Threat intelligence leadership, on demand.
A part-time head of threat intelligence to build, lead and mature your cyber threat intelligence capability — so intelligence drives decisions, detection and testing instead of sitting in a feed.
Most threat intelligence functions lack leadership, not data.
Feeds, platforms and analysts are easy to buy. What’s hard is deciding what intelligence the organisation actually needs, directing collection and analysis against it, and making sure it changes what the business does.
A Fractional Threat Lead brings that leadership — over 15 years of experience in threat intelligence and offensive security, including delivering the intelligence phase of TIBER-EU, DORA TLPT and iCAST engagements — for the days you need it.
When a Fractional Threat Lead makes sense.
A SOC without CTI
You have security operations, but no one directing threat intelligence to inform them.
Analysts without a lead
You have CTI analysts, but no senior leader setting direction and developing the team.
Feeds without value
You’re paying for feeds and platforms but struggling to show what they change.
Preparing for TLPT
You expect a DORA TLPT or TIBER-EU test and need your intelligence picture and control team ready.
Leadership across the intelligence lifecycle.
Intelligence requirements
Priority intelligence requirements agreed with stakeholders from the board to the SOC.
CTI operating model
A programme, processes and reporting rhythm that turns collection into decisions.
Sources & tooling
Vendor-neutral selection and rationalisation of feeds, platforms and sources.
Team development
Mentoring, structure and analytic standards for your analysts — and help hiring.
Threat-informed defence
Intelligence that drives detection engineering, hunting and SOC priorities.
Threat-informed testing
Intelligence that shapes penetration testing and red team scenarios.
Leadership briefings
Strategic threat briefings that help boards and executives make decisions.
TLPT readiness
Preparing your intelligence picture and control team for DORA TLPT or TIBER-EU.
Intelligence sharing
Participation in trusted sector sharing communities, handled under TLP.
Take your capability to the next level.
We assess where your threat intelligence capability is today and build a practical roadmap to where it needs to be.
Ad hoc
Intelligence consumed informally, if at all; no defined requirements.
Reactive
Feeds and alerts in place, but little analysis or prioritisation.
Defined
Documented requirements, processes and regular reporting to stakeholders.
Threat-informed
Intelligence routinely drives detection, testing, risk and investment decisions.
From assessment to a working programme.
Days 1–30 · Assess
Stakeholder interviews, maturity assessment, review of sources and tooling.
Days 31–60 · Define
Priority intelligence requirements, operating model and roadmap agreed.
Days 61–90 · Operate
Reporting rhythm live, first leadership briefing and team development under way.
Two ways to get value from threat intelligence.
- Fractional Threat Lead — we lead and build your capability, team and programme.
- Managed threat intelligence — we deliver the intelligence for you, as a service.
- Many organisations combine both: managed intelligence while the in-house function is built, then a lead to grow and own it.
Flexible ways to engage.
Every engagement is shaped around what you need now — and can change as you grow.
Fractional
A set number of days each month, giving you continuity of senior leadership at a fraction of a full-time cost.
Interim
Full-time or near full-time cover between permanent hires, during a transformation or after a departure.
Project-based
A defined outcome — a regulatory readiness programme, a strategy, a capability build — with a clear end point.
Fractional Threat Lead questions.
What is a Fractional Threat Lead?
A part-time head of threat intelligence who sets direction for your CTI capability — defining intelligence requirements, leading analysts, choosing sources and tools, and making sure intelligence informs decisions.
We don’t have any CTI analysts yet. Is this still useful?
Yes. A Fractional Threat Lead can design the capability from scratch, combine managed intelligence with in-house roles, and help you recruit the right people.
Do you recommend particular platforms or feeds?
No. Our advice is vendor-neutral and based on your requirements, budget and existing tools.
Can you help us prepare for DORA TLPT or TIBER-EU?
Yes. We can prepare your intelligence picture and control team. If we advise your control team, we won’t also act as the threat intelligence provider for that test, to keep roles independent.
How many days a month is typical?
It depends on the size of your team and programme. Many engagements start with more time during the first 90 days, then settle into a regular monthly rhythm.
Explore related services.
Need threat intelligence leadership?
Tell us about your capability today and where you need it to be.