CTI Fundamentals: a reading list for threat intelligence theory

What the collection is and what it deliberately leaves out

CTI Fundamentals is a collection of essential resources related to cyber threat intelligence theory. The repository description says it is a collection of papers, blogs and resources that make up the quintessential aspects of cyber threat intelligence, and the README opens with a shorter version of the same idea.

What makes the list worth reading is what it points at. Almost every entry is a primary document from the organisation that produced the original work, and the list reaches back to general intelligence practice rather than starting from threat intelligence. The first three rows are all from the US Central Intelligence Agency: the traditional intelligence cycle describing how intelligence is ideally processed in civilian and military intelligence agencies and law enforcement organisations, a primer on structured analytic techniques, and a paper on the psychology of intelligence analysis from the CIA's Center for the Study of Intelligence.

That last one is the tell. The premise is that threat intelligence is a specialisation of a much older discipline, and the resources are the ones that discipline already produced.

The repository itself is minimal. There is a README.md, a logo file, and an Archive/ directory, with no code, no build, no configuration and no package manifest. The primary language and the licence are both listed as unknown, and the project publishes no releases. It is a reading list in the literal sense, and the value is entirely in the curation.

The list is presented as a single table under a CTI Theory heading, with three columns: author, a description of what the resource covers, and the resource URL. The descriptions are written to tell you whether an entry is relevant to you, which is the part that separates a useful list from a pile of links.

The intelligence cycle and the analytic tradecraft primers

Four entries in the table are about method rather than about threats, and they are the ones that come first in the ordering.

The intelligence cycle is the oldest item and the anchor for the whole list. The description says it describes how intelligence is ideally processed in civilian and military intelligence agencies and in law enforcement organisations. The linked page is an archived copy of a CIA page, which tells you something about the age of the source and the fragility of the link at the same time.

Structured analytic techniques appear twice. One is the CIA tradecraft primer, described as highlighting structured analytic techniques, some widely used in the private sector and academia and some unique to the intelligence profession. The second entry is the same primer hosted elsewhere, attributed to the US Government, which is a useful thing to know because the primary link is on a government domain and the mirror is on a university one.

The third CIA entry, the psychology of intelligence analysis, is described as the psychology of intelligence analysis by the Center for the Study of Intelligence. This is the item that most directly addresses a problem specific to the field, because a CTI analyst faces the same traps as any other analyst, and the same cognitive biases that make a written intelligence product wrong make a threat report wrong.

There is a fourth, from Recorded Future, which takes the traditional intelligence life cycle and tailors it to threat intelligence embedded in modern security operations. The description calls it the six phases of the threat intelligence lifecycle, and the linked article is a web archive capture rather than the live page.

So the shape of the first third of the list is a method sequence: the process, the techniques that support it, the psychology that undermines it, and then the adaptation of it to the security operations context.

Threat models, kill chains and the state of the discipline

The middle of the list turns to specific models and to arguments about the field itself.

The SANS entry is a Cyber Kill Chain tailored to Industrial Control Systems, written by Michael J. Assante and Robert M. Lee, and the link points into the repository's own Archive/ directory rather than to an external host, which is the one entry where the project has mirrored the file.

Two entries come from Joe Slowik, and they are the most technical reading in the collection. One is on the limitations of malware analysis, which is a paper about the limits of a core technique in the discipline. The other, on analysing network infrastructure as composite objects, makes an argument that is easy to state and hard to act on: while network infrastructure indicators and observables are typically viewed as atomic objects, seeing these items as composites enables analysis able to keep pace with adversary evolution.

Three entries argue about the state of threat intelligence as a practice. The Carnegie Mellon Institute for Software Research paper covers the life cycle of an advanced persistent threat group attack from reconnaissance to data exfiltration. RAND contributes a Four-Step Scalable Warning and Resilience Model, which comes from the resilience and warning side of that work rather than from threat hunting. And the piece in the International Journal of Intelligence and CounterIntelligence makes the argument that CTI is a product without a process, with several underlying causes and consequences for the practice, and that the field needs to implement traditional intelligence analysis and methodology rather than add more technology.

That last argument is the most useful disagreement in the list, and it connects the whole collection. If the field has a tooling problem, the answer is more tooling. If it has a process problem, the answer is the intelligence cycle, the tradecraft primer and the analyst's style manual, which is exactly the set of resources this repository has assembled.

Writing standards, the analyst manual and the intelligence architecture map

Four entries are about the craft of producing the written output, and they are the ones a new analyst needs most and is least likely to find elsewhere.

The Mercyhurst University Institute for Intelligence Studies contributes the Analyst's Style Manual, described as a product intended to assist student analysts with the many perplexing and complex rules they should follow in producing written intelligence products. It comes from an academic institute rather than a vendor, and it is aimed at students, which is the point: it assumes you do not yet know the conventions.

Two more entries come from Juan Andrés Guerrero-Saade, and they are about language and ethics. One is the ethics and perils of APT research, described as an unexpected transition into intelligence brokerage, and the argument is about what happens to a researcher whose work touches investigations with geopolitical weight, whose final attributions entail unmasking nation-state operations, and who will need drastic preparations, not only to excel but to survive. The second is on expanding the descriptive palette for cyber threat actors, which is about vocabulary.

