Strategic, Tactical & Technical Threat Intelligence

Threat intelligence has a usage problem rather than a supply problem. Most organizations have access to more intelligence than they act on: feeds ingested into a platform nobody queries, reports circulated and skimmed, indicator lists that expire faster than anyone reviews them.

The waste is usually traceable to a mismatch. Intelligence produced for one audience gets delivered to another. A board-level briefing on geopolitical threat trends arrives in the SOC queue, where it changes nothing. A list of file hashes lands on an executive's desk, where it means nothing. Both products may be perfectly good. Neither reaches someone who can make a decision with it.

The four-level framework exists to fix that mismatch. It is not a taxonomy for its own sake; it is a way of matching what gets produced to who has to decide something. This post covers what each level actually contains, who consumes it, what decisions it drives, and how to build a program that produces intelligence people use.

Why the Four Levels Matter

The distinction is about audience and decision horizon, not about sophistication.

Different Consumers Need Different Time Horizons

An executive deciding a three-year security investment strategy needs to understand how threats to their sector are evolving. A detection engineer building a rule this week needs to know exactly what technique to catch. An analyst triaging an alert right now needs to know whether a specific address is malicious.

Those are all threat intelligence, and none of them substitutes for another.

Different Decisions Have Different Shelf Lives

Strategic intelligence remains relevant for quarters or years. Tactical intelligence about adversary techniques stays useful for months. Operational intelligence about a specific active campaign matters for weeks. Technical indicators may be worthless within days.

Treating them uniformly means either discarding durable insight too quickly or acting on stale indicators too long.

Mismatch Is the Main Cause of Waste

The most common failure in threat intelligence programs is producing at one level and evaluating at another: buying indicator feeds to answer strategic questions, or commissioning strategic reports to improve detection coverage. Both disappoint, and the conclusion drawn is usually that threat intelligence does not work.

Organizations trying to work out which level they are actually missing can assess that alongside their detection coverage with FoxRadar360, since the gap frequently sits between intelligence and the detections it should be informing.

Strategic Threat Intelligence

The longest horizon and the smallest volume.

What It Covers

Strategic intelligence describes the threat landscape at the level of risk and trend rather than incident. It covers which adversary categories target your sector and why, how motivations and business models are shifting, the effect of geopolitical developments on targeting patterns, regulatory direction, and how threats to your industry are likely to evolve over the coming year or more.

It is largely non-technical, narrative in form, and concerned with implications rather than mechanics.

Who Consumes It

Boards, executive leadership, the CISO, and risk functions. Occasionally legal and compliance where regulatory exposure is involved.

What Decisions It Drives

Security budget allocation and multi-year investment direction. Risk acceptance and transfer decisions, including insurance. Whether to enter or avoid particular markets or partnerships. Which capabilities to build versus buy. How to frame security risk in enterprise risk reporting.

What Good Looks Like

Strategic intelligence is useful when it is specific to your organization rather than generic. A report stating that ransomware is increasing is not intelligence; it is background noise. A report stating that operators targeting your sector have shifted toward exfiltration-only extortion, which means your backup investment provides less protection than assumed, is a decision input.

The test is whether it changes a resource allocation. If leadership reads it, agrees, and does nothing differently, it was not strategic intelligence for that organization.

Common Failures

Vendor marketing dressed as strategic analysis. Reports that summarize public news without adding sector-specific implication. Products so long that nobody reads past the summary, which then contains nothing actionable.

Tactical Threat Intelligence

The level most directly useful to security engineering.

What It Covers

Tactical intelligence describes adversary tactics, techniques, and procedures: how attacks are actually conducted. Which initial access methods are being used, how persistence is established, which lateral movement techniques appear in current intrusions, how defenses are evaded, and what tooling adversaries favor.

This is where frameworks like MITRE ATT&CK do their real work, providing a shared vocabulary for describing behavior rather than artifacts.

Who Consumes It

Detection engineers, security architects, SOC leadership, red and purple teams, and anyone making decisions about control design.

What Decisions It Drives

Which detections to build and in what order. Where to prioritize control investment. What to test in purple team exercises. Which hardening measures address techniques actually in use rather than techniques that are merely possible.

Why It Has the Best Return

Techniques change far more slowly than indicators. An adversary switches infrastructure daily and file hashes constantly, but the underlying approach to credential access or lateral movement persists for years.

Detection built on behavior therefore survives, while detection built on indicators expires. Tactical intelligence is what makes behavioral detection possible, which is why it delivers more durable value than any other level for most security teams.

What Good Looks Like

Descriptions specific enough to build against. Not that adversaries use living-off-the-land techniques, but which specific binaries, in which specific sequences, with which observable parent-child relationships and command-line characteristics.

Mapped to a framework so coverage can be tracked, and paired with detection logic or at least a clear detection hypothesis.

Common Failures

Descriptions too abstract to implement. Technique lists with no environmental context, so teams cannot judge relevance. Coverage mapping produced once and filed rather than maintained as environments drift.

Operational Threat Intelligence

The level concerned with specific campaigns and actors.

What It Covers

Operational intelligence describes particular adversary activity: a named group's current campaign, which sectors and geographies it is targeting, what infrastructure it is using, what its objectives appear to be, and how the campaign is developing.

It sits between tactical and technical, providing the context that makes indicators meaningful and the specificity that makes technique descriptions actionable now.

Who Consumes It

SOC managers, incident responders, threat hunters, and the people deciding where to focus hunting effort this month.

What Decisions It Drives

Which hunts to run and in what order. Whether an emerging campaign warrants immediate defensive action, such as urgent patching of a specific appliance or temporary hardening of a particular access path. How to prioritize vulnerability remediation based on what is being exploited rather than what has the highest severity score.

