Treadstone 71 / Founder's briefs
What is cyber intelligence tradecraft?
Cyber intelligence tradecraft is the disciplined method of turning collected data about adversaries into judgments a leader acts on. Treadstone 71 LLC has practiced and taught the method since 2002: requirements first, graded evidence, structured analysis, estimative language, and a finished product built to change a decision. The firm's courses appear in the federal NICCS training catalog.
Most shops I walk into own a feed, and few of them own a question.
A feed reports that an address went bad on Tuesday. Nobody upstairs asked about the address. The board asked whether the crew that probed the water utility comes back, and what the company does when the crew returns. Indicators answer neither question. Tradecraft answers the first and frames the second.
Where programs go wrong
The pattern repeats. A company buys a platform, hires two analysts, and points them at the vendor dashboard. Six months later the analysts forward other people's reports with a cover note, and leadership stops reading. Budget season arrives and nobody in the room is able to name one decision the team changed. Not one.
I learned the cure in uniform, as an Air Force linguist working Arabic and Russian, and later leading armored scouts for the Army. Collection without a written requirement is a hobby.
The method, in the order we run it
- Requirement: A stakeholder names the decision. We write the intelligence requirement against the decision, with a due date.
- Collection: Open sources, technical telemetry, online human sources, and commercial data, planned against the requirement and nothing else.
- Grading: Every item receives a source reliability letter, A through F, and an information credibility number, 1 through 6, under the ASA Evidence Standard. The two axes are never averaged.
- Analysis: Structured techniques picked for the problem. Hypotheses get tested against evidence. Assumptions get checked. Deception gets a hearing.
- Estimate: A judgment on the Kent scale. Highly likely means 85 to under 95 percent, for every reader, every time.
- Product: One page a tired executive reads in four minutes and acts on.
If it does not change a decision, it is not intelligence. If it does not arrive in time to change a decision, it is not useful intelligence.
What separates an analyst from a feed reader
Four habits, and none of them needs a tool.
An analyst writes the requirement down before opening a browser. She grades a source before she believes the source. Likelihood goes out in numbers, and she defends the band when a vice president pushes. Then she rewrites the first paragraph until a reader who stops after forty words still walks away with the judgment, the confidence behind the judgment, and the action the judgment supports. Tools help at the margins. Generative AI drafts collection plans and summarizes foreign-language sources faster than any junior analyst. The model also invents citations. We teach analysts to run the machine and to check the machine.
How Treadstone 71 teaches the method
The Certified Cyber Intelligence Analyst program runs in person, and on demand at the Cyber Intelligence Training Center. Students build the real products: a requirement set, a collection plan, a graded source list, and a finished estimate. The full training catalog lists dates and formats.
Teams that need more than a course start with a maturity assessment and a program build. The desk reference is Tradecraft at Machine Speed, listed with my other books on my Amazon author page.
Treadstone 71 has run the same method on every engagement since 2002. CISA carries the courses in its NICCS catalog.
Questions buyers ask
Is cyber intelligence the same as a threat intelligence feed?
No. A feed delivers indicators such as addresses, hashes, and domains. Cyber intelligence answers a stakeholder's question with a graded, sourced judgment and a stated likelihood. Feeds are one input to collection.
Who takes Treadstone 71 cyber intelligence training?
Analysts, investigators, intelligence leaders, and SOC and incident response leadership from government agencies, defense organizations, Fortune 500 firms, and universities.
Is the training available online?
Yes. The Cyber Intelligence Training Center at cyberinteltrainingcenter.com delivers self-paced, on-demand certification programs with optional mentor support.
