What Makes Intelligence Actionable
What is it?
Actionable intelligence is relevant to the recipient, timely enough to act on, accurate, and specific enough to drive a concrete decision. Intelligence that is interesting but changes no action is trivia, however true it is.
Why it matters
The entire point of CTI is to change a defender's behavior; a product that cannot be acted on has failed regardless of how sophisticated the analysis was.
Where you see it
The 'so what / now what' test applied to every product before release.
What normal looks like
A product that names a specific recipient, a specific action, and a window in which the action matters.
What suspicious looks like
Not applicable directly.
How analysts investigate
By testing each product against relevance, timeliness, accuracy and specificity — and cutting anything that fails without a clear action.
Common beginner mistakes
- Producing accurate but generic intelligence ('threats are increasing') that no one can act on — accuracy without specificity is not actionable.
Two Sahab products. "Phishing is a risk to telecoms" — true, but Sahab already knew, and can do nothing new with it. "This week's campaign spoofs Sahab's HR portal from lookalike domain sahab-hr[.]example; block it and warn staff" — relevant, timely, specific, actionable.
Quick check
Which quality is MISSING from 'Ransomware attacks are increasing globally'?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.