Threat intelligence is one of those phrases that arrives already sounding expensive. It is sold in feeds and platforms and annual subscriptions, and the marketing around it tends to describe capability rather than purpose, which leaves most people with a vague sense that it means knowing about hackers.

It has a much plainer definition, and one number makes it obvious.

The number

The US National Vulnerability Database has published 380,235 CVEs — catalogued software vulnerabilities — since the scheme began.

CISA, the US cyber defence agency, maintains a separate list: vulnerabilities it has confirmed are being exploited in the wild. Not theoretically exploitable, not demonstrated at a conference. Actually used against real systems. That list currently holds 1,670 entries.

That is 0.439% — roughly one in 228.

Every security team on earth has a finite number of hours. "Patch everything" is not a strategy, it is what you say when you have not worked out which of the 380,235 are the 1,670. Threat intelligence is the work of telling those apart. Everything else — the feeds, the platforms, the acronyms — is machinery built to answer that question faster.

Intelligence is not information

The useful distinction between an intelligence function and an expensive news alert is simple. Information is what happened; intelligence is what you should do about it.

"A critical vulnerability was disclosed in a widely used library" is information. It is true and timely, but on its own it tells you nothing. Do you run that library? Is your version affected? Is anyone actually using the bug? Does fixing it matter more than the other nine things on your list?

"This vulnerability is in the library our payment service depends on, it is being exploited by a group that targets our sector, and there is a patch" is intelligence. Same underlying event. The difference is that the second one has been connected to your estate and your adversaries, and it ends in a decision.

This is why buying a feed isn't the same as having intelligence. A feed delivers information, but somebody still has to connect it to your world.

What the exploited list actually looks like

The catalogue is more interesting than its headline count. Two details stand out against common assumptions.

Exploited does not mean new. 54.6% of the entries are for vulnerabilities five years old or more. The oldest goes back to 2002. Attackers are not overwhelmingly using fresh discoveries; they are using the things that were never fixed, because unpatched old software is more reliable than a new exploit and considerably cheaper.

The distribution is lopsided. A single vendor, Microsoft, accounts for 23.1% of everything on the list — 385 entries. Cisco is next at 5.7%, then Apple at 5.6%. This is less a statement about quality than about ubiquity; the more common a piece of software, the more attackers have to gain.

And 349 entries — 20.9% — are linked to known ransomware campaigns. That subset is the sharpest prioritisation signal in the whole catalogue, because it is the difference between a vulnerability someone might use and one that has already been part of somebody's worst quarter.

Where the discipline came from

The vocabulary is borrowed wholesale from state intelligence work, which explains why it sounds grander than it is. The intelligence cycle — direction, collection, processing, analysis, dissemination, feedback — is the same loop, applied to a smaller and much more commercial problem.

The useful inheritance is the insistence on the last step. An intelligence product that nobody read, or that arrived after the decision was made, has failed regardless of how accurate it was. Threat intelligence teams that measure themselves on volume of reporting have usually stopped doing intelligence and started doing publishing.

The three tiers you will see referenced are different jobs, not seniority levels.

  • Tactical — indicators. This IP address, that file hash, this domain. Short-lived, machine-consumable, and the tier most feeds actually sell.
  • Operational — behaviour. How a particular group operates, what they do after they get in. Longer-lived, because changing tooling is cheap and changing habits is not.
  • Strategic — the shape of the risk. Which sectors are being targeted, what is changing, what to build for over years rather than weeks.

Most organisations buy tactical, need operational, and quote strategic in board slides.

What this list does not tell you

The list has two important limits. Misreading either one is how a prioritisation exercise goes wrong.

The exploited catalogue is a floor, not a census. It records what CISA has confirmed and chosen to publish. Exploitation that is unreported, still classified, or simply not yet noticed is absent by construction. A vulnerability's absence from the list is not evidence that nobody is using it — it is the absence of evidence that somebody is.

And its selection pressure is not neutral. The catalogue exists to direct US federal agencies' patching, so software common in that estate is likelier to be represented than software common in, say, an Indonesian bank. It is the best public list of its kind by a wide margin. It is not a global census of exploitation, and a regional risk picture cannot be built from it alone.

Both caveats point the same way. A public list tells you what is definitely worth fixing. It cannot tell you what is safe to ignore.

The honest starting point

If your organisation has no intelligence function, don't start with a subscription. Start with an inventory. Intelligence about adversaries is worthless until it can be matched against a list of what you actually run, and most organisations discover that the second list is the one they are missing.

Start there, then check that inventory against the confirmed-exploited catalogue, which is free and published as machine-readable JSON. That single comparison — what we run, against what is definitely being used against people — is more prioritisation value than most first-year intelligence programmes deliver, and it costs an afternoon.

The rest of this series works outward from here: what threat intelligence is actually used for turns that ratio into a work queue, what a threat actor name buys you counts the named-adversary layer, and what your own domain tells a stranger runs the reconnaissance side against ourselves.

Figures are from 19 August 2026, measured directly from CISA's published catalogue and NVD's totals. The script is in our repository and re-runnable; both numbers move, and the ratio between them is the part worth watching.