What Is a Threat Intelligence Analyst?
Cybersecurity’s research and writing discipline, explained fully: the three intelligence tiers, the intelligence cycle, MITRE’s major April 2026 restructuring, and a real threat report walked through.
Quick answer: A Threat Intelligence Analyst researches threat actors, campaigns, and attack techniques, then turns that research into structured intelligence other teams can act on, from specific indicators a SOC can block immediately to long-term trends leadership uses to plan security investment. It’s one of the more research- and writing-heavy specializations in the field, and rarely a true first job.
What a Threat Intelligence Analyst actually is
Every other role covered in this series reacts to or defends against threats inside an organization’s own environment. Threat Intelligence works one layer back from that: understanding who is attacking, why, how, and what they’re likely to do next, largely by studying activity outside the organization’s own walls, dark web forums, malware samples, other companies’ public breach disclosures, government advisories, and open-source research from the wider security community.
The output isn’t a fixed system or a resolved ticket. It’s a written product: a report, a briefing, a structured feed of indicators, tailored to whoever needs to act on it. That distinction, intelligence as a communicated product rather than a technical fix, is what separates this role from almost every other one in this series, and it’s exactly why writing ability matters here as much as technical skill does.
Who this role suits
This role rewards genuine intellectual curiosity about adversaries as people and organizations, not just as abstract technical signatures, along with real comfort synthesizing large amounts of ambiguous, sometimes contradictory information into a clear, defensible conclusion. Strong writing ability isn’t optional here; a brilliant analytical insight that’s poorly communicated to the people who need to act on it has effectively no value.
It’s a weaker fit for people who want hands-on technical work above all else, since a meaningful share of the job is reading, researching, and writing rather than operating tools directly, and for people uncomfortable expressing calibrated uncertainty, since intelligence work constantly requires stating how confident a conclusion actually is rather than presenting every assessment as fact.
The three intelligence tiers
Threat intelligence isn’t one flat category of output. It operates at three distinct levels, each serving a different audience with a different time horizon.
| Tier | Audience | Example output |
|---|---|---|
| Strategic | Executives and leadership | A quarterly briefing on which threat actor groups and geopolitical trends pose the greatest risk to the organization’s sector over the next year. |
| Operational | Security teams planning defenses | A report on a specific ransomware group’s typical attack chain, so defenders know what to prioritize hardening against. |
| Tactical | SOC and detection teams | A specific list of malicious IP addresses, file hashes, and domains tied to an active campaign, ready to block immediately. |
A single piece of research often gets written up at all three levels simultaneously, in different formats, since a SOC analyst needs the tactical indicators right now, while a CISO needs the strategic implications for next quarter’s budget conversation.
The intelligence cycle
The intelligence cycle is the standard structural framework for the discipline, borrowed directly from traditional intelligence work and adapted for cybersecurity.
| Phase | What happens |
|---|---|
| Planning & Direction | Defining what questions actually need answers, driven by what the organization needs to decide or defend against, not just whatever is interesting to research. |
| Collection | Gathering raw information from a wide range of sources: open-source reporting, dark web monitoring, malware repositories, information-sharing communities, and internal telemetry. |
| Processing | Converting that raw, often messy information into a consistent, structured format that can actually be analyzed and compared. |
| Analysis | Determining what the processed information actually means, including an honest, stated level of confidence in the conclusion. |
| Dissemination | Delivering the finished intelligence to whoever needs it, in the tier and format that’s actually useful to them. |
| Feedback | Finding out whether the intelligence was actually useful, and feeding that back into what gets prioritized in the next cycle. |
Feedback is the phase beginners most often skip in their mental model of the job, and it’s arguably what separates a mature intelligence function from a team that just produces reports nobody reads. Without it, there’s no mechanism to learn that last quarter’s strategic briefing didn’t actually inform any real decision, and the same mistake repeats indefinitely.
