Which statement correctly differentiates cyber threat intelligence (CTI) from broader cyber intelligence (CI) as used in operations?

Which statement correctly differentiates cyber threat intelligence (CTI) from broader cyber intelligence (CI) as used in operations?

• A. CTI is the broader analysis; CI focuses specifically on threats.
• B. CTI is specifically information about cyber threats, adversaries, and their TTPs; cyber intelligence is the broader analysis of adversaries and capabilities; CTI informs cyber planning and defense.
• C. CTI and CI are identical concepts.
• D. CTI only covers hardware vulnerabilities and not adversaries.

Answer: (B)

The key idea is that cyber threat intelligence is the specific, actionable information about threats, adversaries, and their tactics, techniques, and procedures, which directly informs how you plan and defend your cyber environment. This specialized intelligence focuses on who is behind attacks, what they are capable of, and how they operate, so you can anticipate, detect, and counter their techniques. That makes the correct statement the best fit: cyber threat intelligence describes threats, adversaries, and their TTPs, and it feeds cyber planning and defense. Broad cyber intelligence, on the other hand, encompasses a wider set of analyses about adversaries and capabilities beyond just immediate threats, including other aspects of the cyber domain that aren’t limited to threat information. The other options mischaracterize the relationship. It’s not broader than CTI, not identical to CI, and not limited to hardware vulnerabilities without addressing adversaries.

The key idea is that cyber threat intelligence is the specific, actionable information about threats, adversaries, and their tactics, techniques, and procedures, which directly informs how you plan and defend your cyber environment. This specialized intelligence focuses on who is behind attacks, what they are capable of, and how they operate, so you can anticipate, detect, and counter their techniques.

That makes the correct statement the best fit: cyber threat intelligence describes threats, adversaries, and their TTPs, and it feeds cyber planning and defense. Broad cyber intelligence, on the other hand, encompasses a wider set of analyses about adversaries and capabilities beyond just immediate threats, including other aspects of the cyber domain that aren’t limited to threat information.

The other options mischaracterize the relationship. It’s not broader than CTI, not identical to CI, and not limited to hardware vulnerabilities without addressing adversaries.