Glossary
What Is Forward Threat Intelligence?
Forward threat intelligence is finding an adversary's infrastructure before it is used — the not-yet-weaponised domains and servers an operator has staged but no feed has flagged. It is the opposite of reactive intelligence: instead of listing what is already burned, it surfaces the next wave by pivoting on shared fingerprints.
Reactive vs forward
Most threat feeds are reactive: an indicator earns a listing only after it has done harm and been observed. By the time it reaches you, the operator has often moved on. Forward intelligence works ahead of the feeds — it finds the infrastructure that shares an operator's fingerprint but has not yet been used or flagged.
How latent infrastructure is found
Operators reuse things: a registrant email, a favoured nameserver, a hosting pattern, a way of naming domains. Pivoting from one known-bad node along those shared attributes surfaces siblings — and filtering those siblings to the ones in no threat feed isolates the latent set, the next wave before it launches.
Why it changes the timeline
Acting on forward intelligence means blocking or watching infrastructure before the campaign goes live, shifting the defender from cleanup to pre-emption.