Intelligence Analysis and Structured Analytic Techniques
What this domain tests
Intelligence analysis and structured analytic techniques tests whether you can apply disciplined reasoning, separate facts from assumptions, express confidence and likelihood correctly, and use structured techniques to challenge your own conclusions. Expect scenario questions about bias, ACH, and analytic standards.
Analytic standards and language
Good analysis is objective, timely, transparent about sourcing, and explicit about assumptions. Estimative language should be defined for the audience; "likely" means more than "possible," and probability should be separated from analytic confidence. Confidence reflects the strength of the information and the logic, not how strongly you feel. Record what would change your judgment.
Common biases
- Confirmation bias: seeking evidence that supports the initial hypothesis.
- Anchoring: over-relying on the first indicator or vendor label.
- Availability: over-weighting recent or vivid incidents.
- Mirror-imaging: assuming the adversary thinks like you.
- Groupthink: converging on a consensus without dissent.
Structured techniques
- Analysis of Competing Hypotheses (ACH): list hypotheses, list evidence, rate consistency, and focus on diagnosticity - evidence that discriminates between hypotheses. Look for the hypothesis with the least inconsistency, not the most supporting items.
- Key Assumptions Check: surface and test the beliefs the judgment depends on.
- Devil's advocacy and red teaming: argue the opposite case and test detection from the adversary's perspective.
- What-if analysis and premortem: imagine the judgment failed and identify why.
- Indicators and signposts: define observable events that would confirm or refute a judgment over time.
- Quality of Information Check: assess source coverage, reliability, and gaps.
- Outside-in thinking: consider external drivers and the adversary's constraints.
Worked example
A phishing campaign targets a defense contractor. Hypotheses: state-sponsored espionage, criminal credential theft, hacktivist disruption. Evidence: spear-phishing to engineering staff, custom loader, infrastructure overlapping a known espionage cluster, no ransom demand. In an ACH matrix, shared commodity tooling is non-diagnostic; targeting and the custom loader are more discriminating. The hacktivist hypothesis is inconsistent with the quiet persistence. The judgment: espionage with moderate confidence, plus signposts such as follow-on lateral movement or data staging.
Traps that cost marks
- Treating ACH as a scoring ritual rather than a test of diagnosticity.
- Confusing confidence with probability.
- Ignoring disconfirming evidence.
- Failing to document assumptions and source gaps.
- Using techniques only at the end, after the conclusion is fixed.