In the threat intelligence lifecycle, which stage is responsible for turning collected data into detections and risk assessments?

• A. Planning
• B. Collection
• C. Analysis
• D. Dissemination

Answer: (C)

Turning raw data into actionable detections and risk assessments happens during the analysis phase. After data is collected from sensors, feeds, and sources, analysts examine it, correlate clues across disparate items, and map findings to known threat patterns and enterprise context. This is where evidence is interpreted, hypotheses are tested, and meaningful outputs are produced—such as detection rules, indicators of compromise, threat profiles, and risk scores—that security teams can operationalize. Planning defines what needs to be learned and sets requirements, while collection is about gathering the data, and dissemination is the sharing of the finished intelligence with stakeholders. The analysis stage is the bridge that converts raw signals into concrete, usable intelligence used to detect threats and assess risk.