What Good Looks Like

Timely enough to matter. Operational intelligence about a campaign that concluded three months ago is history rather than intelligence. It should also state relevance clearly: whether your sector, geography, and technology stack are in the targeting profile.

The best operational intelligence arrives with a recommended action and a way to check whether you are already affected.

Common Failures

Volume without filtering, so teams receive campaign reporting for sectors and technologies irrelevant to them. Attribution debates consuming attention that detection coverage deserves. Reporting that describes activity without indicating what a defender should do.

Technical Threat Intelligence

The shortest-lived and highest-volume level.

What It Covers

Specific observable artifacts: IP addresses, domains, URLs, file hashes, certificate fingerprints, registry keys, and mutex names. These are the atomic units most people picture when they hear threat intelligence.

Who Consumes It

Detection tooling primarily, and analysts secondarily during triage and enrichment.

What Decisions It Drives

Blocking and alerting decisions. Enrichment during triage, answering whether an observed artifact has known malicious history. Retrospective searching to determine whether previously unknown infrastructure appeared in historical telemetry.

Where It Is Genuinely Valuable

Retrospective hunting is the most underused application. When a campaign is disclosed with associated infrastructure, searching historical telemetry for those artifacts frequently reveals intrusions that were never detected in real time. This depends entirely on retention being adequate, which is one more argument for keeping logs longer than the minimum.

Enrichment during triage is the other durable use. Knowing that an observed address has appeared in prior malicious activity accelerates a triage decision meaningfully.

Where It Disappoints

As a preventive control, indicator feeds have limited value because adversaries rotate infrastructure faster than feeds propagate. Blocking a domain that was abandoned last week stops nothing.

Feed volume is also actively harmful past a point. Thousands of indicators with no relevance filtering produce false positives that consume analyst time and erode trust in the alerting channel.

Common Failures

Measuring intelligence capability by feed count or indicator volume, both of which are marketing metrics rather than security ones. Ingesting without expiry, so stale indicators generate alerts indefinitely. Treating indicators as a substitute for behavioral detection rather than a supplement to it.

Making the Four Levels Work Together

The levels reinforce each other when connected and waste effort when siloed.

A Worked Example

A ransomware operator becomes active against logistics firms.

Strategic: the sector faces increasing extortion activity where data theft precedes encryption, which means recovery capability alone is insufficient and detection investment needs to increase. Leadership adjusts budget accordingly.

Tactical: the operator's approach involves brute-forcing remote access without MFA, using commercial remote management tooling for persistence, and destroying backups before deployment. Detection engineering builds coverage for those specific behaviors, and architecture prioritizes MFA on remote access and backup isolation.

Operational: a current campaign is targeting a particular VPN appliance version present in your estate. Vulnerability management escalates that patch out of cycle, and threat hunting checks for signs of prior exploitation.

Technical: infrastructure associated with the campaign is searched retrospectively across ninety days of telemetry to confirm no earlier compromise occurred.

Each level answered a different question for a different person, and the combination produced action at every layer.

Requirements Come Before Collection

The step most programs skip is defining what questions the organization actually needs answered. Intelligence requirements should be written down, tied to named consumers, and reviewed periodically.

Without them, collection is driven by what vendors sell rather than by what decisions are pending, which is why so many programs accumulate feeds nobody uses.

Feed It Into Detection, Not Just Reporting

Intelligence that ends in a document has produced awareness. Intelligence that ends in a new detection, a validated coverage gap closed, or a hunt executed has produced defense.

The connection between tactical intelligence and detection engineering is the highest-value link in the whole chain, and it is where most programs are weakest. Building that link deliberately, so technique reporting converts into tested detection logic, is part of how FoxRadar360 approaches intelligence rather than treating it as a separate reporting function.

Prioritize by Your Environment

Relevance filtering is what makes intelligence usable at any level. Techniques that require technology you do not run, campaigns targeting sectors you do not operate in, and indicators for platforms absent from your estate all consume attention without contributing.

Your own incident history and alert telemetry describe your actual threat environment better than any external report, and should weight how external intelligence is prioritized.

Measuring Whether Intelligence Is Working

Detections built or improved from intelligence input. The clearest link between intelligence and defensive outcome.

Coverage gaps identified and closed, tracked against techniques relevant to your environment.

Hunts executed and findings produced, including negative results, which have value in confirming coverage.

Retrospective matches. Historical telemetry searches against newly published infrastructure, and what they surfaced.

Decisions attributable to strategic intelligence. Budget, architecture, or risk decisions that changed because of an assessment.

Consumer feedback per level. Whether each audience finds what they receive actionable, gathered directly rather than assumed.

Notably absent: feed counts, indicator volumes, and reports produced. Those measure activity rather than effect.

Final Thoughts

The four-level framework is useful because it forces a question most intelligence programs never ask: who is going to make a decision with this, and what decision is it.

Strategic intelligence answers where the organization should invest and what risks to accept, and belongs to leadership. Tactical intelligence answers which behaviors to detect and which controls to build, and delivers the most durable value because techniques outlive infrastructure by years. Operational intelligence answers what to hunt for and what to prioritize right now, and depends entirely on timeliness. Technical intelligence answers whether a specific artifact is known bad, and earns its keep through enrichment and retrospective hunting rather than through preventive blocking.

Programs fail when these get confused: when indicator volume is used to demonstrate capability, when strategic reports are expected to improve detection, or when tactical reporting stops at a document instead of becoming a tested detection.

The organizations getting real value are not the ones subscribing to the most sources. They are the ones who wrote down what they need to know, matched each product to someone who has to decide something, and built a working path from technique reporting to validated detection coverage. To review how your current intelligence translates into actual detection coverage, and where the link breaks, start a conversation with the team at FoxRadar360.