What is Threat Intelligence? A Complete Enterprise Guide to Threat Intel

Threat Intelligence (TI) refers to the methods and practices by which an enterprise or organization collects, aggregates, and analyzes external and publicly available information to identify, assess, and provide early warning of risks that may threaten its operations, assets, supply chain, or reputation. Threat intelligence spans cyber security threats (such as malware, APT attacks, and dark web intelligence), geopolitical risk, sanctions and compliance risk, and supply chain and counterparty risk. Effective threat intelligence turns scattered raw data into actionable decision support, enabling decision-makers to recognize warning signs before risks materialize. This article fully explains the definition of threat intelligence, OSINT data sources, sanctions screening, dark web monitoring, and geopolitical risk assessment, and describes how LargitData InfoMiner supports enterprises in building threat intelligence capabilities.

The Definition of Threat Intelligence and the Intelligence Cycle

Threat intelligence is not a single tool but a continuously operating intelligence cycle: from requirement definition, data collection, processing and aggregation, and analysis and assessment, through to intelligence output and feedback. Based on its own industry, supply chain structure, and regulatory environment, an enterprise defines the threat dimensions it needs to monitor, then uses automated collection and human assessment to distill vast volumes of public data into a small number of action-worthy alerts. Unlike traditional security tools that focus on events that have already occurred, threat intelligence emphasizes forward-looking early warning and situational awareness.

Threat intelligence is generally divided into three tiers: the strategic tier focuses on long-term trends and geopolitical risk to inform senior decision-makers' strategy; the operational tier focuses on the intent and tactics of specific threat actors; and the tactical tier focuses on concrete indicators of compromise (IoCs) and technical details that can be defended immediately. When adopting threat intelligence, enterprises should design intelligence outputs at the appropriate tier for each role's needs.

OSINT (Open Source Intelligence) and Data Sources

OSINT (Open Source Intelligence) is the most important foundation of threat intelligence. It refers to collecting intelligence from public, legally accessible sources, including news media, government announcements, court judgments, company registration data, social media, forums, professional databases, and public discussions on the dark web and deep web. The value of OSINT lies in its broad coverage, controllable cost, and its ability to be cross-validated with other intelligence sources to improve the credibility of assessments.

Common OSINT data sources include: mainstream news and industry media; public discussions on social platforms and online forums; announcements and sanctions lists from governments and regulators worldwide; public company registration and financial data; court judgment documents and litigation records; government procurement and tender public data; and threat indicators publicly shared by the security community. Enterprises should establish a standardized source whitelist and collection process to prevent noise from degrading assessment quality.

Key Capabilities of a Threat Intelligence Platform

• Multi-source automated collection: real-time gathering across news, social media, forums, government announcements, and public databases.
• Sanctions screening: cross-checking against public sanctions and watchlists such as OFAC, EU, and UN to identify sanctioned entities and related parties.
• Dark web and deep web monitoring: tracking public dark web discussions, data breach intelligence, and underground market activity.
• Geopolitical risk assessment: monitoring country risk, policy changes, and cross-border sensitive issues affecting the supply chain and operations.
• Adverse media and litigation screening: automatically detecting counterparties' disputes, lawsuits, penalties, and bankruptcy records.
• Entity relationship analysis: building relationship graphs among people, companies, and events to reveal hidden risk networks.
• Sentiment and anomaly-in-volume detection: using AI to interpret public sentiment and issue alerts before risks spread.
• Disinformation detection: identify false content spreading across platforms and trace its origin and diffusion path.
• 資訊操弄研判：分析敘事框架、協同帶風向的手法，以及跨平台擴散的規模與時序。
• Anomalous account detection: expose troll armies, bots, and coordinated inauthentic behavior clusters.
• Alert grading and notification: automatically grading by risk level and pushing alerts to the responsible personnel.
• Continuous monitoring and timeline tracking: maintaining long-term observation of key subjects and recording how risk events evolve.
• Automated report generation: aggregating intelligence into readable risk reports that support decision-making and audit trails.

Use Cases

• Financial institutions screen sanctions lists and adverse intelligence during credit, KYC, and counterparty reviews.
• Manufacturing and technology firms assess suppliers' country risk, financial stability, and compliance records.
• Government agencies and critical infrastructure operators conduct continuous monitoring of geopolitical and cyber security threats.
• 公部門與關鍵基礎設施單位偵測不實資訊與資訊操弄，並辨識異常帳號與協同帶風向行為。
• Due diligence before M&A and investment, understanding the potential risks of the target company.
• Compliance and audit teams establish verifiable, traceable risk review processes.