MITRE ATT&CK v19, and why the restructuring matters
Worth knowing: MITRE released ATT&CK version 19 on April 28, 2026, described by practitioners as the most significant structural change to the framework in years. The Defense Evasion tactic, previously a single broad category covering how attackers avoid detection, was split into two distinct tactics: Stealth, which keeps the original TA0005 identifier and covers techniques focused on avoiding detection outright, and the newly created Defense Impairment (TA0112), covering techniques that disable or degrade defensive tools directly. Any threat intelligence reporting, detection mapping, or purple team exercise still referencing the old single Defense Evasion tactic needs updating to stay aligned with how the rest of the industry now categorizes this behavior.
This follows on from ATT&CK v18, released in October 2025, which had already expanded the framework’s cyber threat intelligence content specifically, adding new adversary groups, campaigns, and software tied to supply chain intrusions and cloud identity compromises, alongside introducing Detection Strategies and Analytics as new structured object types for defenders. Together, these two releases represent the most substantial evolution of the framework’s CTI-relevant content in recent memory, and most existing beginner content about this role has not caught up with either update.
There’s a broader current thread worth naming too: industry forecasting heading into 2026 has consistently pointed to AI tools becoming standard issue for both attackers and defenders, from AI-assisted phishing and voice-cloning social engineering on the offensive side, to AI-assisted analysis speeding up an analyst’s own research on the defensive side. For a Threat Intelligence Analyst specifically, this means the adversary behaviors being tracked and the tools used to track them are both shifting at the same time, a genuinely unusual dynamic worth being aware of walking into the field.
A real threat report, walked through
To make this concrete, here’s a realistic composite of producing a single piece of intelligence from a fresh signal to a finished product.
Monday: Open-source monitoring flags chatter on a known cybercrime forum referencing a new ransomware affiliate program targeting a specific industry vertical. The analyst begins collection: pulling related samples, prior victim disclosures, and any technical write-ups already published by other researchers.
Tuesday: Processes the gathered material into a structured timeline and technique list, cross-referencing observed behaviors against MITRE ATT&CK, including confirming whether specific techniques fall under the newly split Stealth or Defense Impairment tactics rather than the old combined category.
Wednesday: Analyzes the pattern, concluding with moderate confidence that this is a rebrand of a previously tracked group based on overlapping infrastructure and near-identical ransom note language, explicitly stating that confidence level rather than presenting it as certain.
Thursday: Writes three versions of the finding: a tactical indicator list for the SOC to load into detection tooling immediately, an operational summary of the group’s typical attack chain for the security engineering team building new detections, and a short strategic note flagging the targeted industry vertical for leadership.
Following week: Follows up with the SOC to confirm whether the tactical indicators actually generated any real detections, feeding that outcome back into how future reporting on this group gets prioritized.
One underlying piece of research, three different deliverables, each written for a different reader with a different need. That translation work, not just the research itself, is a large part of what the role actually is.
Common misconceptions about the role
- “It’s just reading security news.” Reading is one input. The actual work is structured collection, analysis with stated confidence levels, and writing tailored deliverables, closer to research analysis than casual reading.
- “You need to be a skilled hacker to do this.” Deep offensive skill helps in some specializations within the field, but most CTI work draws more on research, writing, and structured analytical thinking than on hands-on exploitation ability.
- “Threat intelligence has no measurable impact.” The feedback phase of the intelligence cycle exists specifically to measure whether reporting led to real action, blocked indicators, closed gaps, informed decisions, not just report volume.
- “It’s the same as OSINT investigation.” Open-source research is one collection method among several, dark web monitoring, malware analysis, information-sharing communities, and internal telemetry all feed the same process too.
Skills and tools
Core skills
Strong analytical writing is close to a prerequisite, since the deliverable is almost always a written product read by people with less context than the analyst has. Structured analytic thinking, explicitly separating what’s confirmed from what’s inferred, and stating a genuine confidence level rather than overclaiming certainty, is a specific, learnable skill this role depends on.
Tools you’ll actually use
- Threat intelligence platforms like MISP, Recorded Future, or ThreatConnect for aggregating, structuring, and sharing intelligence.
- MITRE ATT&CK as the shared vocabulary for mapping adversary behavior, now including the v19 tactic restructuring described above.
- STIX and TAXII, the standard formats for structuring and sharing threat intelligence data between organizations and tools.
- OSINT research tools for gathering publicly available information relevant to a specific threat actor or campaign.
