Threat Actors, Threat Intelligence, and Frameworks
Key Takeaways
Subdomain 5.2 names threat actors (types and motivations), cyber threat intelligence, and threat frameworks.
Match the actor's motivation to the controls and monitoring that matter most for the organization.
Threat intelligence is useful only when it is checked against the organization's own systems and routed to the people who act on it.
A threat framework organizes known adversary behavior; the outline does not require one specific framework.
Source: ISC2 CC Exam Outline v01/2026, subdomain 5.2, checked 2026-10-22.
Threat Actors, Intelligence, and Frameworks
Subdomain 5.2, Understand security operations, includes three threat topics: threat actors (types and motivations), cyber threat intelligence, and threat frameworks. Together they answer who might attack, why, and how an organization learns about and organizes that information.
Source: ISC2 Certified in Cybersecurity Exam Outline, effective September 1, 2026 (v01/2026), subdomain 5.2, checked 2026-10-22.
Threat Actors: Types and Motivations
A threat actor is the person or group behind an attack. The outline asks candidates to know the types of threat actor and their motivations. Match each actor to the goals it is likely to pursue, and to the controls that address those goals.
Cyber Threat Intelligence in Operations
Cyber threat intelligence (CTI) is information about threats that is collected, analyzed, and used to make decisions. For an entry-level practitioner, CTI means reading an advisory, checking whether it applies to the organization's systems, and passing the relevant item to the people who patch or monitor. The outline places CTI inside security operations, so it supports triage and response.
Threat Frameworks
The outline names threat frameworks without requiring one specific framework. Study what a framework does: it organizes known adversary behavior and techniques so that defenders can map alerts to known patterns and prioritize detection work.
Scenario: The Advisory
A vendor advisory warns that a threat group is exploiting a remote-access product the company uses. A CC-level response checks whether the product is in use, identifies the affected systems, raises monitoring for the described behavior, and escalates to the incident response plan if activity is found. Ignoring the advisory because it names a vendor is the wrong choice.
Which action best uses cyber threat intelligence in security operations?
Check whether an advisory applies to the organization's systems and pass relevant findings to monitoring and patch owners
Ignore advisories that name a specific vendor, since those notices rarely describe the organization's own systems and threats
Delete logs that mention the threat actor named in the advisory, so that the records do not confuse later investigations
Wait for a confirmed breach before reading any advisory, so that time is not spent on threats that may never arrive
Match each threat term to its meaning.
Match each item on the left with the correct item on the right
Threat actor
Motivation
Threat framework
Sections you finish are checked off in the contents.