Cyber Threat Intelligence (CTI) for Australian organisations
CyberTI® is short for Cyber Threat Intelligence. Intelligence about who attacks Australian organisations, how, and through which exposures is what our detections, our attack surface monitoring and our advice are built on.
Cyber threat intelligence (CTI) is evidence-based knowledge about adversaries: who they target, the tactics, techniques and procedures (TTPs) they use, the infrastructure they run and when they are active, turned into something a defender can decide on. A list of malicious addresses is not intelligence until someone has worked out what it means for your environment.
An indicator of compromise (IOC), such as a file hash or a domain, is data. Intelligence adds the context: which actor uses it, which MITRE ATT&CK® technique it belongs to, and whether it matters to you. An indicator of attack (IOA) describes the behaviour itself, so it keeps working after the attacker changes the hash.
The work runs as a cycle: set the questions, collect from sources that can answer them, analyse, hand the result to whoever acts on it, and use their feedback to sharpen the next questions. At CyberTI® the cycle ends in a detection, a hunt, a remediation order or a piece of advice, not a report.
Intelligence that ends in a detection, not a report
Every indicator and technique is judged by one test: does it change what we detect, what we hunt for, or what you fix first?
Strategic, operational and tactical intelligence
Threat intelligence is split into three levels by who uses it and how quickly.
Tactical intelligence is used within minutes: indicators a detection rule can match. In Chevalier MDR this is the threat intelligence (IOC/IOA) capability, applied to the endpoint, network and cloud telemetry the platform already collects.
Operational intelligence describes how an adversary works, and is used by detection engineers and threat hunters over days and weeks. We express it as detections mapped to MITRE ATT&CK® v19 and as the artifact-driven and hypothesis-driven hunting on the Chevalier Hunter and Elite tiers.
Strategic intelligence is for the people who set priorities, over months: which threats apply to you and what that means for what you log and detect. It feeds an advisory engagement's logging policy and detection strategy.
How CyberTI® applies threat intelligence
Cyber threat intelligence is a practice delivered through Chevalier MDR, U-ASM, Advisory and Security Engineering, not a separate product.
Chevalier MDR turns intelligence into detections and hunts against your own telemetry. U-ASM applies exploitation intelligence to everything you expose to the internet. The next two sections cover both in depth.
Advisory sets the intelligence requirements: which actors and techniques matter to you, which sources feed your detections, and how they are kept current. Security Engineering connects threat intelligence sharing, enrichment and management platforms to the SIEM and EDR/XDR tooling you already own, so an indicator reaches a rule instead of a separate console.
CTI inside Chevalier MDR
Global threat intelligence is included in every Chevalier tier, and threat intelligence (IOC/IOA) is the first capability of the platform. What changes between tiers is how often, and how, analysts go hunting with it.
The path from intelligence to action is the same on every tier. An indicator or a described behaviour arrives as intelligence. It becomes a detection rule if it can be written as logic, or a hunt hypothesis if it needs an analyst to look. The rule fires, or the hunt finds something, on your own endpoint, network and cloud telemetry. An analyst confirms whether it is real, and then response actions execute. That last step is where intelligence becomes containment rather than a notification.
Tactical intelligence enters through the platform's global threat intelligence and its IOC/IOA matching. Operational intelligence enters through the detections themselves: we write them, map them to MITRE ATT&CK® v19 and review them weekly.
Targeted threat hunting runs quarterly on Chevalier and Vanguard, fortnightly on Hunter and weekly on Elite. Hunter and Elite add artifact-driven and hypothesis-driven hunting, which is where operational intelligence is used most directly: an analyst starts from what a campaign is known to do and looks for it in your estate before any rule has fired.
The limit, stated plainly: no feed is complete and no adversary announces their plans. Intelligence raises the odds that an intrusion is detected early. It does not guarantee it, which is why detection and hunting run alongside each other.
CTI inside U-ASM
U-ASM applies exploitation intelligence to your external attack surface. The question changes from what is vulnerable to what an attacker is likely to use against you right now.
Discovery comes first. U-ASM works outward from the same public artefacts an attacker starts with (domains, DNS records, certificates, IP space, open ports and the web servers behind them) and builds a live inventory of what you actually expose.
Each exposed service with a known weakness is then scored by exposure context, EPSS exploitation probability and CISA KEV status rather than raw CVSS. EPSS estimates the probability that a published vulnerability will be exploited in the wild within the next 30 days; KEV records vulnerabilities confirmed to be under active exploitation. One is prediction and the other is evidence, and both describe attacker behaviour. That makes them cyber threat intelligence in the strict sense, applied to your perimeter.
This is the second stage of the intrusion chain on our home page: an attacker finds the exposure first. Compromised credential discovery and similar-domain discovery add two more signals: credentials tied to your domains turning up in breach data, and look-alike registrations that are often the first visible sign of a phishing campaign.
