{ "vercy": "1.0-draft", "publication": { "status": "research-draft", "adjudicationStatus": "unreviewed", "publishableCanonical": false, "generatedAt": "2026-09-12T08:57:33Z", "providers": [ "Codex" ], "breadth": "recalled by Codex without web access - no source was read", "missingProviders": [], "pass": 2, "cost": { "grok": { "seconds": 27.3, "error": "Reading additional input from stdin...\nOpenAI Codex v0.153.4\n--------\nworkdir: R:\\02_PROJECTS\\02_Meta_Models_Platforms\\Ver.cy\\current\\thing-registry-backlog\nmodel: gpt-6-astra\nprovider: openai\napproval: never\nsandbox: read-only\nreasoning effort: none\nreasoning summaries: none\nsession id: 01a094d4-ed03-7dc1-b900-3f667ec175b6\n--------\nuser\nDescribe what is already known about one registered thing. Answer as JSON only, no prose around it.\n\nThing: cyber threat intelligence\nSense to describe: (none recorded)\nDomain code: ACT.ACT\nAlso known as: (none)\n\n\nContext for this batch of 1001 things:\n# Batch", "usd": 0.0, "recall": true }, "codex": { "seconds": 77.1, "error": "Reading additional input from stdin...\nOpenAI Codex v0.153.4\n--------\nworkdir: R:\\02_PROJECTS\\02_Meta_Models_Platforms\\Ver.cy\\current\\thing-registry-backlog\nmodel: gpt-6-astra\nprovider: openai\napproval: never\nsandbox: read-only\nreasoning effort: none\nreasoning summaries: none\nsession id: 01a094d4-ed11-7fd3-ad1b-aacd70cd905e\n--------\nuser\nYou are drafting a Vercy meta-model for one registered thing. Answer as JSON only, no prose around it.\n\nThing: cyber threat intelligence\nRegistry id: vr.tr.cyber-threat-intelligence\nPlane / domain: ACT / ACT.ACT\nRegistry definition: (none recorded)\nNames folde" } }, "enrichment": { "pass": 3, "engine": "claude", "producedAt": "2026-10-06T12:00:00Z", "ingestedAt": "2026-10-06T08:49:30+00:00", "fields": [ "agent_conduct", "ethics", "owners", "standards_and_regulation" ] }, "gate": { "passed": true, "version": "1.0", "at": "2026-10-07T10:10:29+00:00", "evidence": [ "completeness 1.00", "sense: Wikidata description", "2 live sources", "review by codex: pass" ] } }, "metaModel": { "id": "THING-Q25053549", "registryId": "vr.tr.cyber-threat-intelligence", "name": "cyber threat intelligence", "version": "0.1.0-research.1", "entryKind": "thing", "family": "Thing Registry", "domain": [ "ACT.ACT" ], "status": "research-draft" }, "canonicalUrl": "https://ver.cy/models/thing/q25053549/", "model": { "registry_id": "vr.tr.cyber-threat-intelligence", "name": "cyber threat intelligence", "purpose": "Enable an agent to recognise cyber threat intelligence, assess its evidential strength and relevance, and determine how it may inform authorised defensive decisions.", "definition": "Cyber threat intelligence is information about cyber threats that has been evaluated and analysed in context to support decisions about preventing, detecting, responding to, or managing those threats, with the term also used for the activity that produces it.", "scope_statement": "This model owns cyber threat intelligence as a decision-oriented analytical activity and the assessments it produces, recording requirements, cyber threat evidence, interpretation, uncertainty, dissemination constraints and feedback while leaving underlying incidents and defensive execution to neighbouring models.", "in_scope": [ "Intelligence requirements tied to exposed assets, threat scenarios and named decision owners", "Collection and evaluation of cyber threat reporting, telemetry and external intelligence", "Analysis of adversary behaviour, capabilities, targeting and competing explanations", "Intelligence assessments with confidence, applicability and temporal limits", "Controlled dissemination, defensive recommendations and consumer feedback" ], "out_of_scope": [ "General vulnerability management and remediation execution", "Security monitoring infrastructure and raw telemetry storage", "Incident response case management and containment execution", "Malware reverse engineering as a standalone technical investigation", "Offensive cyber operations and access acquisition", "Enterprise risk ownership and final acceptance of business risk" ], "distinguishing_features": [ "A proposed intelligence product can identify the threat-related decision or requirement it serves; a raw feed subscription alone does not demonstrate this.", "An assessment separates observed cyber activity from analytical interpretation and exposes the evidence supporting its conclusions.", "An indicator is accompanied by context, relevance and temporal limits before the model treats it as decision-ready intelligence.", "A threat assessment explains adversary behaviour or plausible hostile activity; a vulnerability inventory alone describes weaknesses without establishing a threat.", "An intelligence recommendation remains distinguishable from permission to execute blocking, containment or other operational changes." ], "characteristics": [ { "name": "Intelligence requirement", "kind": "relation", "unit_or_values": "Linked