What is Threat Intelligence?
Threat Intelligence (also Cyber Threat Intelligence or CTI) is the systematic gathering, analysis and application of information about existing and emerging cyber threats, so that an organisation can better protect, detect, prepare and respond. It is not about raw data but about interpreted knowledge: who is attacking, with what aim, using which techniques, and what that means for your own installations. In OT networks, threat intelligence helps you identify the threats that matter and focus your defences on techniques that are actually used against industrial systems.
🧠 How does the threat intelligence cycle work?
Threat intelligence follows a fixed cycle borrowed from the traditional intelligence world. Each step feeds the next, and the feedback at the end steers the following round.
| Phase | What happens? | Example in OT |
|---|---|---|
| 1. Direction | Defining the questions to be answered (intelligence requirements) | “Which groups target drinking water utilities that run Siemens PLCs?“ |
| 2. Collection | Gathering data from sources | Advisories, feeds, your own logs, sector information |
| 3. Processing | Normalising, de-duplicating and converting to a common format | Converting indicators to STIX or importing them into a platform |
| 4. Analysis | Connecting the dots and judging relevance to your environment | Matching against your asset inventory and zones |
| 5. Dissemination | Getting the right information to the right audience | Board report, detection rule for the SOC, advice for maintenance |
| 6. Feedback | Evaluating whether the information was useful | Adjusting sources and questions |
The main sources are:
- Open sources (OSINT) - research publications, vendor advisories, vulnerability databases such as CVE
- Commercial feeds - paid services from specialist providers, for OT including Dragos and Claroty
- Government bodies and communities - the Dutch NCSC, CERT teams, the US CISA and sector ISACs
- Internal sources - SIEM alerts, incident logs, findings from Threat Hunting and your own Honeypot, a decoy system that yields threat intelligence specific to your environment
Threat intelligence is only valuable when applied in an action-oriented and context-specific way.
🔍 What types of threat intelligence are there?
Threat intelligence is usually divided by audience and time horizon. ISO/IEC 27002:2022 names three layers (strategic, operational and tactical); in practice the technical layer of individual indicators is often treated separately.
| Type | Goal | Audience | Application in OT |
|---|---|---|---|
| Strategic | Who the threat actors are and why, long-term trends | Board, CISO | Risk assessment and investment decisions |
| Operational | Specific campaigns and attacks that are imminent or under way | Security management, incident team | Heightened vigilance during an active campaign |
| Tactical | How they operate: TTPs mapped to MITRE frameworks | SOC analysts, architects | Structuring detection and defence |
| Technical | IOCs: IP addresses, domains, malware hashes | Firewall, EDR and SIEM administrators | Blocking and alerting in Firewall, EDR and SIEM |
🎯 Why are TTPs more valuable than individual IOCs?
In 2013 David Bianco published the Pyramid of Pain. It shows how much “pain” it causes an attacker when you detect and block a given type of indicator.
| Level (bottom to top) | Effort for the attacker to change |
|---|---|
| Hash values | Trivial: changing one bit gives a new hash |
| IP addresses | Easy: a new server or VPN |
| Domain names | Simple: register a new domain |
| Network and host artefacts | Annoying: tools and behaviour must be adapted |
| Tools | Challenging: develop or buy new tooling |
| TTPs | Tough: the way of working itself must change |
That is why detecting behaviour, for example “an engineering workstation downloading new PLC logic outside a maintenance window”, lasts longer than a list of IP addresses. MITRE ATT&CK and MITRE ATT&CK for ICS give these TTPs a common language. The ICS matrix has twelve tactics, two of which are specific to OT: Inhibit Response Function (such as disabling alarms or safety functions) and Impair Process Control (manipulating process control). The Cyber Kill Chain also helps you place observations in the right phase of an attack.
🏭 How does OT threat intelligence differ from IT?
OT threats are less frequent, but often far more impactful than IT threats. Only a handful of state-sponsored and criminal groups have demonstrable knowledge of industrial processes, and the number of ICS-specific malware families is small and well documented: from Stuxnet (discovered in 2010) through Industroyer and TRITON to PIPEDREAM and FrostyGoop, which in January 2024 used Modbus TCP to leave more than 600 apartment buildings in Lviv without heating.
Well-known threat actors targeting ICS include:
- XENOTIME - the name Dragos uses for the group behind TRITON, which targeted safety systems (SIS)
- Sandworm - Russian military group behind attacks on the Ukrainian power grid; Dragos tracks the related OT cluster ELECTRUM
- APT33 - suspected Iranian group, active since at least 2013, with a particular interest in aviation and energy
- Volt Typhoon - Chinese group pre-positioning access to critical infrastructure for later disruption
As of 2026, Dragos tracks 26 OT-focused threat groups, including VOLTZITE, which overlaps with Volt Typhoon. More important than such numbers is which group targets your sector and your technology. Context matters too: blindly blocking an IOC on an OT firewall can disrupt legitimate process traffic, so test and assess first. In OT, threat intelligence is used for, among other things:
- enriching SIEM and OT SOC data with OT-specific threat feeds
- updating firewall rules and IDS signatures based on current threats
- prioritising patch management and vulnerability management, for example with the catalogue of Known Exploited Vulnerabilities
- realistic scenarios for tabletop exercises and Threat Simulations
- preparing Incident Response playbooks for known modes of operation
🔧 How is threat information shared?
