How Analysts Think, Judge, and Fail
What This Section Is About
The Tradecraft section focuses on the part of cyber threat intelligence that tools, frameworks, and playbooks cannot fix:
How analysts think.
Most CTI conversations focus on what analysts do: collecting data, tracking actors, and producing reports. Far fewer focus on how analysts reason, make judgments, and communicate uncertainty.
That gap is where intelligence quality is determined.
The articles in this section explore the human side of CTI work: judgement, bias, reasoning, communication, and the uncomfortable decisions analysts make under uncertainty.
Why Tradecraft Matters
You can have strong foundations and still produce weak intelligence.
This usually happens when:
- Analysis becomes mechanical
- Outputs become formulaic
- Judgement is replaced by process
- Analysts optimise for safety instead of insight
Tradecraft is what separates:
- Reporting from intelligence
- Activity from impact
- Confidence from credibility
Without strong tradecraft, CTI teams may appear productive while quietly losing influence.
What You’ll Find Here
Articles in Tradecraft examine topics such as:
- Analytical judgment and decision-making
- Cognitive bias and human failure modes
- Assumptions, confidence, and uncertainty
- Writing intelligence that survives misinterpretation
- Turning data into insight instead of accumulation
These are not abstract ideas. They show up daily in CTI work, often unnoticed until something goes wrong.
How These Articles Are Written
Tradecraft articles are written from experience, not theory alone.
They:
- Focus on reasoning rather than rules
- Highlight common analytical mistakes
- Explore why smart analysts still get things wrong
- Emphasise clarity over completeness
Many pieces challenge habits that feel productive but undermine analysis quality over time.
Who This Section Is For
This section is especially relevant if you are:
- A CTI analyst moving from execution to judgement
- A senior analyst mentoring others
- A CTI lead reviewing analysis quality across a team
- A practitioner who feels “busy” but unsure of impact
If you are early in your career, these articles may feel confronting.
If you are experienced, they may feel uncomfortably familiar.
Both reactions are normal.
How to Use This Section
These articles are best read as thinking exercises, not instructions.
You don’t need to agree with every point.
You do need to reflect on how your own analysis is shaped by habit, pressure, and context.
Revisit these pieces as your responsibilities grow. Many tradecraft lessons only fully land after experience.
Suggested Starting Points
If you are new to this section, start with:
- Judgement Is a Skill, Not an Instinct
- When Analyst Confidence Becomes a Liability
- Data Is Not Insight, And Tools Won’t Fix That
These articles introduce recurring themes that appear throughout Tradecraft.
How This Connects to the Rest of CTI Tradecraft
Tradecraft sits at the centre of the site.
- Foundations explains what intelligence is for
- Tradecraft explains how analysts do the thinking
- Threat Analysis shows tradecraft applied in practice
- CTI Programs explores how organisations enable, or suppress, good tradecraft
When tradecraft is weak, even strong programs and good intentions fail quietly.
A Note on the Long View
This section forms the backbone of the Analyst-to-Lead progression within the CTI Tradecraft Academy.
Before analysts learn advanced techniques or leadership models, they need to understand how judgement, bias, and reasoning shape every intelligence product they produce.
That work lives here.
Read one article slowly.
Then notice how it changes the way you read the next.
That’s how this section is meant to work.