decision owner, intelligence question, protected assets and decision deadline", "why_it_matters": "Provides a concrete test of whether collection and analysis serve an actual decision." }, { "name": "Intelligence orientation", "kind": "category", "unit_or_values": "Declared taxonomy, potentially strategic, operational, tactical or technical; multiple values allowed", "why_it_matters": "Records the intended level of use without assuming that these labels have universally agreed boundaries." }, { "name": "Analytical confidence", "kind": "category", "unit_or_values": "Explicitly named confidence scale with rationale and assessment date", "why_it_matters": "Communicates the strength of an assessment without confusing confidence with event likelihood." }, { "name": "Assessed likelihood", "kind": "measurement", "unit_or_values": "Probability from 0 to 1 or a defined verbal scale, attached to a specified proposition and time horizon; unknown allowed", "why_it_matters": "Makes forecasts interpretable and potentially assessable against later outcomes." }, { "name": "Evidence lineage", "kind": "relation", "unit_or_values": "Links from claims to observations, original sources, intermediaries and transformations", "why_it_matters": "Supports verification and reveals apparent corroboration that derives from one original report." }, { "name": "Temporal applicability", "kind": "state", "unit_or_values": "Unassessed, current, review-due, superseded or expired, with observation and review dates", "why_it_matters": "Prevents historical infrastructure associations and assessments from silently becoming current claims." }, { "name": "Consumer relevance", "kind": "relation", "unit_or_values": "Links to consumer technologies, sectors, locations, business dependencies and observed exposure, with supporting rationale", "why_it_matters": "Distinguishes broadly interesting threat reporting from intelligence applicable to a particular consumer." }, { "name": "Handling constraints", "kind": "category", "unit_or_values": "Source permissions, applicable sharing markings, audience restrictions and permitted uses", "why_it_matters": "Determines whether evidence and derived assessments may be shared or operationalised." } ], "affordances": [ "Translate a defensive decision into prioritised intelligence requirements and collection gaps.", "Trace and compare threat claims while identifying duplicated reporting and unsupported inference.", "Develop competing explanations for cyber activity and identify evidence that would discriminate between them.", "Assess the relevance and freshness of indicators, behavioural patterns and threat assessments for a consumer.", "Prepare audience-appropriate intelligence products with uncertainty and handling constraints.", "Propose authorised defensive follow-up and revise intelligence using consumer feedback and subsequent observations." ], "agent_conduct": { "may": [ "Collect, analyse and share threat intelligence within the sharing rules the source sets.", "Report indicators of compromise to the organization that authorized the work.", "Explain threat intelligence concepts and frameworks." ], "must_not": [ "Share intelligence beyond the audience its source marked, such as under a traffic light protocol label.", "Attribute an attack to a named person, group or state without solid evidence.", "Use threat intelligence to attack, hack back or access systems without authorization.", "Collect personal data on individuals beyond what the lawful purpose needs." ], "requires_human": [ "Publicly attributing an attack.", "Sharing intelligence with authorities or outside parties." ] }, "ethics": { "considerations": [ "Wrong attribution can damage reputations and escalate conflicts between states.", "Intelligence work can drift into surveillance of innocent people." ], "affected_parties": [ "Victims of attacks", "Wrongly accused parties", "Users of affected systems" ] }, "owners": { "steward": "The organization that produces or receives it; sharing communities set rules for each exchange.", "master_systems": [] }, "standards_and_regulation": [ "Structured Threat Information Expression (STIX), OASIS.", "Traffic Light Protocol, Forum of Incident Response and Security Teams (FIRST)." ], "what_it_is_for": [ "Cyber threat intelligence is used in security monitoring, incident response and organisational risk assessment.", "It helps defenders interpret observed activity, prioritise investigations and select protective measures using evidence about relevant threats." ], "failure_modes_and_hazards": [ "Outdated or poorly supported intelligence can trigger false alarms and misdirect defensive resources.", "Incorrect attribution can cause unjustified accusations and harmful organisational decisions.", "Sharing intelligence without appropriate controls can expose personal information or sensitive operational details.", "Treating intelligence as complete coverage can leave relevant threats unrecognised." ], "facets_not_applicable": { "recognition": "Cyber