Threat intelligence gets its value from being shared: one team's hard-won discovery becomes another's early warning. But not everything can be shared with everyone. A report might name a victim, expose a sensitive source, or tip off an attacker if it leaks. Teams need a fast, unambiguous way to say how widely a piece of information may travel. The Traffic Light Protocol (TLP), maintained as a public standard by FIRST — the Forum of Incident Response and Security Teams — does exactly that with a handful of colored labels everyone agrees on.

Why a shared label matters

Without a common convention, sharing turns into guesswork. The sender assumes the reader will 'use good judgment'; the reader isn't sure whether they may forward it. That ambiguity either freezes useful information in place or leaks it too far. The Traffic Light Protocol (TLP) removes the guesswork by attaching one standard label that both sides understand identically.

TLP is deliberately simple — a small set of colors, each with a precise meaning about who may receive the information. Because it is a public standard from FIRST (the Forum of Incident Response and Security Teams), a label means the same thing across organizations, sectors, and countries.

📌
One label, one meaning. TLP replaces 'use your judgment' with a standard color whose sharing rules both sender and receiver understand identically.

The five levels

The current standard, TLP version 2.0, defines five levels. TLP:RED is the most restrictive: the information is for the named recipients only and may not be shared further. TLP:AMBER+STRICT limits sharing to the recipient's own organization. TLP:AMBER allows sharing within the organization and its clients on a need-to-know basis.

TLP:GREEN opens it up to the recipient's wider community or sector, but not the public. TLP:CLEAR (which replaced the older 'TLP:WHITE') carries no restrictions — it may be shared freely, including publicly. Reading from red to clear is simply reading from tightest to most open.

Five standard labels, from the most restrictive (RED) to unrestricted (CLEAR). TLP 2.0 levels TLP:RED named recipients only TLP:AMBER+STRICT recipient's org only TLP:AMBER org and its clients TLP:GREEN the community, not public TLP:CLEAR no limits, public
Five standard labels, from the most restrictive (RED) to unrestricted (CLEAR).

Picking the right label

Choosing a label comes down to one question: who genuinely needs to see this, and how much harm follows if it spreads further? If only named individuals can be trusted with it, it is RED. If it belongs inside one organization, it is AMBER (or AMBER+STRICT to exclude clients). If a whole community should benefit but the public should not, it is GREEN. If there is no sensitivity at all, it is CLEAR.

The instinct to over-restrict is as damaging as the instinct to over-share. Marking everything RED strangles the collaboration that makes intelligence valuable; marking a sensitive item CLEAR can burn a source or warn an adversary. The label should match the real sensitivity, no more and no less.

Match the label to who genuinely needs the information, not to habit. Which label? Named only An org Wider Who needs it? TLP:RED named people TLP:AMBER one organization TLP:GREEN / CLEAR a community or all
Match the label to who genuinely needs the information, not to habit.

Marking a report

A label only works if it is visible and applied consistently. The convention is to put the TLP level where it cannot be missed — in the subject line or email header, and at the top of the document — written in full, such as 'TLP:AMBER'. When different parts of a report carry different sensitivities, each section is marked with its own level, so a reader knows the rules paragraph by paragraph.

Consistency is what makes the protocol trustworthy. A report whose label is buried, abbreviated, or missing forces the reader back into guesswork — the very problem TLP exists to solve.

A label is chosen, placed where it can't be missed, applied per section, then shared. Applying a label Choose level match sensitivity Mark the header clear and full Mark each section where they differ Share within the rules
A label is chosen, placed where it can't be missed, applied per section, then shared.

Common mistakes

Most TLP failures are not exotic. They come from treating the label as decoration rather than a rule everyone follows.

  • Over-classifying — marking routine information RED so no one can use it
  • Under-classifying — marking sensitive information CLEAR and losing control of it
  • Hiding the label where a busy reader will miss it
  • Assuming the label is enforced by software — TLP is a trust agreement, not a technical control

TLP for AI-incident intelligence

As teams start sharing intelligence about attacks on AI systems — a manipulated prompt that hijacked an agent, a poisoned data source, a stolen agent credential — the same labels apply unchanged. A detailed write-up that names the affected AI agent — software that uses a model to take real actions like calling tools — and its internal setup might be AMBER, shared only with trusted defenders. A sanitized, generic lesson for everyone might be CLEAR.

The label is a trust agreement, not a technical control, which matters doubly for automated pipelines: a system that forwards or publishes intelligence must respect the TLP level a human assigned, never override it. Sharing AI-incident intelligence responsibly uses the very same five colors as everything else.

The TLP label on an AI-incident report decides who receives it and who is held back. Sharing an AI incident Trusted defender group marked shared with withheld AI-incident report marked TLP:AMBER Check the label who may receive Trusted defenders org and clients Not the public held back
The TLP label on an AI-incident report decides who receives it and who is held back.

Key takeaways

  • The Traffic Light Protocol (TLP) is a public FIRST standard for saying how far a piece of intelligence may be shared.
  • TLP 2.0 has five levels: RED, AMBER+STRICT, AMBER, GREEN, and CLEAR — from named-recipients-only to unrestricted.
  • Pick the label by who genuinely needs the information; over-restricting is as harmful as over-sharing.
  • Mark the level visibly — in the header and per section — written in full so no reader has to guess.
  • TLP is a trust agreement, not a technical control; automated systems must respect the level a human assigned.
  • The same five labels apply unchanged to sharing intelligence about AI-agent incidents.

Glossary

Traffic Light Protocol (TLP)
A public standard of colored labels that state how widely a piece of information may be shared.
FIRST
The Forum of Incident Response and Security Teams, the body that maintains the TLP standard.
TLP:RED
The most restrictive level: for the named recipients only, not to be shared further.
TLP:CLEAR
The open level (formerly TLP:WHITE): no restrictions, may be shared publicly.
TLP:AMBER+STRICT
A level limiting sharing to the recipient's own organization, excluding its clients.