Cyber threat intelligence (CTI) is analyzed information about cyber threats, attacker behavior, capabilities, infrastructure, and likely targets. It can include technical indicators such as malicious domains or file hashes, as well as context about tactics, campaigns, or exposed organizational data.
CTI helps defenders prioritize alerts, guide investigations, and decide where to strengthen monitoring or controls. In real-world defense, teams may use feeds to enrich detections, track attacker infrastructure, or monitor underground sources for relevant mentions. These signals are leads, not proof of compromise: information can be stale, incomplete, or misleading, so analysts should verify it against internal telemetry before acting.