The limit: EPSS and KEV describe attackers and vulnerabilities as a population, not the one actor who may be targeting you. They give the right default order for remediation, not a statement about anybody's intent towards your organisation.
Threat intelligence in the Australian context
Australian organisations have a public source of threat reporting, and obligations that assume you already know your threats and your exposure.
ASD's Australian Cyber Security Centre (ACSC) publishes an annual cyber threat report and ongoing advisories on activity against Australian networks. It is a sensible starting point for intelligence requirements.
ASD also runs the Cyber Threat Intelligence Sharing (CTIS) platform, a two-way service through which ASD and its government and industry partners exchange indicators of compromise at machine speed. ASD grants access through its Cyber Security Partnership Program.
Intelligence also sits under obligations you already carry. The Essential Eight expects at least daily vulnerability scanning of internet-facing services, and exploitation intelligence decides which findings to patch first. If you are a critical infrastructure entity, your SOCI Act risk management program became more prescriptive under the Enhanced CIRMP Rules from 10 June 2026. Under the Cyber Security Act 2024, businesses turning over more than $3 million report ransomware payments within 72 hours, and the OAIC expects a suspected eligible data breach to be assessed within 30 days.
What threat intelligence does not do
Intelligence is an input to detection and to decisions. Treated as an end in itself, it mostly produces volume.
It does not block anything by itself. An indicator does nothing until a detection, a hunt, a blocked connection or a patch acts on it.
A feed is not intelligence. Indicators without context produce alerts nobody can prioritise, and they age quickly: attackers change domains and file hashes far more often than they change how they operate.
No source covers every actor. A targeted intrusion by a capable adversary may leave nothing in any feed until after the fact, which is why detection, hunting and response sit alongside intelligence rather than depending on it.
Frequently asked questions
CTI stands for cyber threat intelligence: evidence-based knowledge about adversaries, produced so a defender can make a decision rather than just store an indicator. The short definition is in our security glossary.
Three, sorted by who uses them and how quickly. Tactical intelligence is the indicators a detection rule can match within minutes. Operational intelligence describes how an adversary works, and detection engineers and threat hunters use it over days and weeks. Strategic intelligence tells the people who set priorities, over months, which threats apply to an organisation like yours.
How each level shows up in our services is set out under strategic, operational and tactical intelligence above.
An indicator of compromise (IOC) is an artefact an attack leaves behind: a file hash, a domain or an IP address that a detection can match. An indicator of attack (IOA) describes the behaviour itself, such as credentials being read from memory or an office application launching a scripting tool.
Attackers can swap a hash or a domain in minutes, but changing how they operate is slow and costly, so IOAs keep working after IOCs go stale. Good detection uses both: IOCs for speed and certainty on known threats, IOAs for variants nobody has catalogued yet. Threat intelligence (IOC/IOA) is the first capability of Chevalier MDR, and the glossary defines both terms.
Threat intelligence is the input; threat hunting is an activity that uses it. A hunt is an analyst looking for known adversary behaviour in your own environment before a detection rule has fired.
In Chevalier MDR targeted hunting runs quarterly, fortnightly or weekly by tier, and the Hunter and Elite tiers add artifact-driven and hypothesis-driven hunting. A hypothesis-driven hunt starts from what a known campaign does and checks whether it is happening to you; an artifact-driven hunt starts from an indicator and follows where it leads.
No. A threat feed is a stream of indicators: one possible source of intelligence, not intelligence itself. A feed becomes useful once someone has decided which indicators matter to you, how long they stay relevant and what should happen when one is seen. That integration and enrichment work is what our security engineering practice builds around the tooling you already own.
You are probably already using some: a SIEM or MDR service that matches indicators is consuming tactical intelligence. Whether it is the right intelligence for you depends on requirements somebody has to set.
An advisory engagement sets them. If your exposure is the bigger unknown, U-ASM applies exploitation intelligence to everything you publish to the internet, and vulnerability scanning orders its findings by the same EPSS and KEV signals.
From several kinds of source, because no single one is complete: the global threat intelligence built into the Chevalier MDR platform; FIRST's EPSS scores and CISA's Known Exploited Vulnerabilities catalogue; the MITRE ATT&CK® knowledge base; and the compromised-credential and look-alike-domain monitoring that U-ASM runs against your domains.
The last source is our own work: what detections, hunts and investigations show our engineers goes back into the detections we write.
A conversation with a security engineer usually settles where to begin: intelligence requirements through advisory, intelligence-led detection through a Chevalier tier, or your external exposure through U-ASM. Contact us to talk it through, or request a demo to see the platform against your own environment.
Ready to see your attack surface the way an attacker does?
Book a walkthrough with an Australian-based security engineer. No scripted demo, no obligation.
Both forms deliver to info@cyberti.com.au.