The Intelligence Cycle: Turning OSINT Collection Into Intelligence

Collecting open source information is easy and produces a pile of facts. Intelligence is something else: information that has been evaluated, analysed and delivered to someone who will act on it. The intelligence cycle is the process that converts one into the other, and skipping phases is why so much threat intelligence goes unread.

Data, information, intelligence

Worth separating before anything else. Data is a raw observation — an IP address, a hash, a domain registration. Information is data with context — that address hosted a phishing site last week. Intelligence is information analysed against a decision — that infrastructure belongs to a group that targets our sector, and here is what to do about it.

Most "threat intelligence" feeds deliver information at best. They are useful, and they are an input to intelligence rather than the product.

The six phases

1. Direction. Someone with a decision to make states what they need to know. This is the phase most often skipped, and skipping it guarantees the output is irrelevant — a team that collects whatever is available produces a newsletter, not intelligence. Requirements should be specific: which threats to our sector are currently active, is this vendor's breach likely to affect us, should we prioritise this vulnerability.

2. Collection. Gathering from sources against those requirements. Open sources include news and vendor reporting, public registries and certificate transparency logs, scan indexes, social platforms, code repositories, and breach data — the tooling and sources covered under OSINT frameworks. Closed sources include commercial feeds, sector sharing communities and your own telemetry, which is frequently the most relevant source and the most neglected.

3. Processing. Making collected material usable — translating, deduplicating, normalizing formats, converting a PDF report into structured indicators. Unglamorous, and the phase that determines whether analysis is possible at all. Structured formats such as STIX exist to reduce this cost, with TAXII handling the transport.

4. Analysis. The actual intelligence work: evaluating reliability, corroborating across sources, identifying patterns, and reaching a judgement with a stated confidence level. Analysis produces an assessment, not a list.

5. Dissemination. Delivering it to the person who will act, in a form they can use and in time to matter. A detailed technical report to an executive and a strategic summary to a detection engineer are both failures of this phase.

6. Feedback. Did it answer the question, was it timely, what should change. Without feedback the cycle is a straight line and never improves.

Grading sources and claims

Analysts grade source reliability and information credibility separately, on the admiralty-style scale — a letter for how reliable the source has proven and a number for how credible this particular claim is. A reliable source can report something implausible, and an unreliable source can be right.

Two practical rules follow. Corroborate from independent sources, and be careful about what independence means — five vendor blogs restating one original report are one source, not five. And state confidence explicitly, because a judgement presented without a confidence level gets treated as fact.

Bias, and why analysts talk about it constantly

Confirmation bias is the dominant risk: seeking and weighting evidence that supports the hypothesis you started with. Formal techniques exist to counter it, and the most useful is the analysis of competing hypotheses — list several explanations and look for evidence that disconfirms each, rather than evidence that supports your favourite.

Attribution deserves particular caution. Tooling is shared, infrastructure is rented, and false flags are deliberately planted. Attribution is rarely necessary for defensive action — knowing the technique matters more than knowing the actor — and confident attribution on thin evidence is a recurring failure.

The three levels of product

Strategic intelligence informs long-term decisions: which threats face our sector, how is the landscape shifting, where should investment go. Audience is leadership, timescale is months.

Operational intelligence describes campaigns and adversary behaviour: which techniques a group uses, how they move once inside. Audience is the security team, and it maps naturally onto technique catalogs for the coverage testing described under adversary emulation.

Tactical intelligence is indicators — addresses, hashes, domains — consumed by tools. Immediately actionable and shortest-lived, since indicators change constantly while behaviour does not.

Programmes that produce only tactical intelligence end up maintaining blocklists. The operational level is where most of the defensive value sits.

Exam angles

Know the intelligence cycle phases: direction, collection, processing, analysis, dissemination, feedback — and that direction is set by the consumer's requirements. Distinguish data, information and intelligence. Know strategic, operational and tactical levels by audience and timescale. Recognize source reliability and information credibility as separately graded, confirmation bias as the main analytic risk, and attribution as difficult and usually unnecessary for defence.