Learning Path
Threat Intelligence Introduction
Security news is full of confident claims — a breach attributed to a named group, a vulnerability described as critical, a threat actor linked to a country. Much of it is wrong, exaggerated, or simply unproven at the time it is published. This path teaches you to read that news the way a professional does: what a CVE ID means, how the MITRE ATT&CK framework organises attacker behaviour, how open-source intelligence is verified, and how to tell a confirmed fact from an allegation. It is an introduction to thinking, not to attacking.
How this path works. Each lesson below is a short summary written for this path, with a link to the full guide. Work through them in order, mark each one complete when you have read the guide, and test yourself with the quiz at the end. Your progress is stored only in your own browser — no account, nothing sent to us. This path teaches understanding, not credentials: completing it does not give you a certificate and does not qualify you for a job.
What you will learn
This path is for readers who want to understand security news properly, and for anyone curious about the professional side of cybersecurity. It assumes you are comfortable with the earlier paths. It teaches concepts, law, scope-reading and reporting — never how to attack a live system, and never exploit code.
- Explain what threat intelligence is, and the difference between strategic, tactical and operational intelligence.
- Use the MITRE ATT&CK framework to name what an attacker did, in plain English.
- Read a CVE ID, and explain what the year, the number and the CNA mean.
- Verify a claim from public sources using the two-source rule and the four Ds.
- Judge an incident report: what is confirmed, what is alleged, and what is missing.
- Know the legal boundary: what research is allowed, what needs permission, and what never to do.
Your progress
0 of 6 lessons complete.
The lessons
Read each lesson summary, then open the full guide it links to. The summaries are written for this path — they do not repeat the guides, they prepare you for them.
Lesson 1: What is MITRE ATT&CK?
MITRE ATT&CK is a public framework that organises what attackers do into tactics and techniques. A tactic is the goal — for example, getting in, or staying hidden. A technique is the specific way an attacker achieves that goal — for example, a phishing email, or a stolen password. The framework gives every technique a name and a number, so security teams around the world can talk about the same behaviour in the same words.
This lesson walks through the framework in plain English, tactic by tactic, with the interactive explorer from our tools: pick a tactic, see the techniques under it, and learn what evidence a security team would look for. You will learn why the framework matters even if you never work in security — because it turns vague news language like a sophisticated attack into a specific, checkable description of what actually happened. MITRE ATT&CK is a registered trademark of The MITRE Corporation, and this site uses it with attribution and no implication of affiliation.
Read the full guide: MITRE ATT&CK explained for beginners
Lesson 2: What is a CVE?
A CVE ID is the public name of a known software vulnerability — for example, a flaw in a web server that lets an attacker run code on it. The letters stand for Common Vulnerabilities and Exposures, and the ID itself tells you two things: the year it was published, and a unique number. Behind every CVE is a CNA, a numbering authority that assigns the ID, and public records that describe the flaw in standardised terms.
This lesson explains how to read a CVE ID, what severity scores mean and what they do not — a high score does not automatically mean you are the most urgent person to patch — and how professionals connect a CVE to the question that actually matters: should I patch first? You will also learn about CISA's Known Exploited Vulnerabilities list, which tracks the flaws attackers are actually using, and why that list is often a better priority guide than a raw severity score. The CVE decoder tool lets you practise decoding an ID yourself.
Read the full guide: What is a CVE ID?
Lesson 3: Learn OSINT from scratch
OSINT — open-source intelligence — is information gathered from public sources only: public records, news, social media posts, company filings, maps and photographs. It is not hacking: it never involves bypassing logins, passwords or access controls. This lesson is a sequenced roadmap from zero — what OSINT is, the intelligence cycle, the two-source rule, and the four Ds of media verification: distortion, disinformation, decontextualisation and deepfakes. Each idea is introduced in order, so the method builds on itself.
You will work through a synthetic case file in the OSINT verification exercise, corroborating each claim with a second independent source and flagging the ones that fail the test. The lesson also teaches the ethical boundary that separates OSINT from surveillance: only public information, only lawful collection, and never personal data about a private individual. Done properly, OSINT is the most accessible skill in this whole path — and the one most useful for judging news critically in everyday life.
Read the full guide: How to learn OSINT from scratch
Lesson 4: Security research for beginners
Security research is the work of finding and understanding vulnerabilities — in software, in systems, in the way people use them. This lesson joins the four strands of the field into one legal-first path: vulnerability research in a lab, bug bounties on programmes that invite testing, OSINT from public sources, and threat intelligence from the findings. Each strand has its own rules, and the lesson is built around the most important sentence in the whole path: testing outside scope is still illegal, even if you report the bug afterwards.