Sharing only works when everyone uses the same language and the same agreements. Three standards dominate:
| Standard | What is it? | Characteristic |
|---|---|---|
| STIX 2.1 | Language and JSON format for threat intelligence (OASIS) | OASIS Standard since 10 June 2021; 18 STIX Domain Objects (SDOs) such as Threat Actor, Malware, Indicator and Attack Pattern |
| TAXII 2.1 | Protocol for exchanging STIX data over HTTPS (OASIS) | REST API with API roots and collections for automatic retrieval and publishing |
| TLP 2.0 | FIRST’s Traffic Light Protocol for sharing agreements | Since August 2022: TLP:RED, TLP:AMBER+STRICT, TLP:AMBER, TLP:GREEN and TLP:CLEAR |
The open-source platform MISP is widely used by CERTs and ISACs to store and share indicators, with exports to STIX and to IDS and SIEM formats, among others. In the Netherlands, the NCSC shares threat intelligence with connected organisations and within sector ISACs such as the Water-ISAC. For the Dutch water boards, CERT-WM fulfils that role.
🔐 Which standards and laws call for threat intelligence?
- ISO 27001:2022 - control 5.7 Threat intelligence is new in the 2022 edition: organisations must collect and analyse information about threats
- NIS2 - Article 29 governs the voluntary exchange of information on threats, vulnerabilities, TTPs, indicators and detection configurations between organisations
- Dutch Cybersecurity Act (Cbw) - the Dutch transposition of NIS2 (Cyberbeveiligingswet), in force since 15 August 2026, with a duty of care and incident reporting for which up-to-date threat knowledge helps you assess risk
- IEC 62443 - the risk-based zones and conduits model requires a substantiated view of threats per zone
- MITRE D3FEND - maps attack techniques to suitable defensive countermeasures
Threat intelligence thus increases Situational Awareness within OT and makes a mature Cybersecurity programme demonstrably risk-driven.
🛠️ How do you get started with threat intelligence in OT?
- Know your installation - without an asset inventory (makes, models, firmware, protocols) you cannot judge whether threat information is relevant to your OT network.
- Formulate your questions - which sector, which vendors, which crown jewels? Keep it to three to five concrete questions.
- Pick a limited set of sources - start with NCSC advisories, CISA ICS advisories, your ISAC and vendor advisories before buying paid feeds.
- Translate to ATT&CK for ICS - map relevant groups to techniques and check which ones you can already detect.
- Automate the technical layer - let SOAR or the SIEM enrich IOCs automatically, but in OT only block after review.
- Report per audience - a quarterly report for the board, a weekly briefing for the SOC, concrete actions for maintenance.
- Measure and adjust - how many detections, patch decisions or exercises resulted from threat intelligence?
Relevance is crucial: too much noise leads to blindness; too little intel leads to surprise.
❓ Frequently asked questions
What is the difference between threat intelligence and threat hunting?
Threat intelligence provides knowledge about threat actors and their methods. Threat hunting uses that knowledge to proactively search your own environment for traces of an attacker that has not yet been detected. Threat intelligence is therefore the input, and threat hunting one of its applications.
Does a small OT organisation need a paid threat intelligence feed?
Usually not as a first step. Free sources such as NCSC advisories, CISA ICS advisories, sector ISACs and vendor advisories cover many relevant OT threats. A paid threat intelligence feed only makes sense once you can actually process and act on the information.
What is an IOC in threat intelligence?
An indicator of compromise (IOC) is a technical trace of an attack, such as an IP address, domain name or hash value of malware. IOCs are easy to automate but age quickly because attackers can change them easily. Behaviour-based detection of TTPs therefore holds up longer.
What does TLP:AMBER mean for shared threat information?
TLP:AMBER means the recipient may share the information only within their own organisation and with clients who need it to protect themselves. With TLP:AMBER+STRICT the information stays strictly within the recipient’s own organisation. These labels come from FIRST’s Traffic Light Protocol 2.0.
Does NIS2 require threat intelligence?
NIS2 does not mandate a specific threat intelligence programme, but it does require risk management based on current threats and, in Article 29, encourages the sharing of threat information. ISO 27001:2022 does contain an explicit threat intelligence control, 5.7. In practice, threat intelligence is needed to fulfil the NIS2 duty of care in a well-founded way.
Which framework should I use to describe OT threats?
MITRE ATT&CK for ICS is the established, freely available framework for describing attack techniques against industrial systems. It has twelve tactics, including Inhibit Response Function and Impair Process Control. For exchanging that information between organisations, STIX 2.1 is used.
📌 In summary
Threat intelligence enables OT organisations to take targeted security measures based on current threats and known attackers, rather than on assumptions.
Start small with an asset inventory, a few concrete questions and free sources such as the NCSC and your ISAC. Focus the analysis on TTPs using ATT&CK for ICS, share information according to STIX and TLP, and measure whether the insights really lead to better detection, patch decisions and exercises. That way threat intelligence becomes an indispensable building block of a mature Cybersecurity strategy.