‹ Shelves / Intelligence analysis ■ Intelligence analysis methods — 2026The methods an analyst uses in 2026, from the ICD 203 standards and probabilistic language to ACH, indicators, red teaming, scenarios, calibrated forecasting and AI-assisted analysis. Every lesson has a quiz.
33 lessons · 51 min
The reading track 33 lessons All With quiz · 33 All authors US Government · 4 US Joint Chiefs of Staff · 3 Office of the Director of National Intelligence (ODNI) · 2 Guvernul SUA (CIA, Center for the Study of Intelligence) · 2
01 Analysis is a mental process that runs through simplified models of reality; structure exists to bring the model into the open, where it can be checked. Psychology of Intelligence Analysis · Richards J. Heuer Jr. · 1999 ✓ Quiz · 3 questions › 02 ICD 203 asks five things of every analytic product — objectivity, independence from politics, timeliness, all sources and tradecraft — and independence protects the other four. Intelligence Community Directive 203: Analytic Standards · Office of the Director of National Intelligence (ODNI) · 2015 ✓ Quiz · 3 questions › 03 A probability word with no number behind it is read differently by every reader; the remedy is an agreed scale with numerical ranges. Words of Estimative Probability · Sherman Kent · 1964 ✓ Quiz · 3 questions › 04 Probability says how likely the event is; confidence says how solid the basis for saying so is. They are two axes and are written separately. Explaining Uncertainty in UK Intelligence Assessment · Professional Head of Intelligence Assessment (PHIA), Guvernul Regatului Unit · 2025 ✓ Quiz · 3 questions › 05 Every report gets two independent grades: a letter for the source, based on its track record, and a figure for the information, based on corroboration and logic. FM 2-22.3 Human Intelligence Collector Operations · Headquarters, Department of the Army (SUA) · 2006 ✓ Quiz · 3 questions › 06 The quality of information check periodically tests whether the source base really supports the judgement; the number of sources is no substitute for their quality. A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis · US Government · 2009 ✓ Quiz · 3 questions › 07 Every assessment rests on premises accepted without discussion; the key assumptions check writes them down, challenges them and says in advance what would overturn them. A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis · US Government · 2009 ✓ Quiz · 3 questions › 08 Strategic intelligence failures cannot be removed by reorganisation: evidence is ambiguous, judgement ambivalent, and the great misses often happen at the decision-maker. Analysis, War, and Decision: Why Intelligence Failures Are Inevitable · Richard K. Betts · 1978 ✓ Quiz · 3 questions › 09 Analysis of competing hypotheses makes every reasonable explanation compete on the same evidence and keeps the one the evidence refutes least. Psychology of Intelligence Analysis · Richards J. Heuer Jr. (CIA, Center for the Study of Intelligence) · 1999 ✓ Quiz · 3 questions › 10 Strategic surprise comes not from missing information but from faint signals buried in louder, more plausible noise. Pearl Harbor: Warning and Decision · Roberta Wohlstetter · 1962 ✓ Quiz · 3 questions › 11 Warning is not information you either have or lack but a judgement built from an indicator list prepared in advance. Anticipating Surprise: Analysis for Strategic Warning · Cynthia M. Grabo (Joint Military Intelligence College) · 2002 ✓ Quiz · 3 questions › 12 Devil's advocacy tests a single dominant consensus; Team A/Team B sets two equally strong positions against each other. A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis · US Government · 2009 ✓ Quiz · 3 questions › 13 Red teaming is the independent, structured challenge of your own plan in service of a better decision — not a team playing the enemy. Red Teaming Handbook (3rd Edition) · UK Ministry of Defence — Development, Concepts and Doctrine Centre (DCDC) · 2021 ✓ Quiz · 3 questions › 14 A premortem asks the team to assume the plan has already failed and explain why, so objections surface while there is still time. Performing a Project Premortem · Gary Klein (Harvard Business Review) · 2007 ✓ Quiz · 3 questions › 15 When everyone is sure something will not happen, it is worth writing down how it could happen after all and what you would see first. A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis · US Government · 2009 ✓ Quiz · 3 questions › 16 Scenarios do not guess the future: they separate what is already determined from what is truly uncertain and change the decision-maker's mental model. Scenarios: Uncharted Waters Ahead · Pierre Wack (Harvard Business Review) · 1985 ✓ Quiz · 3 questions › 17 Superforecasters were not born, they were found and grown: a tournament scored with the Brier score identified them by performance, and training, elite teams and practice made them better year after year instead of regressing to the mean. Identifying and Cultivating Superforecasters as a Method of Improving Probabilistic Predictions · Barbara Mellers, Philip E. Tetlock et al. · 2015 ✓ Quiz · 3 questions › 18 Before judging a case by its details, ask how similar cases ended: the base rate is the starting point, and the details only adjust it. Timid Choices and Bold Forecasts: A Cognitive Perspective on Risk Taking · Daniel