How to Use Analysis of Competing Hypotheses in Cyber Threat Intelligence
Use ACH when several explanations fit the same evidence, compare them consistently, and show decision-makers what could change the leading judgment.
Attribution, intrusion purpose, and campaign linkage rarely have one obvious explanation. Analysis of Competing Hypotheses (ACH) helps when analysts could explain the same evidence in several ways. Its value is not a numeric winner. It forces the team to seek contradictions, expose assumptions, and preserve credible alternatives.
Use ACH when the answer could materially change containment, diplomatic language, resource allocation, or executive posture. First write the decision and deadline; otherwise the exercise expands without producing a useful answer.
Build Explanations That Could Be Wrong
Write mutually distinct, testable hypotheses. For suspicious access, they might be: financially motivated intrusion, state-directed collection, authorized administrative activity, or unrelated incidents incorrectly grouped together. Avoid actor names unless identity itself is the question.
Ask a colleague what explanation is missing. Include an ordinary alternative when plausible. If two hypotheses would predict all the same observations, rewrite them because the decision cannot distinguish between them.
Test Consistency, Quality, and Dependence
Put evidence in rows and hypotheses in columns. Mark each item consistent, inconsistent, neutral, or not applicable. Then add source reliability, relevance, freshness, and whether several reports derive from the same original source.
Focus on reliable contradictions. Ten weak consistencies should not outweigh one strong fact that a hypothesis cannot explain. Treat a vendor label repeated by five articles as one lineage, not five independent confirmations.
Try to Break the Leading View
Remove the most influential evidence and see whether the ranking changes. Reverse a key assumption. Ask what each hypothesis predicts you should observe next, then collect only evidence likely to discriminate among them. Stop when additional research is unlikely to change the decision.
Document deception possibilities and collection blind spots. A missing artifact matters only if the sensors, retention, and search were capable of finding it.
Report the Decision-Relevant Result
State the leading hypothesis, likelihood and confidence, the strongest contradictory evidence against alternatives, and the most credible remaining alternative. Name what would change the view and who should watch for it. Do not disguise disagreement by averaging analyst opinions.
ACH reduces confirmation bias but does not remove judgment. Pair it with explicit evidence standards and the caveats described in the CTI reporting guide. The defensible outcome is a traceable argument, not a colorful matrix.
Frequently asked questions
When should a CTI analyst use ACH?
Use it for consequential questions where several plausible explanations fit incomplete or deceptive evidence. It is unnecessary for a simple factual lookup.
How many hypotheses should an ACH include?
Include the smallest set that covers genuinely different explanations, often three to five. Split compound hypotheses and add a reasonable non-malicious explanation.
Does the hypothesis with the best score become the truth?
No. The matrix organizes reasoning; it does not calculate truth. Analysts must review evidence quality, dependencies, gaps, and sensitivity.
How should missing evidence be treated?
Missing expected evidence can be diagnostic only when collection should reasonably have found it. Absence without collection coverage is unknown, not contradictory.
Should the whole ACH matrix go in the report?
Usually keep the matrix as working material and communicate the leading judgment, credible alternatives, confidence, decisive evidence, and change indicators.
