Intelligence-driven defense is a security methodology that uses threat intelligence as the foundation for all defensive operations, from strategic planning to tactical detection. Pioneered by Lockheed Martin through the Cyber Kill Chain and the Intelligence Driven Computer Network Defense model, this approach shifts organizations from reactive, indicator-based security to proactive, adversary-focused defense. Every security decision, from tool selection to detection rule authoring, is informed by understanding of specific adversary behavior.
Intelligence-driven defense operates across three levels. At the strategic level, threat intelligence informs security investment decisions, risk assessments, and program priorities based on the organization's specific threat landscape. At the operational level, intelligence shapes detection engineering by mapping adversary TTPs to detection analytics, hunting hypotheses, and response playbooks. At the tactical level, indicators of compromise are integrated into security tools for automated detection and blocking. The F3EAD (Find, Fix, Finish, Exploit, Analyze, Disseminate) cycle from military intelligence provides the operational rhythm, with each completed cycle producing new intelligence that drives the next iteration.
Traditional perimeter-centric security fails against advanced adversaries who bypass signature-based controls. Intelligence-driven defense counters this by focusing on adversary behavior patterns that are more difficult to change than specific indicators. When defenders understand the full kill chain of their adversaries, they can establish detection and disruption opportunities at multiple phases. This approach maximizes the return on security investment by ensuring that controls directly counter the most relevant threats rather than providing generic coverage.
Intelligence-driven defense is the philosophical foundation of CDA's entire operating model. The PDM framework maps defensive capabilities to adversary targeting patterns across all six domains. Every theater mission is informed by threat intelligence, and our campaign tiers progressively build intelligence-driven capabilities from basic threat awareness in C-RECON to fully operationalized intelligence programs in C-COMMAND. CDA does not monitor -- we operate -- and that operational mindset is rooted in intelligence-driven defense principles.