You will learn the safe starting points — learning platforms with legal lab environments — and the skills researchers actually need most, which are not the ones people expect: writing clearly, reading a scope page properly, and reporting a finding so that someone can fix it. A crash is not a vulnerability, and a vulnerability is not a report until it is written up in a way that lets the owner reproduce it. That is what this lesson teaches, step by step.
Read the full guide: What is security research?
Lesson 5: How to read a bug bounty scope
Every bug bounty programme publishes a scope page: the document that says what you are allowed to test, what is out of scope, and what the rules are. Reading it properly is the skill that separates a legal researcher from someone who has broken the law by accident. This lesson teaches it with a worked example on a fictional — clearly labelled — scope page, so you can practise without touching a real programme.
You will learn to distinguish in-scope targets from out-of-scope ones, to spot the techniques that are explicitly forbidden even on in-scope targets, and to read the small print that matters most: the safe-harbour language, the disclosure timeline, and what the programme considers a valid report. The scope-checker tool turns this into an exercise: mark targets in or out of scope, and check your answers with the explanations. The lesson ends with the honest economics of bug bounties — most beginners earn nothing for the first months, and treating it as a learning investment rather than income is the only honest framing.
Read the full guide: How to read a bug bounty scope
Lesson 6: The vulnerability report template
Finding something is only half the job; the other half is writing it up so someone can fix it. This lesson gives you the full annotated template for a responsible-disclosure report: a clear title, a summary of the impact, steps to reproduce the finding, the evidence, the suggested fix, and the disclosure timeline. Each section is explained with an example from a fictional lab finding, so you can see what good looks like.
The emphasis throughout is on responsible disclosure: tell the owner privately first, give them time to fix it — a window of around 90 days is commonly cited, though it varies by programme — and do not publish proof-of-concept code before a fix exists. The vulnerability report builder tool turns the template into a form you can fill in for a lab finding and download as a structured report. The lesson closes the path by connecting everything: a finding in a lab, written up properly, reported responsibly, becomes threat intelligence — and that is how the field actually works.
Read the full guide: Vulnerability report template
Try the tools
These free tools let you practise what the lessons describe — everything runs in your browser, and nothing you type is sent anywhere.
- MITRE ATT&CK Explorer — pick a tactic, see the techniques, and learn what evidence a SOC would look for
- CVE Decoder — decode a CVE ID and get the official links to check it — CVE.org, NVD and CISA KEV
- OSINT Verification Exercise — verify four claims from a synthetic case file using the two-source rule
- SOC Alert Triage Simulator — triage five synthetic security alerts the way a Tier-1 analyst would
- Bug Bounty Scope Checker — work through a fictional programme scope and mark targets in or out of scope
Check what you learned
Four questions, all based on fictional scenarios. Answer them all, then check your score — each answer explains itself, so a wrong answer teaches as much as a right one.
Answer all four questions, then check your score.
Download your notes
Download a plain-text summary of this path: the lesson list, which lessons you marked complete, and your quiz score. The file is generated on your device — nothing is uploaded.
Key terms in this path
The glossary defines every term this path uses: CVE, MITRE ATT&CK, OSINT, social engineering. If a lesson uses a word you do not know, look it up there — each term page also explains the idea with an example.
Frequently asked questions
Is threat intelligence the same as hacking?
No, and the distinction matters. Threat intelligence is studying attacks, vulnerabilities and incidents from public and authorised sources. Hacking a live system without permission is a crime. This path teaches concepts, law, scope-reading and reporting — never how to attack a system, and never exploit code.
Do I need to work in security to benefit from this path?
No. The main benefit for most readers is learning to read security news critically: what a CVE means, what an ATT&CK technique tells you, and how to tell a confirmed fact from an allegation. Those skills are useful to anyone who reads breach stories, and they are the point of the path.
What does MITRE ATT&CK cost to use?
MITRE ATT&CK is free to use at no charge. MITRE ATT&CK is a registered trademark of The MITRE Corporation, and this site uses the name with attribution and no implication of affiliation or endorsement.
Can I test what I learn on a real website?
Only with ownership or written permission — for example, a bug bounty programme that invites testing, or a learning platform with a legal lab. Testing a live system without permission is unauthorised access, even if you report what you find. This path teaches you the legal routes and the scope-reading skill that keeps you on them.
Is this path a qualification for a security job?
No. This path is an introduction to thinking like a security analyst, not a professional qualification. If you want to explore security work honestly — including how long it takes, what entry-level work actually involves, and which qualifications are real — the research library covers careers without the hype.