Explain the difference between tactical, operational and strategic threat intelligence, with an example of each.

The levels differ by audience, content and shelf life.

Tactical intelligence serves the SOC and detection engineering. It is concerned with specific observables and behaviours — the command line pattern a loader uses, the URI structure of a C2 protocol, a set of indicators with context on how they were obtained. Its shelf life is days to weeks because the underlying artefacts are cheap for the adversary to change. Example: a note to detection engineering describing how a particular loader establishes persistence, which telemetry would reveal it, and the benign software that would produce false positives.

Operational intelligence serves incident response, threat hunting and security management. It is concerned with campaigns and intrusion sets — how a particular actor operates across an intrusion, what they tend to do after initial access, which sectors they are hitting. Shelf life is months, because tradecraft changes more slowly than infrastructure. Example: a profile of an intrusion set targeting your sector, mapped to ATT&CK, with the hunt hypotheses it generates.

Strategic intelligence serves leadership, risk and the board. It is concerned with the landscape: who is likely to target this organisation and why, how capability is trending, what regulatory or geopolitical shifts change the picture. Shelf life is quarters to years. Example: an assessment that ransomware operators are increasingly targeting the organisation's sector through third-party suppliers, and what that implies for the supplier assurance programme and its budget.

The most common failure in practice is mismatching level to audience — sending an indicator list to a CFO, or sending a general statement about an elevated threat environment to engineers who needed a query.