Evidence-based information about cyber threats, attackers, and their methods, used to anticipate and defend against attacks.
Threat intelligence turns raw data about attacks into actionable knowledge. It can include indicators of compromise, such as malicious IP addresses, domains, and file hashes; descriptions of attacker tactics, techniques, and procedures; and strategic analysis of which groups target which industries and why.
Security teams use threat intelligence to block known bad infrastructure, prioritize patching of vulnerabilities being actively exploited, tune detection rules, and brief leadership on risks. Sources include commercial feeds, government agencies, industry sharing groups, open-source research, and an organization's own incidents. Frameworks such as MITRE ATT&CK provide a common language for describing attacker behavior. Intelligence is most useful when it is timely, relevant to the organization, and connected to concrete defensive actions.
A decoy system or resource deliberately set up to attract attackers so their methods can be detected and studied.
Incident ResponseAn organization's structured process for detecting, containing, investigating, and recovering from security incidents.
Security Information and Event ManagementA security system, known as SIEM, that collects and analyzes log data from across an organization to detect threats and support investigations.
Security Operations CenterA team and facility that monitors an organization's systems around the clock to detect, analyze, and respond to cybersecurity threats.
Zero-DayA software vulnerability unknown to the vendor, or for which no fix exists yet, giving defenders zero days to prepare.
What a SOC does, the roles and tiers inside one, the tools it relies on and how to choose between building in-house, outsourcing to MDR or a hybrid model.
MSSPs manage your security tools. MDR providers hunt and contain threats. Compare scope, who responds, pricing models and the questions to ask before you sign.
How a zero-day goes from hidden flaw to public patch, and what defenders can do in the window before a fix exists.