Tunnel vision may be one of the more dangerous vulnerabilities in threat intelligence, because the analyst…
James W. — Decision Intelligence Executive
Tunnel vision may be one of the more dangerous vulnerabilities in threat intelligence, because the analyst rarely knows when they have it. There is a strange point in an investigation where a hypothesis begins to feel like an answer. A few indicators align, an actor looks familiar, the TTPs resemble something we have seen before, and suddenly we are no longer asking what the evidence tells us. We are looking for evidence that tells us what we already believe and that distinction bothers me. Experience is supposed to make analysts better at recognizing patterns, but experience also creates expectations about what those patterns should mean.
Once we become invested in a conclusion, confirmation bias can quietly influence which evidence gets elevated, which gets discounted, and which questions stop being asked altogether. CTI should make uncertainty manageable, not manufacture certainty where the evidence does not support it. I think mature intelligence teams need to deliberately create friction in the analytic process by rewarding dissent, testing competing hypotheses, separating observation from assessment, and making it acceptable for someone to say, "I don't think the evidence gets us there yet." because that isn't indecision, it's analytic discipline.
There is also a business consequence when we get this wrong, because an unsupported conclusion can redirect threat hunts, change vulnerability priorities, consume incident response resources, influence security investments, or put an executive decision on the wrong path. To combat this we should encourage and build deliberate disagreement into CTI before an assessment becomes a decision that affects stakeholders. Intrusion attempts never cease; so we, as analysts must endeavor to remain as vigilant with ourselves, as we do when we direct our gaze towards our adversaries.
8 reactions · 1 comments
Comments
Mario M.: This is something I’ve been noticing while researching ransomware cases. A threat actor listing an organization on a leak site is an observation, not proof of how the compromise happened, whether ransomware was deployed, or even who actually conducted the intrusion. Separating observation, evidence and assessment, and being clear about what we simply don’t know, helps avoid filling the gaps with w