The third writing-oriented entry is by Freddy M, and it is the Intelligence Architecture Map, based on interviews of industry experts, former intelligence practitioners and the author's own views. The description says it represents a logical and meaningful way of how different aspects of producing intelligence should be put together, and the interview basis makes it the only entry in the collection that is a practitioner's account of how the work is actually organised rather than how it should be.

Two more round out the list. Grace Chi's study asks whether sharing is caring, and it is a comprehensive study on the current cyber threat intelligence interpersonal and social networking practices, results and attitudes, which is a research paper about the profession rather than about threats. And the UK National Anti Fraud Network contributes basics of intelligence management, including classification, evaluation, dissemination and the intelligence confidence matrix.

Standards, further reading and the wider collections

Three entries point outward to other lists and to standards, and they are what turn this repository into a starting point rather than a terminus.

One is by threat-intelligence.eu, and it collects technical standards related to threat intelligence, which is the practical reference for a team that has to produce output that other people will consume. One is by mxm0z, a collection of useful resources concerning intelligence writing such as manuals, guides, standards, books and articles, called Awesome Intelligence Writing, which extends the writing side of the list considerably.

The remaining entry is the iSIGHT Partners guide, described as the first definitive guide to cyber threat intelligence ever produced. The link points at a copy hosted on cryptome.org rather than at the publisher, which is a pattern that runs through the whole table.

That pattern deserves attention on its own. The list is careful about naming authors and publishers, and the resource URLs point at a mixture of live pages, web archive captures and third-party mirrors. For a set of resources from government agencies, universities and vendors, that mix is partly a consequence of the sources themselves, since agency pages move and papers get taken down, and partly a consequence of the links having been assembled over time and then partly re-saved.

The Archive/ directory in the repository is the same instinct applied to the one file the project hosts itself, the SANS ICS kill chain whitepaper, which is mirrored into the repository rather than linked.

The repository is not archived and the last push was on 2026-04-25, so the list is being maintained, though at a pace of a few edits rather than constant revision.

Where CTI Fundamentals is the wrong tool

The first limitation is that it is theory, and it says so in the title of the section, CTI Theory. There is nothing here about collecting indicators, about feed formats, about how to run a pipeline or about the tooling a team uses. A practitioner who needs a working collection process will not find it here.

The second is the curation policy. The README does not state who maintains the list, what the inclusion criteria are, or what happens to an entry that goes offline. There is no discussion, no contribution guide and no stated review cycle in the repository, and the entries are not dated, so a reader cannot tell whether an older primer is still the current version.

The third is link durability. Several entries are web archive captures, one is a third-party mirror, and one lives in the repository's own Archive directory. That is a practical problem for a reading list, because the most likely failure mode is a dead link, and a list that is half archived captures is a list whose usefulness decays silently. Nothing in the repository checks the links.

The fourth is that the descriptions, while useful, are short. Each is a sentence or two on what a document covers, which is enough to decide whether to read it and not enough to know what you will get from it. A reader who has already read the intelligence cycle and the tradecraft primer will get less from the list, since those two are the most cited entries in the field.

The fifth is the licensing and metadata position. The primary language is listed as unknown and the licence as unknown, and no licence file appears in the repository listing. For a collection of other people's papers and standards, the licence of the list itself is a narrower question than the rights to the documents it points at, and the repository does not discuss that.

Licence, maintenance and the cost of a curated reading list

The repository is not archived and the last push was on 2026-04-25, so the collection is still being touched. There are no releases, and the default branch is main. The licence is listed as one the hosting site cannot classify, and the primary language is likewise unknown, which for a README-and-archive repository is not surprising.

The cost of using it is an afternoon. Clone the repository, open the README, and work through the table in order. The first three entries set up the process and the method, the middle section gives you the models and the argument about the discipline, and the writing-oriented entries are the ones most people skip and most need.

That is the value proposition, and it is a real one. Most people entering threat intelligence arrive from a technical route, through log analysis or incident response, and arrive with a strong instinct to build a pipeline. The argument in the International Journal of Intelligence and CounterIntelligence entry is the corrective for that instinct, and the tradecraft primer and the Analyst's Style Manual are the practical version of it.

The cost of maintaining a list like this is a person reading documents well enough to write a description of each. That is why the descriptions are the differentiator here, and why a description that says an entry is the limitations of malware analysis saves you an hour of reading a paper that turns out to be about something else.

The broader collections linked from the table matter for the same reason. Awesome Intelligence Writing extends the writing resources, and the threat-intelligence.eu standards page is where you go when the question is what shape the output should take rather than how to think about it.

Editorial conclusion

CTI Fundamentals suits an analyst who is starting out in threat intelligence and wants the theory behind the workflow rather than another tool, because every entry is a primary document with a named author. It does not suit a team looking for a maintained reference index, since the list has no versioning, no tooling and no stated curation policy, and several links point at archived copies. Read the intelligence cycle and the tradecraft primer first, and check the link is still live before you build a training programme around an entry.

Frequently asked questions

Official sources

1. curated-intel/CTI-fundamentals on GitHub
2. Issues
3. README