In this article
Foundations
This page belongs to the security interview hub, which links the other security roles.
What is cyber threat intelligence?
Cyber threat intelligence (CTI) is information about threats that has been collected, processed and analysed so that someone can make a decision. Raw data, such as a list of internet addresses, becomes intelligence when it is given context: who is behind it, what it targets, how reliable it is and what to do about it. The National Institute of Standards and Technology (NIST) frames the purpose as helping organisations share and use threat information (NIST guide 800-150, October 2016).
Why it is asked: it separates analysts who add context from people who forward feeds.
What is the difference between data, information and intelligence?
Data is a raw fact, information is data organised into something readable, and intelligence is information analysed to support a decision for a specific audience. An address that appears in a log is data. A note that the address belongs to a known malware server is information. A recommendation to block it, with a confidence level and the reason, is intelligence.
Why it is asked: it shows whether you think about the consumer of your work.
What are strategic, operational and tactical intelligence?
The three levels are commonly separated by audience and time horizon. Strategic intelligence informs executives about trends and risks over months or years. Operational intelligence describes a specific campaign or actor so defenders can plan. Tactical or technical intelligence supplies the indicators and techniques that tools and analysts use today. Naming the audience for each level is the strong part of the answer.
Why it is asked: reports written for the wrong audience are ignored.
What is the intelligence cycle?
The intelligence cycle is the repeating loop that turns questions into products: set requirements, collect, process, analyse, disseminate and take feedback. The loop matters because intelligence without a stated requirement is a pile of data. A good answer gives an example requirement, such as "which groups target our sector and how do they get in?", and says how feedback changes the next cycle.
Why it is asked: it tests whether your work starts from a question.
Indicators and frameworks
What is an indicator of compromise?
An indicator of compromise (IOC) is an observable artefact, such as a file hash, internet address, domain name or registry key, that suggests a system has been breached or is being targeted. IOCs are easy to match in tools but also easy for attackers to change, so they go stale. State that limit and say how you would age and expire them.
Why it is asked: it checks that you know the limits of simple indicators.
What is the Pyramid of Pain?
The Pyramid of Pain is a model by David Bianco that ranks indicator types by how much it hurts an attacker when defenders detect them. From bottom to top the layers are hash values, internet addresses, domain names, network and host artefacts, tools, and tactics, techniques and procedures (TTPs) (Bianco, 1 March 2013). Detecting behaviour forces an attacker to learn new behaviours, which is slower than swapping an address.
Why it is asked: it tests whether you prioritise durable detections.
Text description of the diagram
- The layers run from hash values and internet addresses up to tools and tactics, techniques and procedures.
- Detecting behaviour forces an attacker to learn new behaviours.
What are TTPs?
TTPs are tactics, techniques and procedures, the behaviour of an adversary. MITRE explains the split in its Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework: tactics are the "why" behind an action, techniques are the "how", and procedures are the specific implementations of a technique or sub-technique (MITRE ATT&CK FAQ, read October 2026). Behaviour is harder for an attacker to change than an address, which is why TTPs top the Pyramid of Pain.
Why it is asked: the term is used constantly, and precision shows experience.
What is MITRE ATT&CK and how do you use it?
ATT&CK is a knowledge base of adversary behaviour and a taxonomy of actions across an attack's lifecycle, maintained by MITRE; its FAQ describes content version 20 and a twice-yearly update cycle (MITRE ATT&CK FAQ, read October 2026). Use it to describe an actor's behaviour in a common language, to map detections and find gaps, and to plan tests against the techniques that matter to your organisation.
Why it is asked: it is the shared vocabulary of the field. Read more: security operations centre (SOC) analyst interview questions, where the same techniques turn into alert triage.
What is the Cyber Kill Chain, and how does it differ from ATT&CK?
The Cyber Kill Chain is a Lockheed Martin model that describes an intrusion as seven steps, developed as part of its Intelligence Driven Defense approach (Lockheed Martin, read October 2026). It is a linear sequence that helps place where to interrupt an attack. ATT&CK is a larger catalogue of techniques that does not assume one fixed order. Many teams use both.
Why it is asked: it tests whether you can compare models and pick one for a task.
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →Sharing intelligence
Why do organisations share threat information?
Sharing lets defenders learn from an attack someone else already saw, so each organisation does not rediscover the same threat. NIST's guide helps organisations set up and take part in sharing arrangements, including how to define goals and control how data is distributed (NIST guide 800-150, October 2016). The risk is leaking sensitive details, so sharing needs rules about what travels and to whom.
Why it is asked: the field depends on trust and handling discipline.
What is the Traffic Light Protocol?
The Traffic Light Protocol (TLP) is a set of labels, standardised by the Forum of Incident Response and Security Teams (FIRST), that tells recipients how far shared information may travel. Version 2.0 has four labels: red for named recipients only, amber for need-to-know within the organisation and its clients, green for the recipient's community but not public channels, and clear for no limit. Amber also has a stricter form, amber+strict, which limits sharing to the recipient's own organisation (FIRST, TLP 2.0, August 2022).