Sanctions Screening and Dark Web Monitoring

制裁名單比對是威脅情報中最常被納入法遵流程的能力之一。美國財政部海外資產控制辦公室（OFAC）維護的 SDN 名單、歐盟與聯合國的制裁清單，都是公開可查的官方來源。在與交易對象往來前比對這些名單，可協助降低誤與受制裁對象往來的風險，但要說明清楚：名單比對本身不能保證免於法律責任。制裁規範的適用取決於法域、交易性質、貨物與資金流向、實體的控制關係與實質受益人，而名單也常有更新落差與同名異人的問題。

因此比對機制的設計重點在於降低漏判與誤判：需處理名稱變體與音譯差異、追溯持股與控制關係、對命中案例保留人工覆核紀錄，並定期確認名單來源的更新頻率。實際適用範圍與作業要求，仍應以主管機關最新公告及貴公司法務或法遵單位認定為準。

暗網監控則聚焦於一般搜尋引擎無法索引的網路空間。外洩的憑證與資料可能出現在多種地方——公開的貼文平台、程式碼倉庫、檔案分享站、通訊軟體群組，以及地下論壇與交易市場；出現的順序與可見程度因事件而異，並沒有固定路徑，因此不宜假設「一定會先在暗網出現」而只監控單一類型的來源。

較務實的做法是把公開索引來源與地下來源並行監控，並針對自家的關鍵識別字（公司網域、內部系統名稱、主管姓名、產品代號）建立長期觀測。同時要有心理準備：這類情資的雜訊與過期資料比例高，命中後仍需人工驗證是否為真實外洩、屬於哪一次事件、以及影響範圍，否則容易在假警報上耗盡人力。

Geopolitical Risk and Supply Chain Intelligence

Geopolitical risk is especially important for Taiwanese enterprises. Changes in cross-strait relations, international trade policy, technology controls, and export controls can all disrupt the supply chain and markets within a short time. By continuously monitoring policy announcements, international news, and industry developments across countries, threat intelligence helps enterprises assess country risk in advance, identify affected supply nodes, and plan alternatives. Combining geopolitical intelligence with supply chain data shifts risk management from reactive response to proactive positioning.

Deployment Options and Data Governance

威脅情報平台可依安全需求選擇雲端或地端部署。雲端部署導入快速、維運成本低，適合多數企業；地端部署則把資料處理與模型推論保留在自有網段，適合對資料主權與機密等級要求高的公部門、高科技製造與金融客戶。LargitData 提供地端部署選項（RAGi On-Premise 與 QubicX 地端 AI 平台），可支援推論資料不出境的架構要求。

這裡要誠實說明地端的邊界：把推論放在內網可以移除「資料被送到第三方雲端」這條路徑，但不等於資料沒有其他外流可能。軟體與模型更新、廠商遠端維運通道、系統遙測與錯誤回報、備份媒體、以及內部帳號權限過大或人員自行匯出，都仍是需要個別設計控制措施的風險點。因此地端部署應搭配明確的資料流盤點、更新與維運通道的存取管控、遙測關閉或白名單設定、備份加密與保管程序，以及最小權限與稽核日誌。

在資料治理方面，威脅情報應以公開可取得的資訊為限，並落實存取權限控管、稽核留痕與資料保存政策。不過要提醒一個常見的誤解：資訊「公開」並不等於可以任意蒐集、保存與再利用。合法性需逐一來源判斷，至少要看四件事——該平台的使用條款是否允許自動化擷取、內容的著作權範圍、資料中是否含有個人資料及其處理是否落在特定目的的必要範圍內，以及是否涉及跨境傳輸。

實務上建議建立來源台帳，逐一記錄每個來源的取得方式、條款依據、更新頻率、是否含個人資料、保存期限與刪除機制，並在情報產出中保留可回溯的原始出處。歐盟一般資料保護規範（GDPR）在涉及歐盟境內當事人時可能具有域外效力，跨境情資蒐集尤須留意。實際適用範圍與作業要求，仍應以主管機關最新公告及貴機關（或貴公司法務）認定為準。