Using the Intelligence Cycle

Direction

The first stage of the cycle is to determine the intelligence requirements and plan the collection efforts – creating a clear focus and list of priorities for the intelligence team, and ensuring that all information gathered is geared towards a clear purpose.

You’ve probably read about our Intelligence Collection Plans, a practice that we go through with every new client as part of their onboarding process. This allows us to dig into your intelligence requirements.

We aim to understand:

• If there are any gaps in your current intelligence collection
• The geographical areas you operate in and any plans for future expansion
• Any properties or assets across the globe you’ll be monitoring
• Where your people and employees regularly travel
• If there are particular routes they take, accommodation that they stay in or places they visit
• Groups of interest, including activists, terrorists and extremists
• Historical threats to your business or the industry as a whole

Collection

Once we have the intelligence requirements, we can begin our collection process – exploiting our vast range of sources with both manual collection from our 24/7 operations centre, and automated collection through datamining.

Both our manual collection and our datamining development is guided by the information identified in your Intelligence Collection Plan to deliver relevant, timely and valuable data that’ll help you make better decisions.

Our source list, which is constantly growing, currently sits at around 12,500 active open-source channels. With new social media platforms and ways to communicate emerging all of the time, our analyst team are crucial for keeping on top of these trends and digging into areas our datamining can’t reach.

When it comes to selecting sources, we consider a number of factors, including:

• Capability – Can the source you choose complete the task?
• Suitability – On occasions more than one source may be able to answer your question. Appropriate consideration should be taken to choose the right source
• Multiplicity and balance – Where possible information should be sourced using multiple sources. This helps guard against deception and helps enhance the prospect of successful collection

• Timeliness – Sources selected must be able to carry out the task in the necessary timeframe

These considerations allow us to make sure the information collected is already as relevant and reliable as possible before it is processed into intelligence.

Processing

This phase of the intelligence cycle is key to turning information into intelligence and consists of the data being collated, evaluated, analysed and interpreted by our team of analysts.

Information picked up as part of the collection process goes through these stages to become actionable intelligence:

1. Collation: related items of information and/or intelligence are grouped together to provide a basic record of events
2. Evaluation: the credibility of the information and reliability of the source are evaluated using the expert judgement of the analyst – information cannot simply be taken at face value, so it’s important to indicate how much confidence can be placed in each item of information.
3. Analysis: collated and evaluated information is analysed – significant facts are identified, verified and accurately geo-located, and we can make deductions from comparing these together.
4. Integration: occurs simultaneously with the analysis process – as the information is analysed it is combined with other information, and a pattern of intelligence can be identified, such as a sequence of events, threat level or profile of a group.
5. Interpretation: this is the final step of processing. Once we have analysed and integrated the information, we can use our expertise to make actionable interpretations. How significant the information is, and how it relates to what is already known, is judged via a process of comparison and deduction based on common sense, knowledge and experience.

The end result of this is that, regardless of if the incident was identified by our team, or picked up by our datamining technology, each new piece of information is:

• Accurately geo-located
• Graded based on the reliability and credibility of the source
• Reviewed and verified to eliminate false information
• Analysed to determine patterns, trends of connections
• Structured in a way that’s easy to interpret and act upon

This ensures accurate data that’s not only insightful but practical, too.

Dissemination

The final stage of the intelligence cycle is the timely delivery of intelligence to those who need it.

Intelligence must be disseminated in a way that’s appropriate for the user, highlighting the key facts and our interpretation, comment or assessment.

This is why we emphasize the way incident data looks within our threat intelligence platform. Our award-winning user interface and powerful visualisation tools are vital to helping you digest the information at speed.

Alongside providing a clear collection plan, the intelligence cycle ensures that the data is not only relevant but reliable. And it’s one of the most important modules within our intelligence training programme too; driving consistency and quality across the team.

Get Started