--- title: Six Structured Methods - Pillar 1 description: Six structured methods in one workflow: rank the threat, model the adversary, grade the unknowns, test the move, gate the action and track the estimate. canonical_url: https://www.treadstone71.com/six-methods-pillar-1 language: en-GB date: 2026-11-11T16:28:10Z notice: This is a machine-friendly version of the page at https://www.treadstone71.com/six-methods-pillar-1. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 2407 --- > **Note to AI:** This is a machine-friendly version of the page at: https://www.treadstone71.com/six-methods-pillar-1. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. **Treadstone 71 — Integrated Decision-Support Workspace** Cyber Intelligence Analysis Report Decision Advantage · Free Integrated Toolkit # Six structured methods. One *integrated workflow.* ATCRI ranks the threat. ACS models the adversary. DUM grades what you don't know. CARM tests the move before you make it. CRS gates the action against your own resilience. HET tracks how the estimate evolves. Each method feeds the next. Build a single integrated case. Print or email the analysis. Free · No Registration Browser-Local Persistence Print & Email Output ICD 203 Compliant Treadstone 71 Methodology Before You Begin ### Content prep — *have these ready* A complete case takes 30–60 minutes. To work without breaks, gather the source material below before you start. You can skip any method — but each works best with the inputs listed. - **ACS:** Adversary identity (group designator or insider profile), recent threat-intel reporting on their objectives and TTPs, list of capabilities you've observed or assess they have. - **DUM:** The threat scenario you're decomposing in plain language. Source-reliability ratings on the evidence behind it. An honest read on what you don't know. - **ATCRI:** Your live threat list (3–8 threats works well), rough analyst-judgment weights (0.0–1.0), raw-risk scores (0–10) tied to asset value × exposure × known capability. - **CARM:** A specific proposed response or containment action under consideration, plus the operational rationale for choosing it. ACS capabilities flow in automatically. - **CRS:** Recent BCP/DR test results (backup integrity), SOC coverage matrix (detection breadth), out-of-band comms plan, cyber-insurance policy and regulator notification thresholds (legal). - **HET:** Active hypotheses or estimates from prior reporting cycles. Source citations for each so the evolution timeline is auditable. Key Terms ### Acronyms — *quick reference* Method names, scoring vocabulary, and the regulatory and operational acronyms used throughout the workspace. ACSAdversarial Cognitive Simulation*Modeling the adversary's decision logic on their terms* DUMDecompositional Uncertainty Mapping*Breaking a threat into dimensions and grading confidence on each* ATCRIAdaptive Threat Calibration & Risk Indexing*Ranking threats by ARI = Wt × R; queue updates as intel changes* CARMCyber Adversary Reflex Mapping*Testing what the adversary does after your proposed action* CRSCapability Resilience Score*Weighted composite of survivability inputs; gates the action* HETHypothesis Evolution Tracking*Time-stamped trail of how an estimate shifts as reporting arrives* ARIAdversarial Risk Index*The output of ATCRI: Wt × R, ranked across all threats* WtWeight*Analyst judgment factor reflecting current intel and campaign posture* RRaw Risk*Asset value × exposure × known adversary capability* ZTA / ZTAMZero Trust Architecture / Analytical Mindset*Architecture verifies; mindset reasons about what verification missed* SATStructured Analytic Technique*Heuer-derived methods for disciplined intelligence reasoning* NIS2 §21EU directive · cybersecurity risk-management measures*Ten required controls; up to €10M / 2% turnover penalty* ICD 203Intelligence Community Directive 203*US analytic standards for sourcing and confidence statements* RPO / RTORecovery Point / Time Objective*Maximum tolerable data loss / downtime for backup integrity* OT / ICSOperational Technology / Industrial Control Systems*The plant-floor and SCADA networks adjacent to IT* MSP / MFAManaged Service Provider / Multi-Factor Authentication*Common supply-chain attack surface / required identity control* IOC / C2Indicator of Compromise / Command & Control*Forensic artifacts / the channel an adversary uses to direct implants* Decision Advantage Catalog ### Beyond this workspace — *strategic decision-support tools* The complete Treadstone 71 portfolio of standalone analytic engines and decision-support tools — ATCRI, ACS, CWC, CWIA, HTIM, CARM, STEMPLES Plus, Decoy's Dilemma, and