Workforce knowledge and operational skills in cyber threat intelligence

Purpose This study aims to explore the knowledge and skills practitioners consider important for cyber threat intelligence (CTI) practice in organizations. Design/methodology/approach Semi-structured interviews with 14 CTI practitioners and cybersecurity leaders were analyzed using deductive qualitative analysis. Socio-technical systems theory informed interpretation, while the NICE Workforce Framework for Cybersecurity supplied organizing categories. Interview excerpts were coded for knowledge, skills, tasks and work roles and tagged to collection, processing, analysis and dissemination. The mapping was refined through member checking with four original participants selected for complementary areas of expertise. Findings The analysis identifies four knowledge areas: cybersecurity and IT domain knowledge, intelligence tradecraft knowledge, situational awareness and business context knowledge. Eleven operational skills encompass technical, analytical, communicative and interpersonal capabilities. Reported competency associations vary across lifecycle activities, with some spanning all four stages. Two practitioner profiles emerged: technical-operational and intelligence-analytical. Practical implications The competencies and mapping provide a starting point for recruitment, training, mentoring and team design, subject to contextual adaptation and further evaluation. Originality/value The study contextualizes established CTI competencies through practitioner accounts and connects reported knowledge and skills to lifecycle activities. It offers an exploratory mapping rather than evidence of effects on intelligence quality or organizational performance.