← Cyber Intelligence Foundations
Module 1: Start With the Decision
From Security Data to Intelligence Write an Intelligence Requirement
Module 2: Build an Evidence Base
Collect Evidence With a Plan Evaluate Sources and Claims
Module 3: Analyze, Report, and Improve
Describe Adversary Behavior Without Overclaiming Indicators of Compromise and Their Types Use Indicators With Context Write and Review a Decision-Ready Assessment
Module 4: Turn Intelligence Into Better Defense
Build a Bounded Defensive Hunt Keep Intelligence Useful Over Time
Module 5: Apply Intelligence to Common Security Problems
Build Vulnerability Intelligence That Prioritizes Action Analyze Identity and Social-Engineering Threats Analyze Malware and Ransomware Activity
Module 6: Operate Intelligence as a Capability
Work With Stakeholders and Decision-Makers Govern Intelligence and Handle Information Responsibly Share Structured Intelligence and Automate Safely
Module 3: Analyze, Report, and Improve

Write and Review a Decision-Ready Assessment

Assemble evidence into a concise report that states the judgment, confidence, implications, and next actions.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.

In this lesson, you will learn to:

  • Write a concise intelligence assessment with key judgment, evidence, confidence, implications, recommendations, and review notes.

Write and Review a Decision-Ready Assessment

This final lesson brings the workflow together. You will use a compact assessment structure, communicate uncertainty without losing clarity, and review the product for accuracy, usefulness, and responsible handling before delivery.

Use a Structure That Readers Can Scan

A decision-ready assessment should let a busy reader find the answer quickly and inspect the reasoning when needed. Start with a key judgment: one or two sentences that answer the requirement and include calibrated confidence. Follow with the most important evidence, not every source you collected. Then state implications for the organization, recommended actions, collection gaps, and the time or conditions that would change the assessment.

A useful structure is: Question, Key judgment, Evidence, Confidence and alternatives, Implications, Actions, and Sources. Keep each section focused. Use bullets for discrete observations and short paragraphs for reasoning. Define specialized terms once. Put the date and scope near the top so a reader knows how long the assessment should remain useful.

Clear writing is not a cosmetic step. If the report hides its judgment under background, a decision-maker may miss the action. If it hides uncertainty under confident language, a decision-maker may take an irreversible step on weak evidence. Scannability and honesty reinforce each other.

Anatomy of a decision-ready assessmentA stacked report layout highlights key judgment, evidence, confidence, implications, actions, and sources. REPORT DESIGNPut the decision-useful answer first KEY JUDGMENT + CONFIDENCEEVIDENCEALTERNATIVES + GAPSIMPLICATIONSACTIONSSOURCES + DATE + SCOPE
Anatomy of a decision-ready assessment — A report structure places the judgment first, then evidence, confidence, implications, actions, and sources for fast but responsible reading.

Review, Deliver, and Learn From Feedback

Before delivery, review the report in three passes. First check factual integrity: do the quoted sources support the claim, are dates and versions correct, and are observations separated from judgments? Second check analytic integrity: did you consider an alternative explanation, state confidence, expose gaps, and avoid claiming more than the evidence supports? Third check operational usefulness: can the intended consumer understand the action, owner, urgency, and expected result?

Deliver through an appropriate channel and mark handling requirements. A public advisory, an internal SOC note, and an executive brief should not contain the same level of sensitive detail. Keep source links and working notes where authorized, but do not expose personal data or confidential collection methods unnecessarily.

The course capstone is to write a one-page Northstar assessment about the fictional login-spray scenario. Include a key judgment, three evidence points, one alternative explanation, a confidence statement, two actions with owners, one collection gap, and a review date. After delivery, ask the consumer whether the product changed a decision. That feedback is part of the intelligence lifecycle, not an optional survey.

Three-pass review and feedback loopA circular workflow checks facts, analysis, and usefulness before delivery, then sends feedback into the next requirement. QUALITY REVIEWImprove the product through feedback DELIVERdecision-readyassessmentFACTSANALYSISUSEFULNESSFEEDBACKNEXT REQUIREMENT
Three-pass review and feedback loop — A review loop checks factual integrity, analytic integrity, and operational usefulness before delivery, then returns consumer feedback to the next requirement.

Resources

  • MITRE ATT&CK Navigator — Optionally map the fictional scenario’s observed behaviors to a defensive technique vocabulary during the capstone review.
← Previous: Use Indicators With Context Next: Build a Bounded Defensive Hunt →