The intelligence cycle

Start with a decision, not a feed

The intelligence cycle organizes work that turns collected information into an assessment useful to a decision maker. Common stages include direction, collection, processing, analysis, dissemination, and feedback. These stages describe related activities rather than an inflexible assembly line; new findings often send an analyst back to refine the original question.

The starting requirement matters. “Tell us about cyber threats” is too broad to guide efficient collection. “Which account-abuse behaviors should our small cloud operations team prioritize this quarter?” identifies an audience, a context, and a decision that intelligence can inform.

Follow a practical requirement

A fictional academy plans to strengthen protection for staff accounts. Its security lead asks whether current controls address the relevant phishing and account-takeover behaviors. The intelligence analyst identifies useful sources: provider guidance, credible campaign reporting, internal incidents, and the organization's actual authentication and recovery configuration.

Collection gathers material within authorized boundaries. Processing makes it usable by organizing dates, extracting relevant behaviors, resolving duplicate reports, and preserving provenance. Ten articles repeating the same original report are not ten independent confirmations.

Analysis connects the information to the requirement. An account campaign affecting an unrelated technology may be less relevant than a broadly observed technique that the academy's current recovery process leaves exposed. The assessment should explain that reasoning rather than simply ranking headlines by how dramatic they sound.

Communicate confidence and alternatives

State which findings are observed, which are inferred, and which remain uncertain. Consider plausible competing explanations when evidence is incomplete. A report about one actor's behavior does not establish that every organization in the same industry faces the same immediate threat.

Dissemination packages the assessment for the audience. A technical team may need behaviors and evidence sources; leadership may need the decision, likely benefit, dependencies, and remaining uncertainty. Both versions should preserve the same underlying facts.

Feedback checks whether the assessment was useful. Did the team change a control, prioritize a detection, or identify a missing requirement? If nobody could act on it, the problem may be framing rather than a lack of more raw information.

Run a small cycle yourself

Choose one fictional requirement about privileged-account protection. Gather three primary or clearly attributable sources, record their dates, and explain what each can support. Write a short assessment with one recommended action, one limitation, and one unanswered question.

Ask a peer whether the recommendation follows from the evidence and fits the stated environment. Revise the requirement if needed. Evaluating information sources supports the collection and analysis work, while Threat intelligence explains the resulting decision-focused product.

Related concepts

• Open-source intelligence
• Incident reporting and handover