FAQs

Cyber Threat Intelligence (CTI) is information about existing or emerging cyber threats that has been collected, analysed and placed into context. It can include information about malicious IP addresses, domains, malware, vulnerabilities, attack techniques and Indicators of Compromise (IOCs).

Effective CTI helps cybersecurity teams understand how threats behave, identify malicious activity faster and make better-informed decisions about prevention and response.

An Indicator of Compromise is a piece of technical evidence that may indicate malicious activity within a system or network. Examples include malicious IP addresses, suspicious domains, URLs, file hashes or unusual network activity.

IOCs become particularly valuable when they are verified, correlated with other information and shared with organisations that may face the same threat.

An attack detected by one organisation may also threaten many others. Without information sharing, different Security operation centers[SB1.1] may independently investigate the same malicious infrastructure, indicators or attack techniques.

Sharing verified threat intelligence allows organisations to learn from threats detected elsewhere, improve situational awareness and potentially take preventive action before the same threat reaches their environment.

Global threat intelligence provides valuable information about the wider threat landscape, but not every threat is equally relevant to every country, sector or organisation.

Local and regional intelligence can reveal malicious activity specifically affecting nearby organisations. INTERCEPT therefore aims to strengthen access to trusted regional threat intelligence, initially through cross-border cooperation between Slovenia and Croatia.

A Threat Sharing Platform provides an environment where cybersecurity information from different sources can be collected, processed, analysed and securely shared.

The INTERCEPT Threat Sharing Platform is designed to support structured and secure intelligence exchange between organisations. Verified threat intelligence can be distributed to participating organisations and integrated into their existing security infrastructure.

MISP is an open-source platform for collecting, storing, sharing and correlating cyber threat intelligence, including Indicators of Compromise.

INTERCEPT uses MISP as a core technology behind its Threat Sharing Platform. Its standardised approach also supports interoperability with existing SOC technologies and enables organisations to exchange threat information more efficiently.

Threat sharing does not necessarily mean sharing raw organisational data. Information can first be anonymised or pseudonymised to remove or transform sensitive elements.

Within INTERCEPT, information passes through a controlled sharing process that includes an anonymisation component before verified intelligence is made available through the Threat Sharing Platform.

Connected SOCs can learn from incidents detected by other organisations and take preventive action earlier.

For example, if one organisation identifies a malicious domain or phishing campaign, other organisations receiving that intelligence can potentially block the domain or strengthen monitoring before they are targeted themselves. INTERCEPT uses this principle to support coordinated rather than isolated cyber defence.

Once an indicator of compromise (IOC) has been confirmed, it can be distributed to other security systems and organisations.

Depending on the threat, organisations can use this intelligence to generate alerts, strengthen monitoring, block malicious domains or introduce DNS-level protection. This turns threat intelligence from passive information into actionable cybersecurity measures.

Cyber threats do not stop at national borders. The same malicious infrastructure, malware campaign or attack technique can target organisations in several countries within a short period.

Cross-border intelligence sharing gives cybersecurity teams a broader view of emerging threats and enables organisations to benefit from incidents detected elsewhere. INTERCEPT initially connects cybersecurity capabilities in Slovenia and Croatia to demonstrate this approach.

The architecture developed within INTERCEPT is modular and designed with future expansion in mind.

Additional organisations could potentially participate through local MISP instances or consume relevant intelligence through APIs. The architecture also provides a foundation for connecting additional regional environments to a wider threat-sharing ecosystem.

A Security Operations Centre (SOC) continuously monitors an organisation’s systems and networks for cybersecurity threats.

SOC teams analyse alerts, investigate suspicious activity, detect incidents and coordinate responses. Modern SOCs increasingly combine human expertise with automation, threat intelligence and AI-supported technologies to process growing volumes of security information.

A SOC primarily sees activity within the systems, networks and data sources available to it. Threats already detected elsewhere may therefore remain invisible until they reach the organisation itself.

Combining local monitoring with external and shared threat intelligence can provide analysts with a broader picture of the threat landscape.

AI and Machine Learning can analyse large amounts of security data, correlate information from multiple sources, identify anomalies and help recognise patterns associated with malicious activity.

