Treadstone 71 / Founder's briefs
How do you build a cyber intelligence program?
A cyber intelligence program starts with stakeholder requirements, then adds collection planning, evidence grading, structured analysis, and reporting tied to decisions. Treadstone 71 LLC builds such programs with its Cyber Intelligence Capability Maturity Model and Adaptive Cyber Intelligence Lifecycle, and fills staffing gaps through Fractional Intelligence Officer and Analysis as a Service engagements. The firm has done the work since 2002.
The purchase order comes first, and that is the mistake.
A company signs a six-figure platform contract, then goes looking for someone to run the thing. The platform arrives with the vendor's idea of what matters. Nobody asked the general counsel, the head of M&A, or the plant managers what keeps them awake. A year on, the team produces a weekly report nobody requested and nobody reads.
I worked as a chief information security officer, and I have sat on the buying side of that table.
Start with a score
The Cyber Intelligence Capability Maturity Model rates a program function by function, requirements to dissemination. Leadership reads the rating and learns where the money goes first. A free Intelligence Readiness Score gives a first read in minutes.
The build sequence
- Stakeholder interviews: Who decides what, and when. Legal, finance, operations, the board.
- Intelligence requirements: Written, prioritized, dated, and signed by the person who asked.
- Collection plan: Sources mapped to requirements. Gaps named. Tools bought last, against the gaps.
- Grading and analysis standards: The ASA Evidence Standard for sources. Structured techniques for judgments. Kent bands for likelihood.
- Product line: A small set of report types, each with an owner, a reader, and a clock.
- Feedback: Every product ends with a question to the reader: did the report change a decision?
The sequence follows the Adaptive Cyber Intelligence Lifecycle. Most builds run in phases across several months. Analysts train on the client's own requirements during the build, so the classroom work becomes the first production run.
When you lack the people
Small teams stall on staffing. Two options cover the gap. A Fractional Intelligence Officer gives the program a senior lead several days a month: someone to own requirements, review products, and brief the executives. Analysis as a Service adds finished assessments on demand while internal analysts come up to speed.
The test of a finished build
The consultant leaves and the work keeps running. Requirements get refreshed on a calendar. Products ship on time. Executives quote the reports in meetings where the intelligence team is absent. Client programs leave a Treadstone 71 engagement with requirements, workflows, and reporting that outlast us.
Full scope and deliverables are on the Program Build Service page.
Treadstone 71 has built intelligence programs since 2002.
Questions buyers ask
What is the first step in building a cyber intelligence program?
Interview stakeholders and write intelligence requirements. A requirement names the decision, the decision maker, and the date. Collection, tools, and hiring follow from the requirements.
What is a Fractional Intelligence Officer?
A Fractional Intelligence Officer is a senior Treadstone 71 intelligence lead engaged for a set number of days each month to own requirements, review analytic products, and brief executives while the client builds internal capability.
What is the Cyber Intelligence Capability Maturity Model?
A Treadstone 71 model that rates a cyber intelligence program across its functions, from requirements through dissemination, and sets priorities for investment.