threat intelligence is evaluated information whose identity and quality cannot be established through visual cues." } }, "sources": [ { "id": "wikidata", "title": "Wikidata item Q25053549: cyber threat intelligence", "url": "https://www.wikidata.org/wiki/Q25053549", "url_status": "live", "what_it_supports": "identity and sense of the item", "checked_by": "wikidata-api" }, { "id": "wikipedia-en", "title": "Wikipedia: Cyber threat intelligence", "url": "https://en.wikipedia.org/wiki/Cyber_threat_intelligence", "url_status": "live", "what_it_supports": "general description of the item", "checked_by": "wikidata-api sitelink" } ], "structure": { "bundles": [ { "id": "intelligence-purpose-and-boundaries", "name": "Intelligence Purpose and Boundaries", "description": "Establishes what counts as cyber threat intelligence in the relevant setting and which decisions it serves.", "rationale": "Cyber threat intelligence can refer to a practice, a service or a product; a model needs to preserve those distinctions and the consumer's actual requirements.", "layers": [ { "id": "definition-and-instance", "name": "Definition and Instance", "description": "Records the adopted conception of intelligence and tests whether a candidate activity or output meets it.", "findings": [ { "id": "declared-intelligence-conception", "name": "Declared Intelligence Conception", "description": "Capture whose definition applies, its criteria and whether the instance is an analytical activity, service or assessment.", "questions": [ { "text": "Which organisation or analytical tradition supplies the working definition, and what makes an output intelligence under that definition?", "kind": "definition", "id": "declared-intelligence-conception-q01" }, { "text": "What distinguishes this instance from raw threat data, a security alert or general cybersecurity advice?", "kind": "boundary", "id": "declared-intelligence-conception-q02" } ] } ] }, { "id": "consumer-and-requirement", "name": "Consumer and Requirement", "description": "Connects intelligence work to an accountable consumer and a bounded decision.", "findings": [ { "id": "decision-linked-requirement", "name": "Decision-Linked Requirement", "description": "Record the intelligence question, protected interests, decision deadline and criteria for a useful answer.", "questions": [ { "text": "Which consumer must decide what, by when, and concerning which assets or business dependencies?", "kind": "action", "id": "decision-linked-requirement-q01" }, { "text": "What observable deliverable would satisfy the requirement, and which related questions remain outside it?", "kind": "boundary", "id": "decision-linked-requirement-q02" } ] } ] } ] }, { "id": "collection-and-evidence-integrity", "name": "Collection and Evidence Integrity", "description": "Structures the acquisition, provenance and evaluation of evidence used in cyber threat assessments.", "rationale": "Threat reporting may be incomplete, duplicated or manipulated; conclusions need traceable evidence and explicit visibility limits.", "layers": [ { "id": "collection-coverage", "name": "Collection Coverage", "description": "Relates collection sources and observable environments to the intelligence requirement.", "findings": [ { "id": "visibility-and-collection-gaps", "name": "Visibility and Collection Gaps", "description": "Record what telemetry and reporting can reveal, what they cannot reveal and which collection activities are authorised.", "questions": [ { "text": "Which systems, populations, locations and periods are visible through the available telemetry and reporting?", "kind": "measurement", "id": "visibility-and-collection-gaps-q01" }, { "text": "Which authorised collection step could resolve the most decision-relevant gap?", "kind": "action", "id": "visibility-and-collection-gaps-q02" } ] } ] }, { "id": "source-and-claim-evaluation", "name": "Source and Claim Evaluation", "description": "Separates source reliability, individual claim credibility and independence of supporting reports.", "findings": [ { "id": "traceable-independent-evidence", "name": "Traceable Independent Evidence", "description": "Preserve original observations, transformations and reporting dependencies so that repeated claims do not automatically count as corroboration.", "questions": [ { "text": "What original observation supports each material claim, and through which intermediaries or transformations did it arrive?", "kind": "provenance", "id": "traceable-independent-evidence-q01" }, { "text": "Which supporting reports are independent, and what evidence bears on source reliability, claim credibility or possible deception?", "kind": "provenance", "id": "traceable-independent-evidence-q02" } ] } ] } ] }, { "id": "adversary-and-activity-analysis", "name": "Adversary and Activity Analysis", "description": "Organises observations of hostile cyber activity into bounded behavioural assessments and attribution hypotheses.", "rationale": "Infrastructure