Why it is asked: mishandling a label can end a sharing relationship.
What is STIX?
Structured Threat Information Expression (STIX) is a language for sharing cyber threat intelligence in a consistent, machine-readable format. The current standard from the Organization for the Advancement of Structured Information Standards (OASIS) is version 2.1, shown with its first errata dated 2 April 2025 (OASIS STIX 2.1 specification). A machine-readable format lets tools ingest intelligence without an analyst retyping it.
Why it is asked: it tests familiarity with the plumbing, not only the analysis.
Analysis and attribution
How do you evaluate a threat intelligence feed?
Judge a feed on source reliability, timeliness, relevance to your environment, context and false-positive rate. Run it against your own logs for a test period and measure how many matches were true and actionable. A feed with a million indicators that never matches your estate is noise, so ask what decision each piece of data supports.
Why it is asked: buying and trusting feeds is a daily judgement.
How do you prioritise which threats matter to your organisation?
Start from what you protect and who would want it, then weigh likelihood against impact for each plausible actor and technique. A retailer and a bank face different adversaries. Use a threat model to list the assets, the ways in, and the controls already in place, and spend effort where a likely technique meets a weak control.
Why it is asked: no team can track everything.
How do you attribute an attack to an actor?
Attribution is a judgement built from overlapping evidence: infrastructure, tooling, techniques, targeting, timing and language artefacts. No single clue is proof, because attackers reuse and imitate each other's tools. State a confidence level, such as low, moderate or high, say what would change it, and separate "this behaviour matches a known cluster" from "this named group did it".
Why it is asked: overconfident attribution is a classic analyst failure. Prepare one story where new evidence changed your conclusion; see behavioural interview preparation.
What is the difference between threat hunting and threat intelligence?
Threat intelligence supplies knowledge about adversaries; threat hunting is a proactive search in your own environment for signs of them that alerts missed. Intelligence often starts a hunt: a report names a technique, and a hunter looks for it in logs. The hunt's findings then feed back as new intelligence about your environment.
Why it is asked: the two roles overlap, and interviewers want to see you understand the hand-off. For the defensive-engineering side, see application security interview questions.
What would you do with a new indicator from a trusted partner?
Check its context and handling label first, then search your logs for past matches, not just future ones. If it matches, scope the activity and escalate to incident response, the hand-off a SOC analyst will usually own. If not, add it to detection with an expiry date and a note on its source, and record the outcome so you can measure the partner's value later.
Why it is asked: it shows the full path from receipt to action.
Reporting
How do you write a threat report for executives?
Lead with the decision: what happened or may happen, how likely it is, what it would cost, and what you recommend. Keep technical detail in an appendix. Use plain words, one page, and a stated confidence level. An executive should be able to act on the first paragraph without knowing any indicator.
Why it is asked: analysis is worthless if the reader cannot act.
Follow-up questions
Is an indicator still valid a month later?
Not automatically. Hashes and addresses are the cheapest layers of the Pyramid of Pain to change, so give each indicator a source, a first-seen date and an expiry, and re-check it before acting. An old address may now belong to an innocent host. Practise a short script that expires old indicators; see coding interview preparation.
How does amber+strict differ from amber?
Amber lets the recipient share on a need-to-know basis within their organisation and with its clients, while amber+strict restricts sharing to the recipient's own organisation only (FIRST, TLP 2.0, August 2022). The source may also add restrictions that recipients must follow.
How do you state confidence in a finding?
Say the level (low, moderate or high), the evidence it rests on, and what new evidence would raise or lower it. Keep the claim ("this behaviour matches a known cluster") apart from the stronger claim ("this named group did it"). This is the answer's judgement, not a quotation from a standard.
- Intelligence is analysed information tied to a decision, not a list of indicators.
- Indicators decay: addresses and hashes are cheap for attackers to change, behaviour is not.
- ATT&CK gives a shared language for techniques; the kill chain is a seven-step view of an intrusion.
- Handle shared information by its TLP label, and share in machine-readable formats such as STIX.
- State confidence in every attribution, and write the first paragraph for the person who decides.
Sources
- Guide to Cyber Threat Information Sharing (NIST SP 800-150) — NIST, 1 Oct 2016
- MITRE ATT&CK FAQ — MITRE, 24 Oct 2026
- Traffic Light Protocol (TLP) version 2.0 — FIRST, 1 Aug 2022
- STIX Version 2.1 (OASIS Standard, errata 01) — OASIS, 2 Apr 2025
- The Pyramid of Pain — Enterprise Detection and Response (David J. Bianco), 1 Mar 2013
- Cyber Kill Chain — Lockheed Martin, 24 Oct 2026
