Threat intelligence and the cyber threat landscape — the single most important concept for anyone who wants to understand how defenders stay ahead of attackers. For the CAS-005 exam, you must know how organisations collect and use information about adversaries to make smarter security decisions, not just react after a breach.
Jump to a section
A simple way to picture Threat Intelligence and the Cyber Threat Landscape
14 weather models from 12 different agencies feed into a single dashboard that tells a coastal city's emergency manager whether to evacuate 200,000 people ahead of a tropical storm.
This is threat intelligence for cybersecurity. The emergency manager doesn't just look at one radar image — they study satellite loops, buoy readings, historical storm tracks, and pressure drops to predict where the storm will hit and how strong it will be. They map the threat actor (the hurricane), its tactics (rapid intensification), techniques (storm surge), and procedures (a turn toward the coast).
Just as a forecaster issues an evacuation order based on probabilities and evidence, a security analyst issues an alert to block an IP address or update a firewall rule based on threat intelligence. Both professionals rely on incomplete, time-sensitive data to protect lives or data. Both must distinguish between a minor weather cell that will fizzle out and a Category 5 that demands immediate action.
Without this intelligence, the emergency manager would be reacting blindly after the storm hits. In cybersecurity, threat intelligence turns reactive firefighting into proactive defence — you see the storm coming and board up the windows before the winds arrive.
Threat intelligence is evidence-based knowledge about an attacker's identity, motives, capabilities, and preferred methods. It answers four critical questions: Who is targeting us? Why? What tools and tricks do they use? When are they most likely to strike?
Let us break down every piece of jargon. A threat actor is any person or group that launches an attack — this could be a teenager hacking for fun (script kiddie), a criminal gang after money, or a nation-state spying on another country's government. Tactics are the high-level goals an attacker pursues, like gaining initial access to a network. Techniques are the specific methods used to achieve those tactics, such as sending a phishing email to trick someone into clicking a malicious link. Procedures are the detailed, step-by-step playbook that a particular attacker follows every time. Together, these are abbreviated as TTPs, and intelligence professionals use TTPs to identify which group is responsible for an attack.
Threat intelligence is categorised by its time horizon and audience. Strategic intelligence is long-term and high-level — it tells executives what threats exist and how much to invest in defence. Tactical intelligence focuses on the tools and techniques an adversary uses right now, such as the type of malware they are deploying. Operational intelligence is about specific campaigns — a particular group targeting a sector you are in. Technical intelligence is the most immediate: IP addresses, domain names, file hashes that you can block immediately.
Where does all this data come from? Open-source intelligence (OSINT) is publicly available — news articles, government reports, social media. Closed-source intelligence comes from commercial vendors who employ analysts to monitor criminal forums and private data. Internal intelligence is harvested from your own network logs — a failed login from an unusual country is a data point.
The cyber threat landscape is the big picture — all the active threats, vulnerabilities, and attacker groups that exist at a given time. It constantly changes. One month, ransomware gangs might be targeting hospitals; the next, they might focus on schools. The landscape includes zero-day vulnerabilities (flaws that have no patch yet), exploit kits (ready-made hacking tools sold on the dark web), and living-off-the-land techniques (where attackers use legitimate system tools, like PowerShell, to avoid detection).
Organisations use a threat intelligence platform (TIP) to aggregate all this data into a single dashboard. The platform correlates information from multiple sources and sends alerts when it spots a pattern that matches known malicious behaviour. This replaces the old approach of manually checking dozens of different security feeds and hoping nothing was missed.
Intelligence is graded on confidence levels. High-confidence intelligence comes from multiple trusted sources and is highly likely to be accurate. Low-confidence intelligence might be a single unverified report. Security teams must decide how much trust to place in each piece of intelligence before acting on it. Acting on bad intelligence can cause wasted effort or even false alarms that harm business operations.
The cycle of intelligence gathering is called the intelligence lifecycle. It has six steps: direction (what do we need to know?), collection (gathering raw data), processing (converting data into readable format), analysis (interpreting the data to find threats), dissemination (sharing findings with decision-makers), and feedback (what worked and what needs to improve). This loop runs continuously, updating as new information arrives.
Define Intelligence Requirements
The team decides what they need to know — for example, 'Which ransomware groups are targeting our industry in Southeast Asia?' This step ensures intelligence gathering is focused and not random.
Collect Raw Data
The intelligence platform pulls data from OSINT sources (news, forums), commercial feeds, and internal logs. Raw data includes IP addresses, file hashes, domain names, and incident reports.
Process Data into Readable Format
Raw logs and unformatted reports are converted into a standardised structure (e.g., STIX/TAXII format) that machines and humans can easily analyse. This step removes noise and duplicates.
Analyse and Correlate Signals
An analyst or automated system looks for patterns. For example, a hash that matches a known malware family plus a domain registered yesterday may indicate a new campaign. Confidence levels are assigned.
Disseminate Intelligence to Stakeholders
Findings are packaged into reports for different audiences: a one-page summary for executives (strategic), a detailed playbook for incident responders (operational), and a list of IoCs for automated systems (technical).
