Skip to content
Domain

Threat Intelligence

Threat Intelligence is about knowing your enemy. You'll track threat actors, analyze attack patterns, and provide actionable intelligence to defenders. This domain turns raw data into insights that drive security decisions.

TI15 certifications

Why TI matters

Reactive security doesn't cut it anymore. Threat intelligence helps organizations anticipate attacks before they happen. You'll be the early warning system, giving defenders the intel they need to stay ahead of attackers.

Key areas

  • Threat actor tracking and attribution
  • Indicators of Compromise (IOCs) analysis
  • Malware analysis and reverse engineering
  • Threat intelligence platforms (TIPs)
  • OSINT and dark web monitoring
  • Strategic and tactical intelligence reporting

Career path in TI

  1. Entry level
    Start as junior threat analyst, learning to identify and categorize threats
  2. Mid level
    Become senior analyst or threat hunter, leading investigations
  3. Senior level
    Advance to threat intelligence lead, building intel programs

Essential skills

OSINT techniquesMalware analysisPython scriptingIntelligence frameworks (MITRE ATT&CK)Analytical thinking

Typical roles

Pay and outlook for these roles

US figures from the Bureau of Labor Statistics for the closest BLS occupation to each role. BLS doesn't report pay by specialty and counts most of these roles only within a wider occupation, so each card covers every job in it.

Certifications for TI

Entry2

CompTIA

Entry

CompTIA Security+

Vendor-neutral proof of core security administration skills, tested partly through performance-based tasks and mapped by CompTIA to DoD 8140 work roles

Exam
$439
Study
3-6 months

Centri

Entry

Blue Team Level 1

Proves you can investigate phishing, forensic, threat intelligence and SIEM evidence in a 24-hour practical incident response exam

Exam
$529
Study
3-6 months

Intermediate7

EC-Council

Intermediate

Certified Ethical Hacker

Tests recognition of attack techniques across nine domains in a 125-question exam, with an optional six-hour hands-on Practical leading to CEH Master

Exam
$950
Study
4-6 months

ISC2

Intermediate

Associate of ISC2 (CISSP Pathway)

The designation ISC2 grants for passing the CISSP exam before you have five years of experience, with six years to qualify

Exam
$749
Study
4-8 months

CompTIA

Intermediate

CompTIA Cybersecurity Analyst+

Tests a security analyst's ability to detect threats, prioritize vulnerabilities and handle incidents using real tool output, now on the CS0-004 exam

Exam
$439
Study
3-6 months

GIAC

Intermediate

GIAC Security Essentials

Proves hands-on defensive skill across Windows, Linux, networks and cloud in a four-hour open-book exam that includes CyberLive virtual machine tasks

Exam
$999
Study
4-6 months

GIAC

Intermediate

GIAC Certified Incident Handler

Proves you can detect, contain and investigate attacks by understanding the tools behind them, with hands-on CyberLive tasks in live virtual machines

Exam
$999
Study
4-6 months

Hack The Box

Intermediate

Certified Defensive Security Analyst

Proves you can investigate intrusions across several lab networks for seven days, then write an incident report an instructor grades

Exam
$210
Study
3-6 months

Advanced4

CompTIA

Advanced

CompTIA SecurityX

CompTIA's senior engineering and architecture exam, formerly CASP+, scored pass/fail and built almost entirely on scenario and requirements-based objectives

Exam
$544
Study
6-12 months

Centri

Advanced

Blue Team Level 2

Proves you can run a 72-hour intrusion investigation, from malware analysis to threat hunting, and write a hand-marked report

Exam
$2,648
Study
6-12 months

GIAC

Advanced

GIAC Network Forensic Analyst

Proves you can trace an attack from network evidence alone, using packet captures, NetFlow, proxy logs and protocol analysis, in a hands-on CyberLive exam

Exam
$999
Study
4-6 months

GIAC

Advanced

GIAC Certified Intrusion Analyst

Proves you can read network traffic at the header level and write detection rules, tested partly through hands-on CyberLive tasks

Exam
$999
Study
4-6 months

Expert2

GIAC

Expert

GIAC Reverse Engineering Malware

Proves you can reverse-engineer Windows malware and malicious documents with disassemblers and debuggers, including unpacking samples and defeating anti-analysis tricks

Exam
$999
Study
6-9 months