Within INTERCEPT, AI and ML capabilities are being integrated into several tools to assist analysts with detection, classification, correlation and incident management.

AI cannot reliably predict every cyberattack. However, analysing historical and current threat data can reveal patterns, anomalies and relationships that may indicate emerging malicious activity.

This can help security teams identify potential threats earlier and prioritise areas that require human investigation.

AI can accelerate analysis, but critical cybersecurity decisions still require human judgement.

Within the INTERCEPT threat-sharing process, an IOC must be validated by a SOC analyst before it is treated as confirmed threat intelligence and shared with others. AI therefore assists the analyst rather than independently making the final decision.

Anomaly detection identifies behaviour that differs from what is considered normal within a system or network.

Unexpected network connections, unusual user activity or abnormal system behaviour can indicate malicious activity. Anomaly detection can therefore help security teams identify threats that traditional rule-based systems might overlook.

SOC analysts spend significant time not only investigating threats but also documenting, categorising, reporting and communicating incidents.

The AI-supported Incident Management System being developed within INTERCEPT assists with ticket categorisation, incident classification, language validation, translation, contextual recommendations and reporting documentation. The solution is designed with a target of reducing analysts’ operational workload by up to 40%.

As incident volumes increase, mandatory documentation and regulatory reporting can create significant additional workload.

Automation allows information entered during incident management to be reused for reports, notifications and compliance documentation. This can reduce repetitive work, improve consistency and minimise errors caused by manual data entry.

An audit trail provides evidence of what happened during an incident and how it was managed.

It can record who performed particular actions, when changes were made, which measures were taken and who had access to specific information. This traceability is particularly important for regulated organisations and critical infrastructure operators.

Phishing is a type of cyberattack in which attackers impersonate trusted organisations or individuals to trick users into revealing sensitive information or taking harmful actions.

Modern phishing attacks are no longer limited to poorly written mass emails. Attackers can use leaked information, social engineering and publicly available data to create highly personalised and convincing messages.

They can also reproduce legitimate websites, logos and visual identities with considerable accuracy, making fraudulent websites increasingly difficult to distinguish from genuine ones. The low cost and wide availability of domain registration services make it easier to register domains that imitate legitimate organisations, while AI and automation can further simplify and accelerate the creation of convincing fake websites and phishing campaigns.

Domain impersonation occurs when attackers create a domain designed to resemble a legitimate organisation’s website or online service.

This may involve small changes to the domain name or the use of similar branding and website design. The goal is often to convince users to enter passwords, payment information or other sensitive data.

Phishing analysis can combine multiple sources of evidence.

The Brand Protect solution presented within INTERCEPT examines attributes such as domain registration information, SSL/TLS certificates, DNS records, hosting infrastructure, domain reputation and similarity to legitimate domains. It can also analyse the content and visual appearance of the suspicious website.

Within INTERCEPT, AI and ML capabilities are being integrated into several tools to assist analysts with detection, classification, correlation and incident management.

Static analysis evaluates information such as WHOIS data, DNS records, certificates and external reputation sources without relying solely on interaction with the website.

Dynamic analysis goes further by actively examining the webpage and evaluating characteristics such as URL similarity, content, layout, brand impersonation and logo usage. Combining both methods gives analysts a more complete assessment of whether a website is malicious.

Phishing websites often attempt to imitate trusted organisations by copying their logos, colours, typography and page layouts.

Comparing a suspicious page with a legitimate website can therefore reveal impersonation attempts. INTERCEPT’s Brand Protect approach includes visual comparison as an additional layer supporting the analyst’s final assessment.

Yes. Detection becomes significantly more useful when it triggers preventive action.

Once a malicious domain has been verified, it can become an IOC, be shared through threat intelligence systems and support protective measures such as DNS filtering. The INTERCEPT approach therefore connects phishing detection with verification, intelligence sharing and response.

DNS filtering can prevent users from reaching domains that have been identified as malicious.

If a phishing domain is detected and verified, DNS-level security policies can be updated to block access. This can protect users before they interact with the fraudulent website, turning threat intelligence into a proactive security measure.

Information Technology (IT) cybersecurity focuses primarily on systems that process, store and exchange digital information.

