CTI reports: Know what is happening and prepare for cyber threats

What are they and who are they for?

The National Cyber Security Centre's (NCSC) Cyber Threat Intelligence (CTI) team investigates current cyber threats in collaboration with other teams and shares its insights in CTI reports. These reports provide extensive context and background on current, relevant cyber threats and examine in depth the modus operandi of observed attacks.

CTI reports describe our own technical research and data analyses, and often include detailed courses of action. They are primarily intended for Chief Information Security Officers (CISOs), security officers, cybersecurity specialists, analysts, and comparable roles.

Topics and information vary widely across CTI reports and therefore carry different Traffic Light Protocol (TLP) levels. Some reports are TLP:GREEN or even TLP:CLEAR and can be shared more broadly than those classified as TLP:AMBER or TLP:AMBER+STRICT.

What are the benefits of receiving CTI reports?

You receive: additional context and interpretation of a threat; concrete actions you can take to improve detection, mitigation and/or recovery. Where possible, indicators and techniques are provided that you can immediately apply in monitoring and response. The report also frequently offers insight into an actor's motives and objectives, enabling you to produce an up-to-date threat assessment for your organisation.

Would you like to receive CTI reports?

A CTI report is event- and intelligence-driven and is published when the situation requires it or when an investigation has been completed; it is not a periodic publication. CTI reports are distributed by email and are published in English. If your organisation falls within our target group — central government and essential/vital organisations — and you would like to receive CTI reports, please contact your relationship manager or sign up via info@ncsc.nl.