Technology has penetrated the social fabric of security practices so deeply that it is often used without much reflection on its role, significance and implications. This naturalisation of technology makes it difficult for practitioners to develop their own vision of technology. They may become subject to the coercive power of technology, and appropriate the narrow technological paradigm embodied in their tools. This, in turn, makes it difficult for technology developers to understand practitioner needs and to assess the transformative potential of technology. This paper aims to develop a conceptual framework for understanding the role of technology in intelligence. The focus is on the technological capabilities supporting an analysis of sociocultural processes related to so‐called ‘new threats’. The two main problems in intelligence nowadays are deciding what data are relevant and how they should be analysed. The major issue is not the collection of information, but turning information into knowledge and action. Accordingly, the practitioner thinking about technological tools can be usefully informed by the concept of technology as a mediator between areas of knowledge production and consumption. This concept highlights technology’s ability to affect intelligence analysts’ understanding of threats, identification of data sources and information gaps, and their interaction with colleagues and consumers of intelligence products.