Cyber threat intelligence (CTI) is often discussed as if collecting more information automatically makes an organisation more secure. In reality, its value depends on whether that information helps people make better decisions.
For organisations operating industrial control systems (ICS) and operational technology (OT), this distinction matters. A cyber incident can disrupt production, damage equipment, interrupt essential services or compromise safety. Threat intelligence should therefore be relevant to the systems being protected and practical enough to support action.
Start with the Information You Already Have
Useful intelligence does not always come from expensive platforms. Organisations can draw on several sources:
- Internal information: Network logs, incident reports, asset inventories, risk assessments and previous security findings.
- Industry collaboration: Information shared by peers, professional groups and sector-specific security communities.
- External reporting: Alerts, advisories and analysis from specialist providers, government agencies and trusted researchers.
- Restricted sources: Intelligence gathered from less accessible environments, including criminal forums, where legally and appropriately obtained through specialist providers or authorised teams.
Each source provides a different perspective. The challenge is to validate the information, understand its relevance and connect it to the organisation's own assets and risks. NIST's Guide to Cyber Threat Information Sharing provides supporting guidance on choosing information sources, participating in sharing communities and handling shared information.
Focus on Intelligence That Supports Decisions
A practical checklist for assessing CTI is complete, accurate, relevant and timely (CART). Here, CART is used as a working checklist rather than a formal standard or a NIST requirement.
Complete: Is there enough context to understand the threat and decide what to do?
Accurate: Is the information credible, and has it been checked against other evidence?
Relevant: Does the threat apply to the equipment, software, connectivity or processes the organisation actually uses?
Timely: Will the information reach the right people early enough to make a difference?
A high-profile vulnerability may attract attention, but it should not automatically become the highest priority. A less publicised weakness affecting a critical PLC, engineering workstation or remote-access route could pose a more immediate operational risk.
Give the Right Information to the Right People
Threat intelligence has different uses across an organisation.
Senior leaders need to understand exposure, investment priorities and long-term business risk. Security managers need to decide where monitoring, controls and resources should be focused. Engineers and operational teams need clear details about affected assets, attack methods and practical mitigations.
Technical specialists may use intelligence to investigate suspicious behaviour, improve monitoring rules or check for indicators of compromise. However, action in an OT environment must also consider availability, safety and the potential consequences of changing a live system. NIST's Guide to Operational Technology (OT) Security addresses these performance, reliability and safety considerations.
Move from Awareness to Action
Collecting reports is only the beginning. A workable process identifies relevant threats, checks whether systems are exposed, assigns responsibility and records what action was taken.
For example, an advisory concerning a PLC firmware vulnerability should prompt the organisation to confirm whether the affected model and version are installed, assess the potential consequences, review existing controls and decide whether mitigation or further investigation is needed.
Any firmware change should follow the site's engineering change process, including supplier guidance, testing, recovery arrangements and an agreed operational window where required. Where an immediate change is impractical, record the interim controls, accountable owner and review date.
The objective is not to know about every cyber threat. It is to understand the threats that matter, make informed decisions and protect the safe, reliable operation of industrial systems.
