Explain like I'm five · Security
What is CTI?
Cyber Threat Intelligence, told as a story about a castle and a friend on a tower.
Your computer is a castle.It holds your stuff. You want to keep it safe.
Sneaky people want to get in.Each one has a favorite trick.
Climbs in windowsthe red-hat one
Pretends to be pizzaso you open the door
Comes after darkwhen nobody's looking
CTI is a friend on the watchtower.They watch the whole town and learn what the sneaky people are doing.
The friend tells you the tricks.Before anyone knocks.
🧢 Red hat robbed 3 houses this week → lock the windows
🍕 Fake pizza is going around → don't open for pizza you didn't order
🌙 They come at night → check the doors at bedtime
So you lock up before they knock.It's easy to stop a trick you already know.
In one breath
CTI = knowing the bad guys' tricks before they try them on you.
Cyber Threat Intelligence is the "heads up!" that lets the good guys get ready first, instead of finding out after something breaks.
When grown-ups say it
- Threat actor
- The sneaky person. A hacker, a gang, or a country's spies.
- TTPs
- Their favorite tricks. How they usually get in and what they do next. → the habit story
- IOC
- A footprint. A clue like "the red hat" — an address or a file the bad guy always uses. → the footprint story
- Threat feed
- The friend's shouting. A stream of new warnings, all day long.
- Threat report
- The friend's storybook. The full tale of one gang and everything they did.
Next story
The Footprint →