• High-Value Target - Know Your Customer Risk and Attack Surface Assessment
    High-Value Target - Know Your Customer Risk and Attack Surface Assessment
  • Offensive Cyber Operations - When you least expect it
    Offensive Cyber Operations - When you least expect it
  • Cyber Intelligence Training
    Cyber Intelligence Training
  • Silent Warriors - Wilderness of Cyber Mirrors
    Silent Warriors - Wilderness of Cyber Mirrors
  • Denial and Deception
    Denial and Deception
  • Analysis as a Service
    Analysis as a Service
  • Critical Thinking - Cognitive Bias
    Critical Thinking - Cognitive Bias
  • Clandestine Cyber HUMINT
    Clandestine Cyber HUMINT

High Value-Income Target - Know Your Customer Assessment

Executive Leadership Cyber Dossier – Internet and Social Media Attack Surface Assessment – (High-Value Target Assessment (HVT-A) – Know Your Customer (KYC)

Open source findings on executives across the internet & social media

  • Information disclosure
  • Potential physical threats of harm
  • Unsecured social network accounts

What is the complete intent of the exercise?

What does the sponsor expect to do with the information?

What is the timeline expected for delivery of each dossier?


Read more ...

Threat Intelligence Platform Assessment Services

Treadstone 71 assists you in your Threat Intelligence Platform selection process. Based upon a foundation in intelligence community tradecraft, security operations, and threat intelligence, we craft a structured analytic techniques method to TIP assessment. Our workbook and methods are used for the review and completion of the questionnaire by the vendors and by TIP participants. Completion of the Treadstone 71 workbook is required within 5 business days after receipt and may only be shared with the client and point-of-contact for the TIP evaluation. 


Read more ...

Internal Intelligence Community - Information Sharing

Treadstone 71 advisory services for Internal Intelligence Community program build

  1. The Strategic Environment section portrays your organizations internal and external security environment;
  2. The Mission Objective section describes key mission priorities and expected outcomes;
  3. The Enterprise Objective section describes resource and capability outcomes needed to enable mission success; and
  4. The Implementing the Strategy section provides broad organizational guidance to meet the Treadstone 71 TI Team’s requirements.


Read more ...

Treadstone 71 Training and Services

Treadstone 71 - We See What Others Cannot

 Training Assessments Planning and Build Research
Cyber Intelligence Tradecraft Certification Threat Intelligence Platform  Intelligence Program Strategic Planning Targeted Adversaries / Dossiers / Baseball Cards
Cyber CounterIntelligence Tradecraft Certification Cyber-Threat Intelligence Program Maturity Intelligence Program Build High-Value Targets
Clandestine Cyber HUMINT  Vendor Intelligence Feeds Policies, Procedures, Critical Success Factors, Key Performance Indicators, Process Flow  Campaign Analysis / Analysis as a Service
Critical Thinking, Structured Analytic Techniques, Analytic Writing Geo-Political / Socio-Cultural Assessments Case Study Testing - Table Top Exercises - Scenario Development Retainer Services
Customized Courses Threat and Attack Surface Assessments Stakeholder Analysis - Analytic Writing and Dissemination Open Source - In-Depth - Contextual
تدريب مخابرات سيبرانية - سيبر مكافحة الذكاء التدريب  استخبارات سيبرانية -  تخطيط استراتيجي  جمع مصدر مفتوح وتحليل منظم  - طرق عدم كشف عن هويته  بحوث مستهدفة وإبلاغ - تحليل كخدمة

Training Fortune 500 and Government Organizations Since 2009

Treadstone 71 Cyber Intelligence Capability Maturity Model

Treadstone 71 Cyber Intel Training 2018Treadstone 71 developed a maturity model to help organizations determine the maturity of their cyber intelligence initiatives against the cyber intelligence common body of knowledge (CICBOK). The model provides strategic and operational aspects of your cyber intelligence maturity, where it needs to go, and where you should concentrate your attention to create more value for your business. Nearly 8 years in the making, the Treadstone 71 Cyber Intelligence Maturity Model uses traditional tradecraft as delivered by Sherman Kent and Richards Heuer, intelligence community standards, analytic standards, and experiential knowledge derived from years of training, assessing, and building cyber intelligence programs.



The Treadstone 71 Cyber Intelligence Capability Maturity Model (T71-CICMM) is a methodology used to develop and refine an organization’s cyber intelligence program. Not only is the model educational and practical skills for learning and developing expertise, but also a roadmap for building a cyber intelligence program. More information is available here:

Treadstone 71 Cyber Intelligence Capability Maturity Model (registered copyright 2017)

Read more ...

What is Analysis?

  • This includes integrating, evaluating, and analyzing all available data—which is often fragmented and even contradictory—and distilling it into the final intelligence products, which highlight information on topics of immediate importance or make long-range assessments.
  • Analysts, who are subject-matter specialists, absorb incoming information, evaluate it, produce an assessment of the current state of affairs within an assigned field or substantive area, and then forecast future trends or outcomes.
  • They integrate data into a coherent whole, put the evaluated information in context, and produce finished intelligence that includes assessments of events and judgments about the implications of the information for your organization.


  • Use structured analytic techniques and types of analysis
  • Analysts are encouraged to include alternative futures in their assessments and to look for opportunities to warn about developments abroad that could either provide threats to or opportunities for organizational security and policy interests.
  • Analysts also develop requirements for the collection of new information. From analysis, we move to analytic writing.