overlap, shared tools and inconsistent actor names can produce misleading associations unless observations and identity claims remain separate.", "layers": [ { "id": "behaviour-and-activity-patterns", "name": "Behaviour and Activity Patterns", "description": "Describes observed techniques, targeting and relationships among events without assuming a common actor.", "findings": [ { "id": "evidence-backed-activity-cluster", "name": "Evidence-Backed Activity Cluster", "description": "Record the evidence for grouping observations, their behavioural interpretation and alternative benign or unrelated explanations.", "questions": [ { "text": "Which observed behaviours and targeting patterns support the proposed cluster, and which relationships are inferred?", "kind": "provenance", "id": "evidence-backed-activity-cluster-q01" }, { "text": "Could shared infrastructure, commodity tooling or legitimate administration explain the apparent connection?", "kind": "boundary", "id": "evidence-backed-activity-cluster-q02" } ] } ] }, { "id": "identity-and-attribution", "name": "Identity and Attribution", "description": "Keeps technical clustering, actor naming and claims about operators or sponsors at their respective evidential levels.", "findings": [ { "id": "bounded-attribution-hypothesis", "name": "Bounded Attribution Hypothesis", "description": "Record attribution propositions, provider-specific aliases and the evidence needed to distinguish competing identity explanations.", "questions": [ { "text": "Does the attribution concern an activity cluster, an operator, an organisation or a sponsor, and what evidence supports that level?", "kind": "boundary", "id": "bounded-attribution-hypothesis-q01" }, { "text": "Which provider assigned each actor name, and does a proposed alias mapping mean equivalence, overlap or an unresolved relationship?", "kind": "provenance", "id": "bounded-attribution-hypothesis-q02" }, { "text": "What additional observation would strengthen or undermine the leading attribution hypothesis?", "kind": "measurement", "id": "bounded-attribution-hypothesis-q03" } ] } ] } ] }, { "id": "assessment-and-temporal-relevance", "name": "Assessment and Temporal Relevance", "description": "Turns analysis into explicit judgments whose uncertainty, consumer applicability and validity can be assessed.", "rationale": "A well-supported historical claim may still be irrelevant to a current defensive decision; confidence, likelihood and freshness require separate treatment.", "layers": [ { "id": "judgment-and-uncertainty", "name": "Judgment and Uncertainty", "description": "Records assessed propositions, assumptions, alternatives and the reasoning behind uncertainty statements.", "findings": [ { "id": "qualified-threat-judgment", "name": "Qualified Threat Judgment", "description": "Make each important judgment inspectable by separating observations, inferences, predictions and analytical confidence.", "questions": [ { "text": "What exact proposition is assessed, and which parts are observed, inferred or forecast?", "kind": "definition", "id": "qualified-threat-judgment-q01" }, { "text": "What supports the confidence rating, and, if likelihood is stated, which event and time horizon does it describe?", "kind": "measurement", "id": "qualified-threat-judgment-q02" }, { "text": "Which assumption or competing explanation could materially change the consumer's decision?", "kind": "boundary", "id": "qualified-threat-judgment-q03" } ] } ] }, { "id": "applicability-and-decay", "name": "Applicability and Decay", "description": "Connects threat judgments and indicators to a particular environment and review period.", "findings": [ { "id": "consumer-specific-validity", "name": "Consumer-Specific Validity", "description": "Record environmental fit, observation dates and invalidation triggers, including infrastructure reassignment and changes in adversary behaviour.", "questions": [ { "text": "Which consumer exposures, technologies or targeting evidence make this assessment applicable?", "kind": "provenance", "id": "consumer-specific-validity-q01" }, { "text": "When was the relevant activity observed, and what evidence or elapsed interval should trigger reassessment?", "kind": "measurement", "id": "consumer-specific-validity-q02" }, { "text": "What verification is needed before a historical indicator is used for a current operational decision?", "kind": "action", "id": "consumer-specific-validity-q03" } ] } ] } ] }, { "id": "dissemination-and-defensive-use", "name": "Dissemination and Defensive Use", "description": "Governs how intelligence reaches consumers, informs defensive choices and changes in response to outcomes.", "rationale": "Intelligence only supports useful decisions when consumers receive sufficient context, can use it within applicable restrictions and can report whether it helped.", "layers": [ { "id": "product-and-sharing", "name": "Product and Sharing", "description": "Packages judgments and supporting context for an intended audience