Difference between Data, Information and Intelligence

Data, information and intelligence are concepts often used interchangeably, but they represent different levels of processing that must be distinguished to understand what really produces value in a threat intelligence program. Data are isolated facts without context, such as an IP address or a file hash; information arises when that data is organized and structured, for example by grouping several indicators related to the same event; and intelligence appears when that information is analyzed, put into context and turned into knowledge that answers a specific question and supports a concrete decision. In practice, many teams confuse accumulating data with producing intelligence, handing their consumers long lists of indicators without any analysis explaining their relevance or what action to take, which overloads analysts instead of helping them. A clear example of this difference is that knowing an IP was malicious is data, knowing it appeared in several recent incidents is information, but understanding that it belongs to the infrastructure of a group actively attacking the organization's sector is actionable intelligence.