Threat-informed defense
Threat-informed defense uses knowledge of relevant adversary behavior to prioritize, implement, and evaluate an organization's defenses.
Use threat reporting to choose the work
Threat-informed defense starts with a practical question: which reported attacker behaviors matter to our organization, and what are we doing about them? A report about support-led account recovery abuse might prompt a service-desk procedure review. A report about stolen application credentials might change which access paths the identity team tests first.
MITRE INFORM groups the work into threat intelligence, defensive measures, and testing and evaluation. Those activities feed one another. Testing can reveal a gap; a fix can change what needs testing; new reporting can change the priority.
A technique list is only a starting point
Knowing that an attacker uses a technique does not tell you whether your environment is exposed to it. Connect the reported behavior to your systems and workflows. Keep the source and date alongside that decision, and separate what the report actually observed from what you are assuming locally.
An adversary emulation can test selected behaviors, but it is one part of the practice. Sometimes the immediate work is changing a procedure, improving a detection, or making sure responders have the logs they need. Choose the evaluation that answers the question, then use the result to decide what to change.