Tracy works as a CISO in a large multinational company. She consumes threat intelligence to understand the changing trends of cyber security. She…

Tracy, as a CISO, is a strategic user of threat intelligence. Her focus is on high-level, long-term concerns such as business trends, security budgets, process improvements, and minimizing overall business risk. Strategic intelligence is tailored for senior leadership and decision-makers to inform long-range planning, investments, and risk management strategy. It is less concerned with specific, immediate technical threats and more with the overarching threat landscape and its business implications.

A. Tactical users: These users, like security managers, focus on threat actor TTPs to improve defensive controls and are more short- to medium-term focused.
C. Operational users: These users, such as incident responders, need information on specific, ongoing, or imminent attack campaigns to direct response efforts.
D. Technical users: These users, like SOC analysts, consume technical indicators (IOCs) such as IP addresses or file hashes for immediate detection and blocking.

1. EC-Council. (2023). Certified Threat Intelligence Analyst (CTIA) v3.0 Courseware, Module 01: Introduction to Threat Intelligence, Section: Types of Threat Intelligence. This section explicitly defines strategic intelligence as being for C-level executives (like a CISO) to make high-level decisions on risk, budget, and strategy.

2. SANS Institute. (2021). FOR578: Cyber Threat Intelligence Courseware. Unit 1, "Intelligence Fundamentals." This course material distinguishes between strategic (for executives), operational (for responders), and tactical (for defenders) intelligence, aligning the CISO role with strategic consumption.

3. Shackleford, D. (2016). Who's Using Cyberthreat Intelligence and How?. SANS Institute Reading Room. Page 4, "Audiences for Threat Intelligence." This paper maps intelligence types to audiences, placing executives and CISOs in the strategic category.