Threat intelligence and the ATT&CK framework
Threat intelligence is information about threats, threat actors, their motivations, and their tactics that has been collected, processed, and analyzed to enable better security decisions. Strategic intelligence informs high-level risk decisions (what industries are being targeted, what types of attacks are increasing). Operational intelligence informs current security operations (active campaigns targeting your sector, new malware families in circulation). Tactical intelligence provides specific indicators of compromise (IP addresses, file hashes, domain names, URLs) used in active attacks.
MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on real-world attack observations. It organizes attacker behavior into 14 tactics (the high-level goal, such as Initial Access or Lateral Movement) and hundreds of specific techniques underneath each tactic. When analysts investigate an incident, mapping observed behaviors to ATT&CK helps identify what the attacker is trying to accomplish and what techniques they have not yet used, enabling proactive hunting for the next step in an attack chain.
Indicators of Compromise (IoCs) are artifacts that indicate a system may have been compromised: unusual network connections to known-malicious IPs, file hashes matching known malware, registry keys created by specific malware families, or abnormal user account behavior. IoCs from threat intelligence feeds are loaded into SIEM and EDR tools to generate alerts when they appear in the environment. Indicators of Attack (IoAs) focus on behaviors rather than static artifacts: detecting lateral movement attempts or credential dumping behavior even without a matching signature.
Vulnerability management lifecycle
Vulnerability management is the ongoing process of identifying, evaluating, prioritizing, remediating, and verifying security weaknesses. The lifecycle starts with discovery: asset inventory tells you what you have, and vulnerability scanning (using tools like Nessus, Qualys, or Rapid7) identifies software versions and configurations with known vulnerabilities. Scanning should cover the entire environment: servers, workstations, network devices, cloud resources, and containerized workloads.
CVSS (Common Vulnerability Scoring System) provides a standardized way to score the severity of vulnerabilities on a scale from 0 to 10. The base score reflects the intrinsic characteristics of the vulnerability: attack vector (network, adjacent, local, physical), attack complexity, privileges required, user interaction, and the impact on confidentiality, integrity, and availability. A CVSS base score tells you how severe a vulnerability is in isolation, but remediation priority must factor in asset criticality and actual exploitability in your environment.
Not every high-CVSS vulnerability should be remediated first. Risk-based prioritization considers four factors: the CVSS score, whether the vulnerability is actively exploited in the wild (check CISA's Known Exploited Vulnerabilities catalog), the criticality of the affected asset, and the presence of compensating controls. A critical CVSS 9.8 vulnerability on an isolated lab system may be lower priority than a CVSS 7.0 vulnerability on a public-facing authentication system that is actively being exploited.
How to choose the correct answer
IoC: specific artifact indicating compromise (IP, hash, domain). IoA: behavioral indicator of attack in progress.
ATT&CK: 14 tactics (what attacker wants to achieve) with hundreds of techniques (how they achieve it). Map incidents to ATT&CK to understand attacker intent.
CVSS base score: intrinsic severity 0-10. Does not include asset criticality or environmental context.
Risk-based patching priority: CVSS score + active exploitation in wild + asset criticality + compensating controls.
CISA KEV (Known Exploited Vulnerabilities): actively exploited, highest remediation priority regardless of base score.
Vulnerability scan vs. penetration test: scanning identifies known vulnerabilities. Pen testing actively exploits them to demonstrate impact.
False positive: scanner reports vulnerability that does not exist. False negative: real vulnerability not detected. Both have costs.