Take Defensive Action and Collect Feedback
The team blocks IoCs, updates firewall rules, patches vulnerabilities, or resets credentials. After the action, they note what worked and what did not, feeding lessons learned back into step one to improve future intelligence.
Sophie is a security analyst for a medium-sized bank with 200 employees. She starts each day by opening her threat intelligence platform (TIP), which has already pulled data from 15 different sources: government alerts, commercial threat feeds, open-source news scraping, and the bank's own firewall logs.
At 8:15 AM, the TIP flags a new indicator of compromise (IoC) — a suspicious IP address in Eastern Europe. This IP was linked to a phishing campaign that targeted three other banks in the same region over the past week. The intelligence is tagged as 'medium confidence' because only two sources corroborated it. Sophie checks the bank's firewall logs and sees that, in the last hour, a connection from that IP attempted to access the bank's public-facing web server.
Sophie follows the bank's playbook. First, she blocks the IP at the firewall. Second, she sends a ticket to the network team to verify that no data left the server. Third, she writes a brief intelligence report to the chief information security officer (CISO), explaining what the threat is, why it matters, and what actions were taken. This is tactical intelligence being turned into action within minutes.
At 10:30 AM, Sophie switches to strategic intelligence. She reads a quarterly report from a government cybersecurity agency that outlines a new ransomware variant called 'LockCrypt 4.0', which spreads through unpatched Windows servers. Sophie realises the bank has three servers that are overdue for patching. She schedules the patch update for that evening and adds a note to the monthly executive briefing. This prevents a potential ransomware incident.
By 2 PM, Sophie notices that the TIP shows an increase in 'living-off-the-land' attacks across the financial sector. Attackers are using PowerShell, a legitimate Microsoft scripting tool, to move quietly inside networks. Sophie organises a team meeting to review PowerShell logging settings and ensures that alerts are configured to trigger whenever PowerShell is used in unusual ways.
The day ends at 5:30 PM. Sophie logs a summary of the day's intelligence activities, including which threats were identified, which were blocked, and which required further investigation. This data feeds back into the intelligence lifecycle so that tomorrow's analysis starts from a stronger position.
CAS-005 tests your understanding of threat intelligence and the threat landscape in several question formats: multiple-choice, drag-and-drop matching, and scenario-based questions. The exam loves to split candidates on the difference between tactical and operational intelligence. A typical trap: a question describes a list of IP addresses and file hashes — that is technical intelligence, not tactical. Tactical intelligence is about tools and TTPs. Operational intelligence is about specific campaigns and attackers.
Another common trap involves the intelligence lifecycle. CAS-005 will ask you to put the six steps in the correct order. Many candidates mix up 'processing' and 'analysis'. Processing is converting raw data into a machine-readable format. Analysis is the human or automated interpretation of that processed data to extract meaning. The exam expects the exact order: direction, collection, processing, analysis, dissemination, feedback. Memorise it by the acronym DCPADF.
The exam also tests your ability to categorise intelligence sources. Open-source intelligence (OSINT) includes public blogs, forums, and news. Closed-source intelligence includes paid commercial feeds like Recorded Future or CrowdStrike. Internal intelligence is from the organisation's own systems. Exam questions will describe a scenario and ask which type of intelligence is being described.
Threat actors are another heavy focus area. You must know the five main categories:
Nation-state actors (government-backed, highly skilled, stealthy)
Cybercriminal groups (motivated by money, use ransomware)
Hacktivists (motivated by political or social causes, deface websites)
Insider threats (employees or contractors who misuse access)
Script kiddies (inexperienced attackers using prepackaged tools)
Questions often list attacker traits and ask you to identify the actor type. The trap: they will describe a script kiddie but use the phrase 'advanced persistent threat' (APT). An APT is a sophisticated nation-state group that maintains long-term access — not a teenager downloading tools.
CAS-005 also loves 'indicators of compromise' (IoCs) versus 'indicators of attack' (IoA). IoCs are forensic evidence like a malicious file hash or IP address that shows a breach has occurred. IoAs are real-time signals that an attack is in progress, such as unusual outbound data transfer. The exam will give you a scenario and ask which is an IoC or IoA.
Finally, be ready for questions on the cyber threat landscape — the current trends. You should know that ransomware remains the most prevalent threat, supply chain attacks (breaching a third-party vendor to reach the real target) are increasing, and that cloud services and remote work have expanded the attack surface. The exam expects you to understand how these trends drive security decisions.
Threat intelligence answers who, why, how, and when an adversary is targeting you — not just what malware they use.
TTPs (tactics, techniques, and procedures) are the fingerprint that uniquely identifies an attacker group.
The intelligence lifecycle has six steps in order: direction, collection, processing, analysis, dissemination, feedback.
Open-source intelligence (OSINT) costs nothing but must be validated; closed-source intelligence costs money but is often more reliable.
Indicators of compromise (IoCs) are post-breach evidence; indicators of attack (IoAs) are real-time signs of an active breach in progress.
