What does it mean to obtain and use ‘cyber intelligence’ in a manner that effectively prioritises scarce resource across the full spectrum of ‘Assess, Protect, Detect & Respond’ cyber security disciplines?Threats in cyber-space arise for two main reasons; weakness in IT infrastructure and an interest taken by an attacker. Most businesses know they must mitigate cyber-threats for their own good but also because regulators require them to.Ensuring an organisation has the skills, agility and underlying platforms and processes to understand, detect and manage cyber-threats is one of the most compelling challenges faced by any business. Regulatory changes have pushed this issue up to board level.What should the priority be for an organisation that wants to improve its cyber security posture, finding and removing vulnerabilities in its infrastructure or assessing the external threats it faces?