Cybersecurity area
CTI
CTI, or Cyber Threat Intelligence, provides actionable context about threats, attackers, campaigns, indicators of compromise, vulnerabilities, and reputation risks.
Acronym Glossary
This glossary explains acronyms used in this part so the intended security function is clear.
- CTI
- Cyber Threat IntelligenceContextual information about threats, attackers, campaigns, indicators of compromise, and reputation risks.
- APT
- Advanced Persistent ThreatA more sustained or targeted attacker, group, or campaign activity using advanced techniques and persistence.
What This Area Covers
CTI provides information about threats, campaigns, indicators of compromise, vulnerabilities, reputation, dark web activity, and attacker behavior. The goal is not to collect the largest possible amount of data, but to deliver context that improves detection, prevention, vulnerability prioritization, and response.
Why It Matters
Without context, many alerts look the same. Threat feeds, sandboxing, dark web monitoring, vulnerability databases, APT monitoring, and reputation monitoring help determine which signals matter for a specific organization. CTI is most valuable when connected to SIEM, SOAR, EDR/XDR, firewalls, exposure management, and incident response processes.
How To Navigate This Area
Threat intelligence is valuable when it is not only a list of indicators, but enters detection, prioritization, and response. A practical view distinguishes technical feeds, tactical context, strategic reporting, dark web monitoring, sandbox analysis, reputation data, and connection to the organization's actual assets.
When selecting CTI, it is necessary to separate technical indicators, tactical context, strategic reporting, and monitoring of external exposure. Not every feed is useful for every organization. Source quality, filtering, automated usage, asset mapping, and noise reduction matter.
The technology list below works as a map of the CTI area. The practical sequence is to name the security problem first, select the closest technology category second, and only then compare relevant vendors. This helps separate similar-sounding solutions and reduces the risk of adding another tool without a clear architectural role.
Technical Section Schema
Questions To Ask When Selecting A Solution
- Which threat types are most relevant for the organization?
- Will CTI data support detection, blocking, investigation, or reporting?
- How will CTI connect to specific assets, vulnerabilities, and incidents?
- How will indicators be cleaned, prioritized, and distributed to tools?
- Is dark web, brand reputation, or VIP monitoring also required?
How To Use This Section
Each technology page expands one category, explains its architectural role, and lists SecTec portfolio vendors related to that area. The section page is therefore the orientation layer, while the detail pages support concrete mapping to solutions.
Vendors From The SecTec Portfolio
Attack coverage and defensive context
MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.
Practical attack scenarios
- Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
- Credential theftAn adversary obtains passwords, tokens, sessions, or other authentication material and uses it to expand access.
- Public application or API abuseAn adversary exploits a vulnerable web application, API, client-side code, or software component for initial access and execution.
- Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
- Malware and Command and ControlMalicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
- Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
- Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
- Reconnaissance and attack surface mappingAn adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.
- Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
- Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
- Defense evasion and control impairmentAn adversary hides activity, removes evidence, disguises code, or weakens security tools, encryption, firewalls, and recovery mechanisms.
- Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
- Unsafe consumption of third-party APIsAn application trusts data or redirects from a partner API more than ordinary input and propagates a supplier compromise into its own environment.
- Credential stuffing and password sprayingAn adversary automatically tests leaked username-password pairs or a small set of common passwords against many accounts.
- MFA fatigue, push bombing, and interceptionAn adversary floods a user with MFA prompts, intercepts a code, or uses social engineering to make the user approve an unauthorized sign-in.
Relevant ATT&CK techniques
- T1027 · Obfuscated Files or InformationDetect, Validate
- T1059 · Command and Scripting InterpreterDetect, Validate
- T1071 · Application Layer ProtocolDetect, Respond, Validate
- T1078 · Valid AccountsDetect, Respond, Validate
- T1095 · Non-Application Layer ProtocolDetect, Validate
- T1105 · Ingress Tool TransferDetect, Validate
- T1110 · Brute ForceDetect, Respond
- T1190 · Exploit Public-Facing ApplicationDetect, Respond, Validate
- T1486 · Data Encrypted for ImpactDetect, Respond, Validate
- T1566 · PhishingDetect, Respond, Validate
- T1568 · Dynamic ResolutionDetect, Validate
- T1573 · Encrypted ChannelDetect, Validate
- T1589 · Gather Victim Identity InformationDetect, Respond
- T1595 · Active ScanningDetect, Respond, Validate
- T1598 · Phishing for InformationDetect, Respond