Operational Technology (OT) cybersecurity focuses on systems that monitor or control physical processes, including industrial control and SCADA systems. Cyber incidents in OT environments can therefore affect not only information but also physical operations and critical services.

A cybersecurity sandbox is an isolated environment where suspicious URLs, attachments or unknown software can be safely executed and analysed without exposing production systems to unnecessary risk.

Beyond checking whether a file or URL is malicious, a sandbox monitors its behaviour and records the process tree and actions performed during execution. These background processes can reveal important indicators that help analysts identify the type of threat, such as malware, an infostealer or a Trojan.

The sandbox developed within INTERCEPT focuses particularly on analysing suspicious files in environments that closely resemble real OT systems.

A hybrid sandbox combines physical and virtual components to create a realistic but controlled environment for analysing potentially malicious files.

The approach developed within INTERCEPT uses a real industrial computer as the target system, while other parts of the environment are virtualised. This is particularly important because sophisticated malware may recognise a fully virtualised environment and remain inactive if it does not match the system it was designed to target.

By combining real hardware with virtualised components, the sandbox can more accurately observe malware behaviour in conditions that closely resemble a real OT environment, while maintaining the flexibility needed for different testing scenarios.

Multi-layered malware analysis examines suspicious software using several complementary methods.

Within the INTERCEPT sandbox approach, a file can undergo initial commercial analysis followed, when necessary, by local behavioural and network analysis. Local analysis can identify changes to files, memory, processes, users or privileges, while network analysis can detect unusual communication with external systems.

Not all malicious activity produces obvious changes on the local computer. Malware may instead communicate with external servers, transfer information or attempt to reach unusual IP addresses.

Monitoring network traffic alongside local system behaviour provides analysts with another layer of evidence and can reveal malicious activity that might otherwise remain undetected.

Software intended for industrial environments can be tested in a controlled environment before being introduced into a customer’s operational infrastructure.

The INTERCEPT sandbox use case includes testing a SCADA system on hardware corresponding to its intended deployment environment. This allows potentially malicious or unexpected behaviour to be identified while supporting cybersecurity testing requirements.

SCADA systems generate large amounts of operational and security data. SIEM (Security Information and Event Management) systems help collect and analyse this information by applying rules and classifying processes and events.

Correctly identifying legitimate processes and reducing false positives helps limit unnecessary alerts and allows security teams to focus on potential threats.

A good starting point is understanding what needs to be protected. Organisations should maintain an accurate overview of their devices, servers, systems, users and access privileges and identify gaps in existing security measures.

Basic cybersecurity hygiene should include endpoint protection, system monitoring and logging, network and access segmentation, individual user accounts and controlled privileges. Employee awareness and regular cybersecurity training should complement these technical measures

Network segmentation separates systems and resources into different security zones and limits unnecessary communication between them.

If an attacker compromises one device, proper segmentation can make it more difficult to move laterally through the organisation and reach sensitive systems. Access should similarly be limited according to users’ roles and operational needs.

Even organisations with advanced security technologies cannot eliminate every possibility of an employee interacting with a malicious email, link or file.

The speed of the response can significantly affect the consequences. Employees should therefore know how to report suspicious activity immediately so security teams can investigate, isolate affected devices and limit potential damage.

Cybersecurity depends on a combination of technology, processes and people. Even the most advanced security solutions cannot eliminate human error, which often remains one of the weakest links in cybersecurity.

Effective protection therefore also requires clear procedures, appropriate access controls, employee awareness and the ability to recognise and quickly report suspicious activity.

Automation can perform repetitive actions that would otherwise require manual intervention from cybersecurity teams.

For example, security orchestration and automated response workflows can collect information, correlate alerts, create incident tickets, trigger notifications or support predefined response actions. This helps analysts concentrate on incidents that require deeper investigation.

Organisations rarely operate a single cybersecurity solution. SOC environments typically include SIEM, SOAR, firewalls, endpoint protection, threat intelligence platforms, ticketing systems and other technologies.

Interoperability allows these systems to exchange information and trigger coordinated workflows. INTERCEPT therefore uses API-based integration and standardised threat-sharing technologies to support connectivity with existing organisational infrastructure