Cyber Threat Intelligence & the Limits of Attribution

Reading time ~11 minutes · No technical prerequisites · Day 1, Module 1.2

The previous lesson asked you to assume you are in persistent contact with capable adversaries. That assumption produces a flood of information — feeds, briefings, vendor reports, attribution claims — and a leader's job is not to consume all of it but to convert the right parts of it into decisions. This lesson is about doing that conversion well, and about treating one particularly seductive product — attribution — with the scepticism it deserves.

Three altitudes of intelligence

Threat intelligence comes at three altitudes, and confusing them wastes both money and attention.

• Strategic intelligence answers "who is likely to target us, and why?" It informs posture, budget, and risk acceptance. This is your altitude as a leader.
• Operational intelligence answers "which campaigns and techniques are active against organisations like ours?" It informs priorities and programmes.
• Tactical intelligence is the specific, perishable detail — addresses, file hashes, domains. It informs tooling and the security operations centre, and it ages out in days.

The common failure is an inversion: leaders are handed tactical feeds and asked to react to them, while no one supplies the strategic judgement that should be shaping the whole enterprise. If you find yourself looking at indicator lists, you are reading someone else's job. Ask instead for the strategic picture and the decisions it implies.

Intelligence-led defence

The purpose of intelligence, for a leader, is to turn adversary behaviour into priorities. Knowing that actors targeting your sector favour spear-phishing of executive assistants should move resources toward phishing-resistant authentication and assistant training — concrete priorities, not a vague sense of menace. Intelligence that cannot be traced to a priority is not yet doing its job, and you are entitled to send it back until it can.

Why attribution is hard — and often wrong

Attribution — naming who did it — is the most quoted and least reliable product of threat intelligence. Several forces conspire against it:

• Borrowed infrastructure. Adversaries route operations through compromised third-party systems and stolen accounts, so the apparent origin is rarely the real one.
• Shared and copied tools. The same malware families and toolkits appear across unrelated actors, including criminal groups imitating states.
• Deliberate false flags. Sophisticated actors plant another group's fingerprints precisely to misdirect attribution.
• Politics. Naming a state is a diplomatic act with consequences. Public attributions are shaped by what a government is willing to assert, not only by what analysts can prove.

None of this means attribution is worthless. It means a confident attribution is a probabilistic claim that must be unpacked. The headline — "carried out by State X" — is not the intelligence. The evidence beneath it, and the analyst's stated confidence, are.

Evidence versus inference

The single most useful habit when reading any intelligence report is to separate what was observed from what was concluded. A report may observe that a phishing domain was registered three days before use, that the malware came from a known toolkit, and that activity clustered in one time zone's working hours. From those observations it may infer a "premeditated, well-resourced operation consistent with Actor Y, operating from country Z." Each inference is softer than it sounds: shared toolkits weaken the "Actor Y" link, and time zones are trivially faked, undermining "country Z." Good analysts label their confidence; weak reports present inference as if it were observation. Your job is to keep the two columns apart in your own head, regardless of how the report blurs them.

The headline claim is not the intelligence. The evidence and the stated confidence beneath it are.

Recognising threat-intel theatre

Some intelligence spending buys reassurance rather than risk reduction. The warning signs are consistent: thousands of indicators with no prioritisation and no "so what"; reports that have never once changed a decision; confident attribution with no stated confidence or evidence; and dashboards that measure volume — "twelve thousand threats blocked" — rather than risk reduced. That last metric is pure vanity: it tells you nothing about the few threats that could actually hurt you. Push every feed and every briefing toward decision-relevance, and be willing to cancel the ones that fail the test.

Four questions before you act

Before you act on any intelligence or attribution claim, put four questions to whoever brought it:

• What did we observe, and what did we infer from it?
• What is the analyst's stated confidence, and on what basis?
• What would change this assessment if we learned it?
• What decision does this inform, and what will we do differently as a result?