Knowledge Base

The intelligence reference library

Priority intelligence requirements, collection planning, the intelligence cycle and the tradecraft around them, written by practitioners and cross-linked so it reads as a reference rather than a blog.

Requirements & Direction

Deciding what to care about before collecting anything.

Start with PIRs

4 articles →

Intelligence Fundamentals

What intelligence is, and the cycle it moves through.

Start with Intelligence cycle

1 article →

Analysis

Turning collected material into an assessment somebody can act on.

Start with The Big 5

3 articles →

Collection

Sources, coverage, and knowing when they fail.

Start with Sources and OSINT

1 article →

Dissemination

Getting finished intelligence to the people who act on it.

Start with Report writing

1 article →

Programme Building

Standing up and maturing a cyber threat intelligence function.

Start with Building a capability

2 articles →
Index

Every article, A to Z

12 published.

AI and LLMs in cyber threat intelligence

Analysis

Building a CTI capability

Programme Building

Essential Elements of Information (EEIs)

Requirements & Direction

Intelligence sources and OSINT

Collection

MITRE ATT&CK, and why TTPs beat actor names

Analysis

Organisation, sector and global: the three spheres

Requirements & Direction

Priority Intelligence Requirements (PIRs)

Requirements & Direction

Report writing, cadence and format

Dissemination

The Big 5 attack vectors

Analysis

The CTI maturity model

Programme Building

The Intelligence Collection Plan (ICP)

Requirements & Direction

The intelligence cycle

Intelligence Fundamentals