Kahneman & Dan Lovallo · 1993 ✓ Quiz · 3 questions › 19 Bayes does not ask you to guess the truth, only to make one judgement per item of evidence: how many times more likely it is if the hypothesis is true than if it is false. Bayes' Theorem for Intelligence Analysis · Jack Zlotnick (CIA, Center for the Study of Intelligence) · 1972 ✓ Quiz · 3 questions › 20 A close, friendly group is in the greatest danger of no longer thinking critically, and the remedy is a procedure that makes objection a duty rather than a betrayal. Victims of Groupthink: A Psychological Study of Foreign-Policy Decisions and Fiascoes · Irving L. Janis · 1972 ✓ Quiz · 3 questions › 21 Effective deception does not change your belief, it confirms it; the most dangerous set of clues is the one that fits perfectly with what you already believed. Deception Maxims: Fact and Folklore · Central Intelligence Agency, Office of Research and Development · 1980 ✓ Quiz · 3 questions › 22 An adversary is not analysed in a vacuum: first the environment — political, military, economic, social, information and infrastructure systems — then what the adversary can do within it. Joint Publication 2-01.3: Joint Intelligence Preparation of the Operational Environment · US Joint Chiefs of Staff · 2014 ✓ Quiz · 3 questions › 23 Open source material becomes evidence only when you can show where it came from, that it has not been altered, and what you did with it from the first search onwards. Berkeley Protocol on Digital Open Source Investigations · OHCHR & Human Rights Center, UC Berkeley School of Law · 2022 ✓ Quiz · 3 questions › 24 A wargame does not predict, it discovers: it shows what is plausible and where the plan gives way when someone genuinely opposes it. Wargaming Handbook · UK Ministry of Defence, Development, Concepts and Doctrine Centre (DCDC) · 2017 ✓ Quiz · 3 questions › 25 A product written with the help of a model is still an intelligence product: the same standards and the same question — how do you know — and the answer must lead to real sources, not to the model. Artificial Intelligence Ethics Framework for the Intelligence Community (v1.0) · Office of the Director of National Intelligence (ODNI) · 2020 ✓ Quiz · 3 questions › 26 Analysis is one step in a cycle; what comes out is at best as good as the question asked at the start and the evidence collected for it — which is why the intelligence requirement is written before any search. Joint Publication 2-0, Joint Intelligence · US Joint Chiefs of Staff · 2013 ✓ Quiz · 3 questions › 27 New ideas do not come from free-flowing talk but from a divergent phase with rules (nothing is censored, an "outsider" at the table, an hour until the commonplaces run out) followed by a convergent one; and a written chronology is the cheapest way to see what is missing and what does not fit. A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis · Guvernul SUA (CIA, Center for the Study of Intelligence) · 2009 ✓ Quiz · 3 questions › 28 Before you analyse the actors you follow, list the forces none of them controls — social, technological, economic, environmental, political — and ask how each could upend the problem; otherwise you find the missing variable after you have coded the whole file. A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis · Guvernul SUA (CIA, Center for the Study of Intelligence) · 2009 ✓ Quiz · 3 questions › 29 A network is read with three measures, not one: who has the most ties (degree), who sits on the path between groups (betweenness) and who reaches everyone quickly (closeness) — and Krebs's lesson is that the most visible person is not necessarily the one the information flows through. Mapping Networks of Terrorist Cells · Valdis E. Krebs · 2002 ✓ Quiz · 3 questions › 30 An intrusion is not an event but a progression in seven phases; it is a "chain" because any broken link stops the whole — so a defender who recognises a campaign's pattern can stop it early, with intelligence, rather than just clean up after it. Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains · Eric M. Hutchins, Michael J. Cloppert, Rohan M. Amin (Lockheed Martin) · 2011 ✓ Quiz · 3 questions › 31 An intrusion event has four corners — adversary, capability, infrastructure, victim — linked by edges the analyst pivots along: from a domain to all its victims, from a tool to the adversary who uses it; ATT&CK then gives every behaviour a common name, so two teams can talk about the same technique. The Diamond Model of Intrusion Analysis · Sergio Caltagirone, Andrew Pendergast, Christopher Betz · 2013 ✓ Quiz · 3 questions › 32 An influence operation is analysed like an intrusion: not "is it false or true", but which tactic it pursues, with which techniques, through which accounts and channels — DISARM borrows ATT&CK's form so defenders name the same behaviour by the same name and can share it. DISARM Disinformation TTP Framework · DISARM Foundation · 2024 ✓ Quiz · 3 questions › 33 An analytic product is written for someone with three minutes and a decision: the judgement in the first sentence, with its probability term and confidence level, then the evidence with each item's source, then what would change the judgement — the reverse order from how the analyst thought. Joint Publication 2-0, Joint Intelligence · US Joint Chiefs of Staff · 2013 ✓ Quiz · 3 questions ›