Framework · Six phases · Built for disruption
Adaptive Cyber Intelligence Lifecycle
Built for disruption. Driven by foresight.
Most intelligence cycles end in a report. The Adaptive Cyber Intelligence Lifecycle ends in an action. Six phases carry a team from the first intelligence requirement to a disruption package a decision-maker signs. Then the result feeds the next cycle. Treadstone 71 runs the lifecycle on every engagement and teaches it in its training.
What is the Adaptive Cyber Intelligence Lifecycle?
The Adaptive Cyber Intelligence Lifecycle is the six-phase intelligence production cycle Treadstone 71 built for adversary disruption. The cycle runs from target framing through collection, processing, analysis, and operational injection to a foresight loop that feeds the next cycle. Priority Intelligence Requirements anchor the first phase. Every source carries an ASA Evidence Standard grade. Analysis draws on 66 structured analytic techniques, STEMPLES Plus, and the Cultural Nexus Framework, and every judgment states its likelihood on the Sherman Kent spectrum with half-open intervals. Each cycle ends in an action package tied to a named decision.
- Type
- Intelligence production lifecycle
- Phases
- Six, in a closed loop
- Anchor
- Priority Intelligence Requirements
- Source grading
- ASA Evidence Standard, A to F and 1 to 6
- Analysis
- 66 SATs, STEMPLES Plus, Cultural Nexus
- Probability
- Sherman Kent spectrum, half-open intervals
- Output
- An action package tied to a decision
- Available as
- Engagement, program build, training, licensed instrument
Why it works
The Treadstone 71 edge
Six design rules run through every phase.
Tap or click a square to flip it
Why it works
Actor-first
Actor-first
Track the people
Requirements grow out of adversary behavior. Track the people behind the infrastructure, their intent, and their incentives.
Why it works
Live-loop design
Live-loop design
Learn while the cycle runs
Feedback and foresight sit in the early phases as well as the last, so the model learns while the cycle runs.
Why it works
Mission-tied
Mission-tied
Every product points to an action
Arrest, disrupt, dismantle. Each phase works toward an outcome a decision-maker signs.
Why it works
AI-wrapped tradecraft
AI-wrapped tradecraft
Speed with the analyst in charge
Bias filters, pattern engines, and speed. AI works as a de-biasing agent and a synthesis engine, and the analyst holds the judgment.
Why it works
Persona-safe
Persona-safe
Collection that stays clean
Collection runs compartmented and adversary-aware, through vetted personas that prevent contamination and support simulation.
Why it works
Analytic rigor
Analytic rigor
Judgments tied to evidence
Assumptions get challenged, bias gets checked, and structured techniques keep every judgment tied to the evidence.
The lifecycle as a flow
Six phases, one loop
Each orange square flips to the phase's working steps. The branches beside it name the methods, standards, references, tools, and outputs the phase runs on. Phase six returns updated requirements to phase one.
Strategic target framing
Frame the right targets
Set the focus before a single source is touched.
Phase 01 · Strategic target framing
Sets the focus. The team aligns with organizational priorities and names the actors and issues of greatest concern.
- Define the mission: leadership's objectives and the business context to protect.
- Derive PIRs: the questions stakeholders need answered, written with them.
- Profile adversaries: build the profile library and rank threats Tier 1 to Tier 3.
- Formulate hypotheses: early, testable guesses that steer collection and analysis.
Phase 01 runs on
- MethodPriority Intelligence RequirementsWritten with, and owned by, the decision-makers who use them
- MethodSTEMPLES PlusThe adversary's total operating environment
- MethodAdversary tieringTier 1 to Tier 3 ranking of threat actors
- ToolACS adversary simulatorAI-assisted red-teaming of the adversary's next moves
- ReferenceJP 2-0, Joint IntelligenceDoctrinal source of the PIR construct
- OutputPIRs, profile library, hypothesis setHands phase two its tasking
Smart collection orchestration
Collect smarter
Gather what the requirements ask for, and nothing that exposes you.
Phase 02 · Smart collection orchestration
Starts active gathering under a coordinated, adaptive collection plan. Automation and diverse sources capture the relevant and filter the noise.
- Execute the plan: map each requirement to collection tasks and to internal and external sources.
