Direction
Agree priority intelligence requirements, audiences and decisions. Define what a useful answer would look like.
← Threat HubFrom threat data
THREAT HUB / MANAGED CTI
From threat data
to useful decisions.
A managed intelligence service shaped around the questions your team needs answered. Collection follows your priorities; analysts assess relevance before it reaches you.
The service
Intelligence that answers your questions.
Most teams already receive alerts, feeds and sector reporting. The hard part is deciding what is relevant to their services, suppliers and decisions. Managed CTI starts with priority intelligence requirements: the questions you need answered and the actions an answer could change.
Collection and analysis are then tuned to those requirements. An analyst checks significance, source quality and confidence before findings are passed to your team.
Intelligence lifecycle
Requirements first. Review throughout.
Collection
Choose sources and collection paths for your sector, technology, exposed estate, suppliers and jurisdictions.
Processing
Deduplicate, correlate and check material so raw items do not become unexamined alerts.
Analysis
Assess relevance, credibility and confidence. Explain what is known, what remains uncertain and what could change.
Dissemination and feedback
Deliver working-level alerts and periodic briefings, then revisit the requirements as the organisation and threat picture change.
Outputs
The right information for each audience.
Cadence and coverage are agreed during scoping. A small team may need an embedded intelligence capability; a mature team may need focused analysis against a few difficult questions.
Typical service components
- Documented priority intelligence requirements
- Analyst-reviewed alerts when a requirement is met
- Periodic threat assessments with confidence levels
- Sector, adversary and third-party coverage
- Leadership summaries focused on decisions
- Regular requirement and collection reviews
Example requirements
Specific questions beat more feeds.
Are credentials linked to our critical suppliers circulating in places that change our exposure?
Which ransomware groups are targeting firms with our technology and operating footprint?
What new attacker behaviour should change our detection, response or exercise priorities?
These are examples. Your requirements are agreed from your own services, risk decisions and information gaps.
Frequently asked questions
Before we begin.
Is this a threat feed or a platform?
It is an analyst-led service. Feeds and platforms may be useful sources or delivery tools, but the work is defining requirements, assessing relevance and explaining implications.
Can we use our existing sources?
Yes. We can use suitable existing subscriptions and internal context, then identify gaps or duplication during scoping.
How often will we hear from you?
Urgent findings are escalated against agreed criteria. Periodic reports, briefings and requirement reviews follow the cadence set in the statement of work.
Can managed CTI support a later TLPT?
Yes. Well-defined requirements and a maintained threat picture can inform the scope and preparation of a later targeted intelligence engagement.
Talk to SMARTSEC
Start with your objective.
Tell us the decisions, test or exercise this work needs to support. We'll suggest a scope and the right next step.