In the Threat Intelligence Lifecycle, which stage captures the needs of consuming teams to refine priorities?

• A. Analysis
• B. Processing
• C. Dissemination
• D. Feedback

Answer: (D)

The question tests how a Threat Intelligence program gathers user input to steer what gets worked on next. In the Threat Intelligence Lifecycle, the feedback stage is where consuming teams review what they received, express what was useful, what was missing, and what should be prioritized in future efforts. This closes the loop and directly informs and refines priorities for upcoming collection, processing, and analysis work.

Processing hands raw data into usable pieces, and analysis turns those pieces into insights, while dissemination distributes the finished intelligence. None of these primary actions specifically capture and feed the needs and priorities of the users as a normal part of the workflow. Feedback, by design, captures that input and guides what the team focuses on next, making it the stage that aligns outputs with user needs.