TLPT threat intelligence

Threat intelligence in TLPT is the evidence about real attackers, their methods and their targets that shapes what the testers attempt. It answers questions such as which groups target firms like this one, which techniques they use to gain access, how they move inside a network, and what they aim to disrupt or steal. Without that grounding, a test can still find weaknesses, but it cannot show whether the firm would withstand the attacks it is most likely to face. With it, every scenario in the test can be traced back to an observed threat.

Intelligence for TLPT is not a single report purchased at the start of the exercise. It is a process of collection, assessment and selection that runs through preparation and testing. Sources may include sector sharing arrangements, commercial providers, public reporting and the firm's own incident and monitoring data. The test team must judge which intelligence is credible, which is current, and which is relevant to the firm's critical functions, and must record those judgements so that the scenarios can be defended later.

Useful intelligence is specific enough to shape a scenario. A general warning that financial firms face phishing is true but not sufficient. Intelligence that describes how a particular group crafts messages aimed at treasury staff, which lures it uses, and which tools it deploys after initial access gives testers something concrete to recreate. Specificity also helps the firm: it can check whether its monitoring would detect that particular technique, rather than asking in the abstract whether it is protected against phishing.

No single source covers the threat landscape. Sector information sharing arrangements allow firms to learn from incidents at comparable organisations without exposing sensitive details. Commercial providers add analysis of attacker groups and tools. Public sources, including vendor research and law enforcement reporting, add breadth. The firm's own data adds context: its monitoring alerts, its near misses and its supplier incidents show which threats have already touched its perimeter.

Sharing arrangements require care. Intelligence must be handled in a way that protects sources and avoids disclosing the firm's own weaknesses to a wider audience. Agreements should set out what can be shared, with whom, and in what form. When handled well, sharing strengthens the whole sector: one firm's incident becomes another firm's test scenario, and an attack that succeeds once is less likely to succeed again elsewhere.

The translation from intelligence to scenario is where TLPT gains its realism. The intelligence provider and the testers work together to select a small number of attack paths that reflect the most plausible threats to the scoped critical functions. Each path is described as a sequence: initial access, persistence, movement inside the environment, access to target systems, and an action against the critical function. That sequence becomes the test plan, with safeguards and stop conditions attached to each stage.

Scenarios should also include variety. If every scenario starts with phishing, the test will say little about supplier access or insider misuse. If every scenario targets the same system, it will say little about the rest of the function. A balanced set of scenarios, each grounded in intelligence, gives a fuller picture and avoids the impression that the firm is prepared for one attack method but not for others.

Quality can be judged by asking whether the intelligence is current, sourced, specific and relevant. Current intelligence reflects recent attacker behaviour, not methods abandoned long ago. Sourced intelligence can be traced to observed activity, not to speculation. Specific intelligence names techniques, targets and tools. Relevant intelligence connects to the firm's own functions and technology. Intelligence that fails several of those tests should not drive a scenario, however alarming it sounds.

The intelligence picture should also be refreshed during the exercise. Attackers adapt, and new reporting may emerge while testing is under way. The test team should be able to incorporate significant new intelligence, or to explain why it was not incorporated. A static intelligence report, frozen months before testing, risks recreating an attack that is no longer plausible while missing the one that is.

Threat intelligence does not predict the future, and it does not cover every attacker. A firm that tests only against the threats in its intelligence picture may still be surprised by a novel method or a group that has not previously targeted its sector. TLPT should therefore be read alongside other testing and monitoring, not as a guarantee that all plausible attacks have been covered. The report should state what the intelligence covered and what it did not, so that readers do not overread the result.