under explicit handling constraints.", "findings": [ { "id": "usable-permitted-intelligence-product", "name": "Usable Permitted Intelligence Product", "description": "Specify the audience, delivery form, sharing permissions and minimum context that must survive summarisation or automated exchange.", "questions": [ { "text": "Which audience may receive this product, and what source permissions, sharing markings or contractual terms constrain redistribution?", "kind": "boundary", "id": "usable-permitted-intelligence-product-q01" }, { "text": "Which evidence links, confidence statements, timestamps and caveats must accompany the product in its intended delivery format?", "kind": "action", "id": "usable-permitted-intelligence-product-q02" } ] } ] }, { "id": "decision-support-and-feedback", "name": "Decision Support and Feedback", "description": "Connects intelligence to proposed defensive actions and subsequent evidence of usefulness or error.", "findings": [ { "id": "authorised-use-and-revision", "name": "Authorised Use and Revision", "description": "Record proposed hunts, detection changes or prioritisation decisions, their approval requirements and feedback that warrants correction.", "questions": [ { "text": "Which defensive action does the assessment support, and what validation and authority are required before execution?", "kind": "action", "id": "authorised-use-and-revision-q01" }, { "text": "What consumer outcome would demonstrate decision value, and what feedback would require correction, withdrawal or renewed collection?", "kind": "measurement", "id": "authorised-use-and-revision-q02" } ] } ] } ] }, { "id": "evidence-and-external-alignment", "name": "Evidence and external alignment", "description": "What the world already says about this thing, gathered so the model can be checked against it.", "rationale": "A model that cannot be lined up against existing standards, identifiers and practice cannot be adopted by anyone who already uses them.", "layers": [ { "id": "reported-evidence", "name": "Reported evidence", "description": "Findings from the breadth pass, kept separate from the structural claims.", "findings": [ { "id": "evidence-confidence-notes", "name": "Check these first", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "This is recall-based content; no sources were consulted.", "The strategic, operational, tactical, and technical taxonomy is widely used, but its boundaries and the treatment of technical intelligence vary between practitioners.", "Researchers should distinguish definitions of intelligence as an analytical product from definitions encompassing its production process, and verify applicable editions and local sharing obligations." ], "questions": [ { "id": "evidence-confidence-notes-q01", "text": "Which of these check these first hold for the sense of cyber threat intelligence this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-kinds", "name": "Kinds and varieties", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Strategic intelligence about threat trends and implications for organisational risk", "Operational intelligence about adversary campaigns, objectives, and activities", "Tactical intelligence about adversary tactics, techniques, and procedures", "Technical intelligence about indicators and observable attack artefacts" ], "questions": [ { "id": "evidence-kinds-q01", "text": "Which of these kinds and varieties hold for the sense of cyber threat intelligence this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-identifiers", "name": "Identifiers and schemes", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ { "scheme": "STIX object identifiers", "value_or_pattern": "--", "note": "Identify structured intelligence objects, rather than cyber threat intelligence as a discipline." }, { "scheme": "MITRE ATT&CK technique identifiers", "value_or_pattern": "T followed by four digits, optionally followed by a dot and three digits for a sub-technique", "note": "Identify adversary techniques referenced in intelligence; they do not identify threat actors or individual incidents." }, { "scheme": "Common Vulnerabilities and Exposures (CVE)", "value_or_pattern": "CVE-YYYY-NNNN, with four or more digits in the final component", "note": "Identify publicly disclosed vulnerabilities that intelligence may discuss; a CVE identifier alone conveys neither exploitation evidence nor threat attribution." } ], "questions": [ { "id": "evidence-identifiers-q01", "text": "Which of these identifiers and schemes hold for the sense of cyber threat intelligence this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-standards-and-regulation", "name": "Standards and regulation", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "OASIS Structured Threat Information Expression (STIX) 2.1: a standard for representing and exchanging cyber threat intelligence.", "OASIS Trusted Automated Exchange of Intelligence Information (TAXII) 2.1: a protocol for exchanging cyber threat intelligence.", "NIST