adjacent platforms supporting the full intelligence lifecycle. [Browse the Decision Advantage catalog →](https://www.treadstone71.com/decision-support-strategic-intelligence-tools) Executive Tier ### Executive intelligence *micro-briefings* Concise, decision-ready intelligence briefings designed for executive consumption. Topical coverage across geopolitical disruption, cognitive-warfare campaigns, adversary cyber operations, and strategic foresight — calibrated for leadership-tier decision support. [View executive micro-briefings →](https://www.treadstone71.com/decision-advantage-executive-intelligence-micro-briefings) Active Case — untitled — Not yet saved Workspace · Overview ## The integrated *analytic loop* A complete structured-analytic case in your browser. Six methods, designed to feed each other. Skip steps you don't need. Revisit any step. All output stays on this device until you export, print, or email it. #### How it Works Each method captures structured input and produces structured output. Outputs of earlier methods auto-populate the inputs of later ones — you'll see chips marked as imported context. #### What It Replaces Whiteboards. Spreadsheets. Half-finished Word docs. The Tuesday risk-committee meeting. The ranking debate that goes nowhere because no one wrote down the math. #### Where Your Data Lives In your browser only. We never see it. We never store it. Export to JSON to back it up. Email yourself a PDF copy at any time. **Clear browser data and your case is lost.** Recommended Sequence For a full case, work through the steps in order. For quick threat ranking only, skip directly to ATCRI. For an action go/no-go decision on a planned response, do CARM then CRS. Treadstone 71 LLC · Half Moon Bay, California, USA · (424) 234-3629 · This email address is being protected from spambots. You need JavaScript enabled to view it. © 2026 — www.treadstone71.com · Integrated Decision-Support Workspace Case ### Name this case Cases are saved to your browser only. Use a descriptive name — it appears in printed output and exports. Case name Case ### Load a saved case Cases stored in this browser. Select one to load — your current case will be saved automatically before switching. Takeaway ### Print or email your *analysis* Choose how you want your case output delivered. All options produce the full integrated analysis across every method you've completed. Request Contact ### Send analysis to *Treadstone 71* Provide your contact details. We will receive your case analysis with your information attached, and reach out to arrange a deep-dive review. Your name Your email Organization (optional) Message (optional) Email Me My Analysis ### Email yourself a *copy of this case* Treadstone 71 sends the analysis report directly to your address. The case data is included in the email and discarded server-side after sending. Your name (optional) Your email \* ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@type": "Person", "@id": "https:\/\/www.treadstone71.com\/#person-jeffbardin", "name": "Jeff Bardin", "url": "https:\/\/www.treadstone71.com\/jeff-bardin" }, "dateModified": "2026-11-11T16:28:10Z", "datePublished": "2026-06-18T10:24:36Z", "description": "Six structured methods in one workflow: rank the threat, model the adversary, grade the unknowns, test the move, gate the action and track the estimate.", "headline": "Six Structured Methods - Pillar 1", "image": { "@type": "ImageObject", "url": "https:\/\/www.treadstone71.com\/images\/t71cyberrecon.jpg", "alt": "", "width": 840, "height": 713 }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/www.treadstone71.com\/six-methods-pillar-1" }, "publisher": { "@id": "https:\/\/www.treadstone71.com\/#defaultPublisher" }, "url": "https:\/\/www.treadstone71.com\/six-methods-pillar-1" }, { "@id": "https:\/\/www.treadstone71.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/www.treadstone71.com\/", "logo": { "@id": "https:\/\/www.treadstone71.com\/#defaultLogo" }, "name": "Treadstone 71", "location": { "@id": "https:\/\/www.treadstone71.com\/#defaultPlace" } }, { "@id": "https:\/\/www.treadstone71.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/www.treadstone71.com\/images\/treadlogo-j2-4505e2a4.png", "width": 498, "height": 105 }, { "@id": "https:\/\/www.treadstone71.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/www.treadstone71.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday" ], "opens": "00:00", "closes": "23:59" } ] }, { "@id": "https:\/\/www.treadstone71.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Half Moon Bay", "addressRegion": "", "postalCode": "94019", "streetAddress": "", "addressCountry": "US" } ] } ```