Threat Analysis and Production
This domain tests analysis technique and judgement: structured reasoning, calibrated confidence, and the discipline to stop at the attribution level the evidence supports.
From indicator to assessment
Analysis answers three questions: so what, for whom, and how sure. Products are tactical (indicator bulletins, detection content), operational (campaign reports, actor profiles) and strategic (threat landscape, board briefing). Each has a different length, vocabulary and decision attached.
Structured analytic techniques
- Analysis of Competing Hypotheses - list hypotheses, list evidence, score consistency, and deliberately seek evidence that disproves rather than confirms.
- Key Assumptions Check, devil's advocacy, red teaming, what-if analysis, indicators and signposts. The purpose is to surface confirmation bias, anchoring, availability bias and mirror-imaging before they reach the consumer.
Confidence and likelihood language
Use a defined lexicon - almost no chance, unlikely, roughly even, likely, almost certain - and state confidence as low, moderate or high with its basis (source reliability, corroboration, analytic agreement). Never write certainty.
Attribution levels
Four commonly used levels: the incident happened; it is this malware family; it is this cluster or campaign; it is this actor or nation-state. Attribution needs infrastructure, tooling, victimology and timing correlation, and false flags are common. For defence, the "who" rarely changes the "what do we patch".
Deliverables that survive review
Bottom line up front, then key judgements, then evidence, then sources and confidence, then recommendations. Attach a machine-readable annex for the SOC.
Worked example
Three intrusions share a command-and-control domain and the same loader, but differ in victim sector and working hours. Hypothesis A: one actor. Hypothesis B: a shared criminal loader service. Reasoning with competing hypotheses: shared tooling fits both, so it is not diagnostic; different victimology and time zones fit B better; the shared domain serves unrelated victims, which actively counts against A. Judgement issued: moderate confidence these are separate clusters using a common loader service. That framing redirects defence toward hunting the loader rather than blocking one actor's infrastructure.
Traps that cost marks
- Collecting only evidence that supports the first hypothesis.
- Stating attribution with more confidence than the evidence supports.
- Producing a summary with no recommendation - that is not a product.
- Ignoring base rates; rare events are usually benign.