← Cyber Intelligence Foundations
Module 1: Start With the Decision
From Security Data to Intelligence Write an Intelligence Requirement
Module 2: Build an Evidence Base
Collect Evidence With a Plan Evaluate Sources and Claims
Module 3: Analyze, Report, and Improve
Describe Adversary Behavior Without Overclaiming Indicators of Compromise and Their Types Use Indicators With Context Write and Review a Decision-Ready Assessment
Module 4: Turn Intelligence Into Better Defense
Build a Bounded Defensive Hunt Keep Intelligence Useful Over Time
Module 5: Apply Intelligence to Common Security Problems
Build Vulnerability Intelligence That Prioritizes Action Analyze Identity and Social-Engineering Threats Analyze Malware and Ransomware Activity
Module 6: Operate Intelligence as a Capability
Work With Stakeholders and Decision-Makers Govern Intelligence and Handle Information Responsibly Share Structured Intelligence and Automate Safely
Module 2: Build an Evidence Base

Evaluate Sources and Claims

Separate source reliability from claim credibility and expose gaps before they become confident errors.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.

In this lesson, you will learn to:

  • Assess source reliability, claim credibility, corroboration, recency, and collection gaps for a security claim.

Evaluate Sources and Claims

This lesson gives you a repeatable way to judge evidence. You will assess the source, the specific claim, corroboration, timing, and missing context instead of treating a reputable publisher as automatically correct.

Judge the Source and the Claim Separately

Source reliability and information credibility are related but different. A historically reliable organization can publish a weak or outdated claim. An unfamiliar source can publish a useful observation that later receives corroboration. Evaluate both parts explicitly.

Ask what the source is positioned to know, how transparent it is about method, and whether it has a reason to exaggerate. Then examine the claim itself: Is it specific? Is the time period clear? Does the evidence support the wording? Is the claim copied from another report? Does an independent source confirm the same fact, or do several pages merely repeat one original statement?

Use calibrated language. “The source reports” describes provenance. “We observed” should be reserved for evidence you actually examined. “We assess” introduces an analytic judgment. “We cannot determine” is a useful result when the available evidence cannot answer the question. These distinctions let readers update their view when new evidence arrives.

Two lenses for evaluating a claimTwo large lenses compare source reliability and information credibility before they join in an assessment. SOURCE EVALUATIONReputation is not a substitute for evidence SOURCEposition to knowmethod + transparencyCLAIMspecific + timelysupported + corroboratedCALIBRATED ASSESSMENT
Two lenses for evaluating a claim — Separate the source lens from the claim lens so reputation does not substitute for evidence.

Make Gaps and Contradictions Visible

Evidence is rarely complete. A responsible analyst records what is missing, what conflicts, and how those gaps affect confidence. If proxy logs cover only four hours, you cannot confidently say a domain was never contacted during the previous week. If two credible sources disagree about the first-seen date, preserve both claims and explain the difference instead of selecting the convenient date.

Use a simple evidence table with columns for claim, supporting source, contradictory source, freshness, confidence, and collection gap. Do not let a long list of references create false certainty. Five articles that copy one report are still one evidentiary origin. Independent corroboration is stronger when the sources use different collection methods or have separate access to the underlying event.

Before publishing an assessment, ask a colleague to challenge the strongest conclusion. What would change your mind? Which observation is doing the most work? What alternative explanation fits the same facts? This is not an exercise in indecision. It is how you avoid presenting an attractive story as a proven fact.

Evidence register with confidence and gapsA light table shows claims alongside support, contradiction, freshness, confidence, and collection gaps. EVIDENCE REGISTERKeep uncertainty beside the claim CLAIMSUPPORTCONFLICTFRESHNESSCONFIDENCEGAPdomain linked to campaignadvisory + DNSfirst-seen differscurrentmoderatelocal logsNorthstar exposureno sightingsnone found30-day windowlowretentionA visible gap is more useful than hidden uncertainty.
Evidence register with confidence and gaps — A compact register keeps supporting evidence, contradictions, freshness, confidence, and collection gaps visible beside each claim.
← Previous: Collect Evidence With a Plan Next: Describe Adversary Behavior Without Overclaiming →