Certification path
CompTIA Security+ remains the right starting certification, the same foundational credential recommended across every path on this site.
Worth knowing: GIAC’s GCTI (Cyber Threat Intelligence) is the most respected dedicated credential in this specific field, covering strategic, operational, and tactical intelligence fundamentals, built on the SANS FOR578 course. It’s an Advanced-level certification that generally assumes real prior analytical experience. Treat it as a meaningful mid-career goal once you’re already doing intelligence-adjacent work, not a first certification.
Salary and demand
Threat Intelligence Analysts don’t have their own distinct BLS occupational code and typically fall under the same Information Security Analysts category as SOC Analysts, which had a 2024 median pay of $124,910 and a projected growth rate of 29% from 2024 to 2034. Because this specialization generally requires more research and writing maturity than an entry-level SOC role, actual pay for genuine threat intelligence work tends to sit above the occupation’s median rather than at its entry-level end, though BLS doesn’t break this out separately.
How to break into this role
Be honest with yourself here: this is rarely a true first cybersecurity job. Most people arrive with prior SOC or incident response experience, or occasionally from an adjacent research-heavy background like journalism, military intelligence, or academic research, combined with self-taught technical grounding.
Build SOC experience and writing practice together
Start with a SOC role, and deliberately practice writing up findings the way an intelligence report would: structured, with a stated confidence level, not just a technical summary.
Write a mock threat intelligence report
Pick a real, publicly documented threat actor or campaign, research it using open sources, and write a structured report at all three tiers, tactical, operational, and strategic, the same way the walkthrough above does.
The Phishing Investigation Project is a strong complementary starting point, since it already involves investigating and documenting a specific threat in a structured way. The full beginner sequence is covered in the Cybersecurity Roadmap for Complete Beginners.
Common interview questions
- “Walk me through how you’d research and report on a new threat actor.” (Tests understanding of the full intelligence cycle, not just research ability alone.)
- “How do you communicate uncertainty in an intelligence assessment without making it useless to the reader?” (Tests structured analytic thinking and calibrated confidence, a core skill interviewers specifically probe for.)
- “What’s the difference between strategic, operational, and tactical intelligence, and who reads each one?” (Tests foundational understanding of the discipline’s actual structure.)
Full interview preparation is covered on the Interview hub.
Building toward this role?
Start with SOC Analyst experience and deliberate writing practice. The full guide covers the investigative fundamentals this role builds directly on top of.
Read the SOC Analyst Guide →Frequently asked questions
What does a threat intelligence analyst do?
A threat intelligence analyst researches threat actors, campaigns, and attack techniques, then turns that research into structured intelligence other teams can actually act on, from specific indicators a SOC can block to strategic trends leadership uses to set priorities.
What is the difference between strategic, operational, and tactical threat intelligence?
Strategic intelligence covers long-term trends and risks for leadership, operational intelligence covers specific campaigns and adversary behavior for security teams planning defenses, and tactical intelligence covers immediate, actionable indicators like malicious IP addresses or file hashes for direct blocking.
What is the intelligence cycle?
The intelligence cycle is the standard framework for intelligence work: Planning and Direction, Collection, Processing, Analysis, Dissemination, and Feedback, which loops back into planning the next cycle. It structures how raw information becomes usable intelligence.
What changed in MITRE ATT&CK in 2026?
MITRE released ATT&CK version 19 on April 28, 2026, its most significant structural change in years. It split the Defense Evasion tactic into two separate tactics, Stealth and the newly added Defense Impairment, meaning threat intelligence reporting and detection mapping built on the old single-tactic structure needs updating to stay aligned with the rest of the industry.
Is threat intelligence analyst a good first cybersecurity job?
Rarely as a true first job. It requires strong research and writing skills alongside real technical grounding, and most people move into it after experience in a SOC, incident response, or a research-heavy adjacent field.
What certification is best for threat intelligence?
CompTIA Security+ remains the right starting certification generally. GIAC’s GCTI (Cyber Threat Intelligence), built on the SANS FOR578 course, is the most respected dedicated credential, but it’s an Advanced-level certification that assumes real prior analytical experience, a later goal rather than a first certification.