Nation-state actors are stealthy and persistent; cybercriminals are loud and financial; hacktivists are publicity-driven and destructive.
The cyber threat landscape is defined by current trends like ransomware, supply chain attacks, and the expanded attack surface from remote work.
Low-confidence intelligence should not trigger automated blocking — it should trigger investigation first.
These come up on the exam all the time. Here's how to tell them apart.
Tactical Intelligence
Focuses on the tools and techniques an adversary uses, such as 'uses PowerShell to move laterally'.
Useful for defenders to harden systems against current methods.
Changes frequently as attackers adopt new malware.
Operational Intelligence
Focuses on specific campaigns and attacker groups, such as 'APT29 is targeting vaccine research this quarter'.
Useful for executive decision-making and resource allocation.
Changes more slowly, as campaigns last weeks or months.
Indicator of Compromise (IoC)
Forensic evidence that a breach has already happened, like a malicious file hash found on a hard drive.
Static and one-time useful — the hash can be changed by the attacker for the next victim.
Used for detection after the fact.
Indicator of Attack (IoA)
Real-time signals that an attack is happening now, like an unexpected spike in outbound traffic at 3 AM.
Dynamic and repeatable — the behaviour pattern (e.g., large data transfer) persists despite changes in malware.
Used for early warning and active defence.
Advanced Persistent Threat (APT)
Highly skilled, well-funded, and often state-sponsored.
Maintains stealthy long-term access over months or years.
Uses custom tools and techniques that evade most defences.
Script Kiddie
Inexperienced and uses pre-packaged tools downloaded from the internet.
Loud and careless — often causes immediate, detectable damage.
Motivated by bragging rights or minor mischief, not strategic goals.
Mistake
Threat intelligence is only for huge corporations with big budgets.
Correct
Threat intelligence is accessible to organisations of any size. Free OSINT feeds, open-source tools like MISP, and industry sharing groups give small businesses actionable intel without spending money.
The field originated in government and military contexts, so beginners assume it is unattainable. In reality, many commercial vendors offer free tiers, and industry-specific Information Sharing and Analysis Centres (ISACs) are often free to join.
Mistake
All threat intelligence is equally reliable and can be acted on immediately.
Correct
Intelligence has confidence levels, and acting on low-confidence data can cause harm, such as blocking legitimate traffic or wasting team resources.
The word 'intelligence' sounds authoritative. New learners do not realise that much of it is unverified, contradictory, or deliberately planted by attackers to mislead defenders.
Mistake
Tactical intelligence and technical intelligence are the same thing.
Correct
Tactical intelligence focuses on attacker methods, tools, and TTPs. Technical intelligence is a subset — it is the specific, often ephemeral data like IP addresses and file hashes.
Both sound similar and beginners roll them together. CAS-005 traps candidates by mixing up these definitions. Tactical tells you how they attack; technical tells you what to block right now.
Mistake
Threat intelligence platforms automatically stop attacks without human intervention.
Correct
TIPs aggregate and correlate data, but humans must validate, prioritise, and decide how to respond. Automation can block obvious threats, but nuanced decisions require analyst judgement.
Marketing hype from vendors makes platforms sound like magic. Reality is messier — false positives, ambiguous data, and context-specific risks need human reasoning.
Mistake
The cyber threat landscape is static and can be learned once.
Correct
The landscape changes daily — new vulnerabilities, attacker groups, and techniques emerge constantly. Staying current requires continuous learning.
Beginners treat cybersecurity like a set of facts to memorise. In reality, it is a dynamic field where yesterday's knowledge may be obsolete today.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Not at all. Threat intelligence platforms (TIPs) have graphical dashboards that humans use to read reports and take actions. Programming is helpful for automating data ingestion but is not required for the CAS-005 exam.
Look for sources with a track record of accurate reporting, cross-reference with at least two other independent sources, and check the timeliness of the data. Government agencies and established commercial vendors are generally more reliable than anonymous forum posts.
An indicator is a specific piece of evidence like an IP address or email subject line — it can change from attack to attack. A TTP is the attacker's habit or method, such as always using spear-phishing with a fake invoice. TTPs are harder to change and thus more identifying.
Not directly, because zero-day vulnerabilities are unknown and unpatched. However, intelligence can detect suspicious behaviour that suggests a zero-day exploit is being used (an indicator of attack), allowing the team to isolate affected systems before data is stolen.
At least daily for automated feeds and weekly for human-reviewed reports. Small businesses should also subscribe to their industry ISAC (Information Sharing and Analysis Centre) for tailored alerts. The threat landscape changes too fast for monthly updates to be useful.
It means attackers use legitimate tools already present on the target system, such as PowerShell or Windows Management Instrumentation (WMI), to avoid triggering traditional antivirus. Intelligence helps detect these techniques by identifying unusual usage patterns of normal tools.
You've finished Threat Intelligence and the Cyber Threat Landscape. Continue through the CAS-005 study guide to build a complete picture of the exam.
Done with this chapter?