Structured Analytic Techniques in Cyber Threat Intelligence

Photo by Jesse Martini on Unsplash

Structured Analytic Techniques

There are 3 types of techniques, grouped by their purpose: diagnostic, contrarian, and imaginative thinking. Here are the techniques, with examples and descriptions from A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis.

Diagnostic Techniques

These make analytic arguments, assumptions, or intelligence gaps more transparent.

  • Quality of Information Check: “Evaluates completeness and soundness of available information sources.”
  • Indicators or Signposts of Change: “Periodically review a list of observable events or trends to track events, monitor targets, spot emerging trends, and warn of unanticipated change.”
  • Analysis of Competing Hypotheses (ACH): “Identification of alternative explanations (hypotheses) and evaluation of all evidence that will disconfrm rather than confrm hypotheses.”

Contrarian Techniques

These challenge current thinking.

  • Team A/Team B: “Use of separate analytic teams that contrast two (or more) strongly held views or competing hypotheses.”
  • High-Impact/Low-Probability Analysis: “Highlights a seemingly unlikely event that would have major policy consequences if it happened.”
  • “What If?” Analysis: “Assumes that an event has occurred with potential (negative or positive) impact and explains how it might come about.”

Imaginative Thinking Techniques

These aim to develop new insights, different perspectives and/or alternative outcomes.

  • Outside-In Thinking: “Used to identify the full range of basic forces, factors, and trends that would indirectly shape an issue.”
  • Red Team Analysis: “Models the behavior of an individual or group by trying to replicate how an adversary would think about an issue.”
  • Alternative Futures Analysis: “Systematically explores multiple ways a situation can develop when there is high complexity and uncertainty.”

How to Use Structured Analytic Techniques

Different techniques are useful at different points in an analysis project.

  • Middle: Contrarian techniques (e.g., Team A/Team B), Red Team, deception detection (e.g., Quality of Information Check, Analysis of Competing Hypotheses [ACH])
  • End: Brainstorming, Key Assumptions Check, Devil’s Advocacy, deception detection (e.g., Quality of Information Check, Analysis of Competing Hypotheses [ACH])
  • Throughout: Analysis of Competing Hypotheses (ACH), Alternative Futures Analysis, Indicators or Signposts of Change

Additional Resources



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store