*Published: 9/22/2026* ![[vintage_compass-ascii.png]] Made with the [Field Kit ASCII utility](https://opus-oss.github.io/field-kit/ascii.html) ## Axioms - Intelligence exists to reduce a defender's uncertainty; if it influences no decision, it was noise - An intrusion is ground truth; everything written above it is inference - Every report is an intrusion seen through someone's telemetry, and it inherits that telemetry's blind spots - The further a claim sits from telemetry, the more it should be hedged - Anticipatory work is intelligence when its assumptions are on the page and something could falsify them - Novelty and severity are different axes, and one is routinely mistaken for the other - Attribution is a working hypothesis, and should be labeled as one - Coverage of the news is not coverage of the threat - Confidence is a snapshot, thus only instantaneously true --- ## The zen approach to threat intelligence - Let the evidence carry the urgency; the writing should stay flat - Before adding to a crowded story, have something the existing reports don't - Ground every claim in something you saw; when you didn't see it, say so - Separate what you know, what you infer, and what you are guessing, and keep the guesses marked - Cite whoever saw it first, never the outlet that repeated it - A number without a source is a rumor with a decimal point - One mitigation at a chokepoint outweighs a page of indicators - Prioritize the behavior over the artifact, because behavior survives tooling changes - Lead with what lasts; domains and hashes rot fast, while a protocol quirk or a config fingerprint can hold for a whole campaign - When the industry fixates on the CVE, ask how the intrusion actually started - When two sources disagree, report the disagreement instead of averaging it - Say what would change your mind, so the reader knows what to watch for - Anchor your words of likelihood; Kent's own board agreed on "serious possibility" while meaning anything from 20 to 80 percent - Likelihood and confidence answer different questions; "probably" describes the event, confidence describes the evidence behind it, and a judgment can be probable on thin evidence - Pick one phrase per claim and stay with it; drifting from "likely" to "probable" to "we believe" reads as three different judgments - Date your confidence; intelligence decays - Correct in public; a dated update earns more trust than a quiet edit - Restraint reads as credibility over time - Clear beats vague, calm holds up better than loud, and useful outlasts impressive --- ## Evaluation questions for threat intelligence - Does it **reduce uncertainty** for a defender? - Is it **rooted in an intrusion**? - Did someone observe this, or is it repackaged reporting? - Can you separate what was **seen** from what was **assumed**? - Is it cited to **whoever saw it first**? - Is it **actionable**? - Does it name a **mitigation the reader can deploy**? - Is that mitigation aimed at a **chokepoint**? - Does it lead with indicators that **last**, or ones that rot by next week? - Is the **tone proportionate** to the risk? - Does the urgency come from the evidence itself? - Are you **adding signal**, or repeating what is already out there? - Is your **confidence dated** and scoped to what you saw? - Does it say **what would change your mind**? --- ## End goal Confidently answer "yes" to every one of these. - Did the right reader get this before they had to decide? - Did they understand it on one read? - Can they act on it without coming back to you? - Will it hold up when the facts firm up? - Is it still useful after the news has moved on? ## References and inspiration - [[Detection Principles]] (the zen approach to detection) - [David Bianco - The Pyramid of Pain](https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html) - [Sherman Kent - Words of Estimative Probability](https://www.cia.gov/resources/csi/studies-in-intelligence/archives/vol-8-no-4/words-of-estimative-probability/) - [Richards Heuer - Psychology of Intelligence Analysis](https://www.cia.gov/resources/csi/books-monographs/psychology-of-intelligence-analysis-2/) - [The Zen of Python](https://peps.python.org/pep-0020/)