Threat intelligence
Stop asking who attacked us? — three better questions
Attribution can be uncertain and slow to change a decision. These three practical questions help security teams turn threat information into defensive priorities.
JODOR Research · 27 October 2026 · 4 min read
When an alert arrives, it is natural to ask who is behind it. Attribution can be useful, but names and labels are often uncertain, and they do not automatically tell a defender what to do. A more useful briefing starts with the decisions an organisation can make.
1. What capability or behaviour should we prepare for?
Describe the observed behaviour in plain language before attaching a group name. Is the concern credential theft, exploitation of an exposed service, misuse of a trusted tool, or an attempt to disrupt operations? A behaviour-based description helps teams compare the information with their own systems and controls.
Keep confidence visible. Separate what has been directly observed from what is inferred, and identify the source and context. If the information is incomplete, say so. Clear uncertainty is more useful than a confident-sounding label that cannot be supported.
2. Which part of our environment is relevant?
Translate the information into an exposure question. Which systems, identities, suppliers or business processes could be affected? What conditions would need to be present? A threat report should help an organisation decide what to review, not assume that every organisation faces the same risk.
Security teams can compare the described behaviour with their architecture and existing safeguards, then ask system owners to validate important assumptions. This narrows investigation toward the environments where an answer could change a decision.
3. What should we do next?
Make the next action explicit. It may be to verify a configuration, review relevant logs, confirm that an existing control is operating, brief a service owner or simply monitor for a defined signal. State who owns that action and what evidence would close it.
Threat intelligence becomes useful when it changes a decision or improves readiness. Attribution may still matter, especially when it informs legal, diplomatic or strategic work. It should not be the only measure of whether the information helps defenders.
Key takeaways
- Start with observable behaviours and make uncertainty explicit.
- Ask where the information intersects with your own systems and dependencies.
- Give each recommendation an owner and a clear way to verify completion.
- Use attribution when it informs a decision, not as a substitute for one.