- Automate and triage: a threat intelligence platform and AI agents handle retrieval and first-line filtering.
- Maintain OPSEC: anonymization and vetted personas keep the organization out of view.
Phase 02 runs on
- MethodCollection plan matrixRequirement to task to source, with gaps marked
- ToolTIP selection and rolloutPlatform chosen against the requirements
- MethodOSINT Cultural Nexus FrameworkSocio-cultural context and native-language sources first
- MethodPersona OPSECCompartmented, vetted personas
- OutputTasked plan and triaged raw reportingHands phase three its inputs
Analytical processing and exploitation
Make threats visible
Turn noise into graded, structured threat objects.
Phase 03 · Analytical processing and exploitation
Turns raw inputs into structured intelligence assets through processing, enrichment, and a first evaluation.
- Normalize and enrich: a raw IP gains geolocation and malicious-infrastructure context.
- Exploit: link analysis surfaces relationships, patterns, and anomalies.
- Evaluate credibility: every item gets a reliability grade and a credibility grade.
Phase 03 runs on
- StandardASA Evidence StandardReliability A to F, credibility 1 to 6, never averaged
- StandardNATO STANAG 2511 Admiralty gradingThe anchor scale the ASA Evidence Standard builds on
- StandardSTIX 2.1 (OASIS)Structured format for threat objects
- StandardMITRE ATT&CKBehavior tags on every object
- MethodLink analysisRelationships across technical, financial, and social data
- OutputGraded, enriched threat objectsHands phase four its evidence
Advanced analysis and insight development
Analyze with an edge
Test every hypothesis, then say how likely, with a number.
Phase 04 · Advanced analysis and insight development
The cognitive core. Tradecraft interprets the data, tests hypotheses, and forecasts what happens next.
- Apply SATs: decompose the problem and check bias at each step.
- Master uncertainty: Analysis of Competing Hypotheses works to disprove alternatives.
- Challenge assumptions: red-team thinking and devil's advocacy against groupthink.
- Forecast: alternative futures and what-if analysis for the road ahead.
Phase 04 runs on
- Method66 structured analytic techniquesAdvanced Analytic Dominance, AI-augmented
- ReferenceAnalysis of Competing HypothesesRichards Heuer, Psychology of Intelligence Analysis, CIA, 1999
- ReferenceWords of Estimative ProbabilitySherman Kent, 1964; the root of the house bands
- ToolCognitive Bias ValidatorBias audit on a draft assessment
- MethodIndicators of ChangeThe signals that move or overturn a judgment
- OutputEstimate with a Kent band and falsifiersHands phase five its judgment
Intelligence production and dissemination
Inject into operations
Put the judgment where the action happens.
Phase 05 · Intelligence production and dissemination
Converts analysis into action and puts it in front of the people who act on it.
- Tailor products: from executive briefings to indicator feeds for the SOC.
- Lead with BLUF: the judgment in the first sentence.
- Integrate with workflows: indicators of compromise flow straight into SIEM and SOAR.
Phase 05 runs on
- MethodAnalytic writing and BLUFJudgment first, every product
- MethodExecutive micro-briefingsShort-form products for leadership
- StandardTraffic Light Protocol 2.0 (FIRST)Handling marks on every release
- StandardSTIX and TAXII feedsMachine-readable indicators for tools
- OutputAction package, executive brief, indicator feedEach tied to a named decision
Continuous feedback and adaptation
Evolve fast
Learn from every cycle, then point the next one better.
Phase 06 · Continuous feedback and adaptation
Closes the loop so the program improves with every cycle.
- Ask the stakeholders: was the product useful, how did you use it, what should change?
- Run after-action reviews: find the gaps and correct analytic errors.
- Update the PIRs: adjust the target framing, then return to phase one.
Phase 06 runs on
- MethodStakeholder feedbackThree questions after every product
- ReferenceAfter-action reviewUS Army TC 25-20, A Leader's Guide to After-Action Reviews
- ToolCyber Intelligence CMMMaturity scored cycle over cycle
- ToolIntelligence Readiness ScoringFree readiness score across five dimensions
- OutputRevised PIRs and indicatorsReturn to phase one
Loop: phase six hands revised PIRs and indicators back to phase one, and the next cycle opens sharper than the last.
