Actor-first
Track people, not only data
Infrastructure changes every week. The operator behind it, with the same intent and the same incentives, changes far less often. Targeting starts there.
Framework · Six phases · Built for disruption
Adaptive Cyber Intelligence Lifecycle
Built for disruption. Driven by foresight.
Most intelligence cycles end in a report. The Adaptive Cyber Intelligence Lifecycle ends in an action. Six phases carry a team from the first intelligence requirement to a disruption package a decision-maker signs. Then the result feeds the next cycle. Treadstone 71 runs the lifecycle on every engagement and teaches it in its training.
6Phases, one loop
66Structured techniques
A–F · 1–6Source grades
7Kent probability bands
What is the Adaptive Cyber Intelligence Lifecycle?
The Adaptive Cyber Intelligence Lifecycle is the six-phase intelligence production cycle Treadstone 71 built for adversary disruption. The cycle runs from target framing through collection, processing, analysis, and operational injection to a foresight loop that feeds the next cycle. Priority Intelligence Requirements anchor the first phase. Every source carries an ASA Evidence Standard grade. Analysis draws on 66 structured analytic techniques, STEMPLES Plus, and the Cultural Nexus Framework, and every judgment states its likelihood on the Sherman Kent spectrum with half-open intervals. Each cycle ends in an action package tied to a named decision.
- Type
- Intelligence production lifecycle
- Phases
- Six, in a closed loop
- Anchor
- Priority Intelligence Requirements
- Source grading
- ASA Evidence Standard, A to F and 1 to 6
- Analysis
- 66 SATs, STEMPLES Plus, Cultural Nexus
- Probability
- Sherman Kent spectrum, half-open intervals
- Output
- An action package tied to a decision
- Available as
- Engagement, program build, training, licensed instrument
Core principles
Three rules run through every phase
Live loop
Every result feeds the next requirement
Field outcomes return to the requirements and the indicators, so the model sharpens with each cycle.
Mission-tied
Every product points to an action
Disrupt, dismantle, block, or refer for arrest. A product with no decision attached goes back to the analyst.
The lifecycle
Six phases, one loop
Each phase names its tradecraft and its output. The output of one phase is the input to the next, and phase six feeds phase one.
01Target framing
Frame the right targets
Break down crimeware rings, laundering paths, and corrupt logistics networks. Write the Priority Intelligence Requirements. Simulate the adversary's next moves with AI-assisted red-teaming.
- Tradecraft
- PIRs, STEMPLES Plus, ACS
- Output
- Target set and written requirements
02Smart collection
Collect smarter
Persona-safe collection fuses AI and HUMINT to surface the signals that count from ransomware crews, crypto fraud, and trafficking operations. Native-language sources come first where the adversary speaks them.
- Tradecraft
- OPSEC-hardened personas, OSINT Cultural Nexus Framework
- Output
- Collection plan and raw reporting
03Processing
Make threats visible
Raw data becomes structured threat objects. Blockchain logs, malware, and dark-forum chat are tagged with behaviors, and every source is graded before analysis starts.
- Tradecraft
- ASA Evidence Standard: reliability A to F, credibility 1 to 6, never averaged
- Output
- Graded, behavior-tagged threat objects
04Analysis
Analyze with an edge
Structured techniques and AI break bias, run scenarios, and forecast the adversary's next move. Every judgment carries a Sherman Kent band and names the indicator that overturns it.
- Tradecraft
- 66 SATs, bias checks, Indicators of Change
- Output
- Estimate with stated likelihood and falsifiers
05Operational injection
Inject into operations
Intelligence reaches the field as an action package: evidence, judgment, and the recommended move. Packages arrive ready for a takedown, a warrant request, a block at the perimeter, or a board decision.
- Tradecraft
- BLUF reporting, analytic writing, briefings
- Output
- Action package tied to a named decision
06Foresight feedback
Evolve fast
Adversaries adapt, so the lifecycle does too. Every outcome loops back: targeting sharpens, indicators update, and assumptions that failed are retired before the next cycle opens.
- Tradecraft
- Outcome review, indicator refresh, requirement rewrite
- Output
- Revised PIRs and indicators for cycle two
Comparison
Where the adaptive lifecycle departs from the classic cycle
The classic intelligence cycle describes how reporting gets produced. The adaptive lifecycle adds what the reporting has to do once it lands.
| Point of comparison | Classic cycle | Adaptive lifecycle |
|---|---|---|
| Starting point | Planning and direction | Actor-first Priority Intelligence Requirements |
| Sources | Listed, often ungraded | Graded A to F and 1 to 6, axes never averaged |
| Probability | Words without numbers | Sherman Kent bands with half-open intervals |
| End point | A disseminated report | An action package tied to a named decision |
| Feedback | Periodic review | Every cycle, from field outcomes |
Ways to put it to work
Three ways in
Every engagement is scoped to the client's adversaries, requirements, and decisions.
