What is threat intelligence?

• A. A system that automatically patches vulnerabilities in software.
• B. Information about threats, actors, and capabilities; informs detections, hunting, and risk prioritization.
• C. A method for encrypting data at rest to protect backups.
• D. A process for long-term capacity planning in security teams.

Answer: (B)

Threat intelligence is information about threats, actors, and their capabilities that helps security teams make informed decisions. It gathers data from multiple sources—such as open sources, vendor feeds, and incident reports—to build a picture of who might attack, what techniques they use, and what they are targeting. With this knowledge, defenders can tailor detections to specific tactics and procedures, guide threat hunting to focus on likely attacker behaviors, and prioritize risk by considering how likely a threat is to exploit certain weaknesses and what impact it would have.

This isn’t about automatically patching software, encrypting data, or long-term capacity planning. Those are separate activities—vulnerability management, data protection, and resource planning, respectively. Threat intelligence sits upstream of those tasks, providing context that makes detections more precise, hunting more effective, and risk decisions more informed.