Comparison
Where the adaptive lifecycle departs from the classic cycle
Transnational threats run from state-sponsored operators to organized cybercrime syndicates, and none of them wait for a static process. A function that only reports on past events adds little. One that delivers predictive insight into adversary capability, intent, and next moves becomes a partner in strategic planning, risk management, and operations. The classic cycle describes how reporting gets produced; the adaptive lifecycle adds what the reporting has to do once it lands.
| Point of comparison | Classic cycle | Adaptive lifecycle |
|---|---|---|
| Starting point | Planning and direction | Actor-first Priority Intelligence Requirements |
| Sources | Listed, often ungraded | Graded A to F and 1 to 6, axes never averaged |
| Probability | Words without numbers | Sherman Kent bands with half-open intervals |
| End point | A disseminated report | An action package tied to a named decision |
| Feedback | Periodic review | Every cycle, from field outcomes |
Ways to put it to work
Three ways in
Every engagement is scoped to the client's adversaries, requirements, and decisions.
Licensed instrument
License the instrument
The Adaptive Intelligence Lifecycle instrument puts the six phases in front of your analysts as a working tool in the browser. Each phase opens with its prompts, checklists, and scoring, so a new analyst follows the same tradecraft a senior analyst does. Your team keeps its own requirements and its own data.
- Priority Intelligence Requirements, written and tracked
- ASA Evidence Standard source grading, A to F and 1 to 6
- STEMPLES Plus and Cultural Nexus framing
- Advanced SATs, the 14 types of analysis, and Indicators of Change
- Critical thinking and cognitive bias checks
- Sherman Kent estimative language, analytic writing, and report assembly
License terms
Per seat, quoted per team
- Licensed per named analyst seat
- Client-internal use only; no redistribution to vendors or third parties, and no derivative works
- Every seat includes the written license Section 12 of the ASA Evidence Standard requires for use inside a commercial product
- Training seats and a program build available alongside
Frameworks inside the lifecycle
The methods each phase calls on
Questions
Common questions
What is the Adaptive Cyber Intelligence Lifecycle?
A six-phase intelligence production cycle Treadstone 71 built for adversary disruption: target framing, smart collection, processing, analysis, operational injection, and foresight feedback. Each cycle ends in an action package tied to a named decision, and the outcome feeds the next cycle's requirements.
How does it differ from the traditional intelligence cycle?
The traditional cycle ends at dissemination. The adaptive lifecycle starts from actor-first requirements, grades every source, states every judgment on the Sherman Kent spectrum, ends in an action package, and feeds field outcomes back into the requirements on every cycle.
Which methods does each phase use?
Priority Intelligence Requirements and STEMPLES Plus frame targets. Persona-safe collection and the OSINT Cultural Nexus Framework gather reporting. The ASA Evidence Standard grades sources. Sixty-six structured analytic techniques, bias checks, and Indicators of Change drive analysis. BLUF reporting and briefings carry the action package.
How does the lifecycle handle uncertainty?
Sources carry two separate grades, reliability A to F and credibility 1 to 6, never averaged. Judgments state likelihood on the Sherman Kent spectrum with half-open intervals, from Almost certain (95 to 99 percent) to Almost no chance (1 to under 5 percent), and each judgment names the indicator that overturns it.
Who uses the lifecycle?
Treadstone 71 runs it on every engagement. Security and intelligence teams in critical infrastructure, finance, and government adopt it through a program build or a licensed instrument, and analysts learn it in Treadstone 71 training.
Does Treadstone 71 license the lifecycle as a tool?
Yes. The Adaptive Intelligence Lifecycle instrument runs the six phases as a working tool in the browser, licensed per named analyst seat for client-internal use. Each seat includes the written license the ASA Evidence Standard requires for use inside a commercial product. Request a demonstration or a seat quote through the contact form.
How does an engagement start?
Send the adversary, the sector, and the decision the intelligence has to support. Treadstone 71 replies with a scoped plan, a timeline, and a price.
Start here
Ready for intelligence that acts?
Name the adversary and the decision. Treadstone 71 replies with a scoped plan, a timeline, and a price.
Direct line: 424.234.3629