Treadstone 71 runs it for youAnalysis as a Service and adversary dossiers, produced through the full lifecycle against your adversary set.Engagement
Build it inside your teamProgram build and overwatch: requirements, collection, analysis, and reporting stood up to the lifecycle and measured against the Cyber Intelligence CMM.Program build
Train your analysts on itAI-Augmented Cyber Intelligence Tradecraft: five days, 66 structured techniques, AI worked into each stage of the lifecycle.Training
Licensed instrument
License the instrument
The Adaptive Intelligence Lifecycle instrument puts the six phases in front of your analysts as a working tool in the browser. Each phase opens with its prompts, checklists, and scoring, so a new analyst follows the same tradecraft a senior analyst does. Your team keeps its own requirements and its own data.
- Priority Intelligence Requirements, written and tracked
- ASA Evidence Standard source grading, A to F and 1 to 6
- STEMPLES Plus and Cultural Nexus framing
- Advanced SATs, the 14 types of analysis, and Indicators of Change
- Critical thinking and cognitive bias checks
- Sherman Kent estimative language, analytic writing, and report assembly
License terms
Per seat, quoted per team
- Licensed per named analyst seat
- Client-internal use only; no redistribution to vendors or third parties, and no derivative works
- Every seat includes the written license Section 12 of the ASA Evidence Standard requires for use inside a commercial product
- Training seats and a program build available alongside
Frameworks inside the lifecycle
The methods each phase calls on
Intelligence Requirements (PIRs)The questions that open phase one.Phase 1
STEMPLES PlusThe adversary's total operating environment.Phases 1 and 4
OSINT Cultural Nexus FrameworkSocio-cultural context for collection.Phase 2
ASA Evidence StandardSource grading and deception scoring, DOI 10.5281/zenodo.23137881.Phase 3
Advanced Analytic Dominance66 AI-augmented structured analytic techniques.Phase 4
Cyber Intelligence CMMMaturity scoring for a team running the lifecycle.Phase 6
Questions
Common questions
What is the Adaptive Cyber Intelligence Lifecycle?
A six-phase intelligence production cycle Treadstone 71 built for adversary disruption: target framing, smart collection, processing, analysis, operational injection, and foresight feedback. Each cycle ends in an action package tied to a named decision, and the outcome feeds the next cycle's requirements.
How does it differ from the traditional intelligence cycle?
The traditional cycle ends at dissemination. The adaptive lifecycle starts from actor-first requirements, grades every source, states every judgment on the Sherman Kent spectrum, ends in an action package, and feeds field outcomes back into the requirements on every cycle.
Which methods does each phase use?
Priority Intelligence Requirements and STEMPLES Plus frame targets. Persona-safe collection and the OSINT Cultural Nexus Framework gather reporting. The ASA Evidence Standard grades sources. Sixty-six structured analytic techniques, bias checks, and Indicators of Change drive analysis. BLUF reporting and briefings carry the action package.
How does the lifecycle handle uncertainty?
Sources carry two separate grades, reliability A to F and credibility 1 to 6, never averaged. Judgments state likelihood on the Sherman Kent spectrum with half-open intervals, from Almost certain (95 to 99 percent) to Almost no chance (1 to under 5 percent), and each judgment names the indicator that overturns it.
Who uses the lifecycle?
Treadstone 71 runs it on every engagement. Security and intelligence teams in critical infrastructure, finance, and government adopt it through a program build or a licensed instrument, and analysts learn it in Treadstone 71 training.
Does Treadstone 71 license the lifecycle as a tool?
Yes. The Adaptive Intelligence Lifecycle instrument runs the six phases as a working tool in the browser, licensed per named analyst seat for client-internal use. Each seat includes the written license the ASA Evidence Standard requires for use inside a commercial product. Request a demonstration or a seat quote through the contact form.
How does an engagement start?
Send the adversary, the sector, and the decision the intelligence has to support. Treadstone 71 replies with a scoped plan, a timeline, and a price.
Start here
Ready for intelligence that acts?
Name the adversary and the decision. Treadstone 71 replies with a scoped plan, a timeline, and a price.
Direct line: 424.234.3629