What to know more? Sign up for Treadstone 71 Cyber Intelligence Training 

Treadstone 71 Training - 2018 Courses

The Treadstone 71 training courses follow intelligence tradecraft following standard intelligence community lifecycle including collection methods, techniques, planning, PIRs, and collection tools and targeting with a focus on intelligence analysis. Intelligence production methods and process flows are covered as well as evidence credibility, reliability, denial and deception, and confidence levels. Students are required to demonstrate understanding and use structured analytic techniques as well as various types of analysis including synthesis and fusion of data and information into actionable intelligence. The class covers methods of adapting TTPs and IoCs for hunt and detect and interfaces to incident response.

 Sign up for courses here

Read more ...

Fallacies in Threat Intelligence Lead to Fault Lines in Organizational Security Postures

Treadstone 71 Training 2017  Organizations follow inaccurate definitions of threat intelligence leading to poorly conceived cyber threat intelligence programs. Vendors communicate threat intelligence Reflectionsdefinitions supporting their offerings propagating the fallacy that threat intelligence solves numerous security problems. (updated)

Cyber Threat Intelligence functions being built on a foundation that is not supported by standard intelligence tradecraft. Many programs support a fraction of the intelligence needs, yet stakeholders hold unrealistic expectations based upon expenditures.

Read more ...

Search Our Site

Treadstone 71 - We See What Others Cannot

The Cyber Intelligence Training delivered and created by Jeff Bardin adds rapid returns to both Cyber Intel Analysts, and Security Ops Centers.  Each student receives quality instruction and hands-on experience with today’s OSINT tools and intelligence tradecraft.  This is necessary for anyone new to Cyber Intelligence and complimentary to any Security Operations within your enterprise. This 4.5-day class provides the student with the resources and fundamentals needed to establish cyber intelligence as a force as both a proactive offensive step and a counter intelligence-contributing arm of your larger team.  – Antonio, 

Fortune 100 Company


January 8-12 Cyber Intelligence- Amsterdam, NL
February 5-9 Cyber Intelligence- Reston, VA
March 12-16 Cyber Counterintelligence - Reston, VA (Cyber Intel Course Pre-Requisite)
March 19-23 Cyber Intelligence- Columbia, Maryland
April 9-13 Cyber Intelligence- London, UK
April 30 – May 3 Cyber Intelligence - Los Angeles California - Burbank
May 14-18 Cyber Intelligence- San Jose, CA
June 18-22 Cyber Intelligence- Annapolis Junction, Maryland
Aug 13-17 Cyber Intelligence- Reston, VA
Sep 17-21 - Cyber Intelligence- Boston, MA
Oct 15-19 Cyber Counter Intelligence - Reston, VA
Nov 5-9 Cyber Intelligence- Denver, CO
Dec 3-7 Cyber Counter Intelligence - Columbia, Maryland


Students and organizations taught (non-inclusively):

AIB, American Express, Capital One, Commonwealth Bank, Bank of America, ING, NCSC NL, Defense Security Services, PNY, Dell Secureworks, HPE Security, EclecticIQ, Darkmatter (AE), General Electric, General Motors, PNC, Sony, Goldman Sachs, NASA, DoD, East West Bank, Naval Air Warfare Center, VISA, USBank, Wyndham Capital, Egyptian Government, DNB Norway, Euroclear, Malaysian Cyberjaya, People's United Bank, Baupost Group, Bank of North Carolina, Fidelity Investments, Citi, Citigroup, T. Rowe Price, Wells Fargo, Discover, Blackknight Financial Services, Intercontinental Exchange (ICE), Citizens Financial Group, Scottrade, MetLife, NY Life, Synchrony Financial, TD Ameritrade, National Reconnaissance Office, FBI, Stellar Solutions, Lockheed Martin, Harvard Pilgrim, State of Florida, Deloitte, Ernst and Young, Mitsubishi, Tower Research, Geller & Company, KeyBank, Fannie Mae, BB&T, Aviation ISAC, JP Morgan Chase, Barclays, Nomura International, ING, Finance CERT Norway, BBVA, Santander, Bank of America, Equifax, BNY Mellon, OCC, Verizon, Vantiv, Bridgewater Associates, Bank of Canada, Credit Suisse, HSBC, International Exchange, Vista Equity Partners, Aetna, Betaalvereniging Nederland, several members of FlashPoint, non-inclusively (as well as several other firms by proxy as they hire qualified intelligence professionals trained by Treadstone 71).

Terms of Use - Privacy Policy - Course EULA



"Fantastic class that gets to the foundational aspects of traditional tradecraft. We studied hard examining recent attack campaigns. The analysis training prepared me for real-world efforts. Have to say this is one of the best classes I have ever taken having taken many from SANS.  SANS does not compare. They are more of a class mill today.  The Treadstone 71 course material is unique, focused, and timely."

“This is one of the best, if not the best, Cyber Threat Intelligence training course I've attended.”


  Treadstone 71 Cyber Intelligence Services

  Treadstone 71 Expands Groundbreaking Services


Cyber Jihad - 2008-2011 Compilation Part 1


Cyber Jihad - 2008-2011 Compilation Part II


Iran Cyber Proxies and Capabilities 

Gaming as a Method of Jihadist Training








Treadstone 71 Cyber Intel Services / Training