Special Publication 800-150, Guide to Cyber Threat Information Sharing: guidance on establishing and participating in threat information sharing.", "FIRST Traffic Light Protocol (TLP) 2.0: dissemination markings that express permitted sharing boundaries." ], "questions": [ { "id": "evidence-standards-and-regulation-q01", "text": "Which of these standards and regulation hold for the sense of cyber threat intelligence this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-real-world-use", "name": "Real-world use", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Prioritising vulnerability remediation using evidence of exploitation and relevance to local assets.", "Developing detection rules and threat-hunting hypotheses from adversary behaviour.", "Enriching incident investigations with campaign context and related observations.", "Informing executive decisions about cyber risk and defensive investment.", "Sharing threat observations and assessments between organisations and sector communities." ], "questions": [ { "id": "evidence-real-world-use-q01", "text": "Which of these real-world use hold for the sense of cyber threat intelligence this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-failure-modes-and-hazards", "name": "Failure modes and hazards", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Treating unverified indicators or collected data as established intelligence without analysis, provenance, or context.", "False attribution caused by shared infrastructure, reused tools, deception, or insufficient evidence.", "Stale or context-free indicators producing false positives or ineffective blocking.", "Circular reporting making one original claim appear independently corroborated.", "Sharing sensitive information beyond permitted boundaries, exposing personal data, sources, or defensive capabilities." ], "questions": [ { "id": "evidence-failure-modes-and-hazards-q01", "text": "Which of these failure modes and hazards hold for the sense of cyber threat intelligence this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-regional-variation", "name": "Regional variation", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Privacy, cross-border data-transfer, and sector-specific obligations affect which threat information organisations can share.", "National reporting arrangements and the roles of CSIRTs, government agencies, and sector-sharing organisations vary by jurisdiction." ], "questions": [ { "id": "evidence-regional-variation-q01", "text": "Which of these regional variation hold for the sense of cyber threat intelligence this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-neighbours", "name": "Neighbouring kinds and how to tell them apart", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ { "name": "Threat data", "difference": "Raw observations become intelligence through evaluation, analysis, and context relevant to a decision; a feed alone does not establish that transformation." }, { "name": "Threat hunting", "difference": "Threat hunting searches an environment for potentially undetected adversary activity; intelligence can guide that search and incorporate its findings." }, { "name": "Incident response", "difference": "Incident response investigates and manages particular incidents; intelligence assesses threats across incidents and can support response decisions." }, { "name": "Vulnerability intelligence", "difference": "Vulnerability intelligence concentrates on weaknesses and their exploitation context; cyber threat intelligence also covers adversaries, campaigns, capabilities, and behaviour." }, { "name": "Cyber risk assessment", "difference": "Risk assessment evaluates potential harm in relation to assets, exposure, and controls; threat intelligence supplies evidence about the threat component." } ], "questions": [ { "id": "evidence-neighbours-q01", "text": "Which of these neighbouring kinds and how to tell them apart hold for the sense of cyber threat intelligence this model covers, and on what evidence?", "kind": "provenance" } ] } ] } ] } ] }, "openQuestions": [ "Which authoritative and practitioner definitions should anchor this entry, and where do they disagree about when processed threat information becomes intelligence?", "Does the ACT placement require intelligence products to be represented through a neighbouring information model, and does an existing world model already own this concept?", "Which distinctions among strategic, operational, tactical and technical intelligence are sufficiently consistent to adopt, and which require provider-specific definitions?", "Which confidence, likelihood and source-evaluation conventions permit meaningful comparison across providers without erasing differences in method?", "What evidence supports practical review intervals and usefulness measures for indicators, behavioural assessments and strategic forecasts in different consumer environments?" ], "statistics": { "bundles": 6, "layers": 11, "findings": 18, "questions": 31 } }