CYSIAM's Cyber Threat Intelligence (CTI) service involves the continuous collection and analysis of threat data from proprietary and non-proprietary sources to identify threat actors and understand their motives, targeted industries, and evolving Tactics, Techniques, and Procedures (TTPs). The service follows a structured four-phase intelligence cycle: 1. Direction – Priority Intelligence Requirements (PIRs) are derived from threat modelling to guide analyst focus. 2. Collection – Relevant data is gathered in accordance with PIRs and managed via an Intelligence Collection Plan. 3. Analysis – Collected data is assessed, including source confidence evaluation, to produce hypotheses aligned to PIRs. 4. Dissemination – Actionable intelligence is delivered in a legible, concise, and appropriate format. Data sources include commercial and open-source feeds, dark web monitoring, and social media. The service supports organisational situational awareness and reduces alert and incident response times through targeted intelligence. CTI is offered as a standalone service (CTI-as-a-Service / CTIaaS) and also feeds into CYSIAM's broader Managed Detection & Response (MDR) and Incident Response offerings. Additional sub-services include Threat Modelling & Assessment, tailored industry-specific reports and advisories, on-demand analyst support, and malware analysis.