Intelligence work is often portrayed as a world of secrets, surveillance and classified information. In reality, much of it involves something less dramatic, but just as demanding: making sense of incomplete information. Professionals in the field may examine political developments, security threats, military activity, cyber operations, criminal networks or emerging technologies. To do this effectively, they need a combination of analytical skills, communication skills, technical knowledge, cultural awareness and sound judgement. As threats become increasingly interconnected, these skills are vital in government, the military, law enforcement and intelligence roles within the private sector.
Understanding different types of conflict
Before intelligence professionals can assess a threat, they must understand the environment in which it exists. A dispute between rival countries requires a different analytical lens to violence between groups within the same country. Understanding the distinction between interstate and intrastate conflicts provides an important basis for this distinction. Interstate conflicts take place between nations and may include conventional warfare, as well as trade disputes, cyber campaigns and proxy conflicts. Intrastate conflicts take place within a country and may involve civil wars, terrorism, organised crime, political violence or clashes between rival factions.
This distinction also influences intelligence gathering. Analysts examining international military threats may rely heavily on signals, imagery and technical intelligence. Internal conflicts may require greater attention to human sources, open-source information, social dynamics, financial activity and local networks. Recognising the nature of a conflict helps professionals decide what information matters and which collection methods are most appropriate.
Analytical thinking and sound judgement
Intelligence professionals rarely receive a complete picture. Instead, they have satellite imagery, intercepted communications, news reports, financial records, witness accounts, social media posts and other fragments of information. Some sources are reliable. Others may be out of date, misleading, incomplete or deliberately false. Sound analytical thinking helps them piece these fragments together without jumping to unsubstantiated conclusions.
Analysts must distinguish facts from assumptions and identify gaps in the available information. They should consider competing explanations, rather than clinging to the first theory that seems convincing. Good judgement also means understanding uncertainty. An intelligence assessment does not always produce a definitive answer. Professionals may need to explain what is likely to happen, clearly communicating how certain they are and what evidence might cause them to change their assessment.
Research and the assessment of information
Finding information is easy. It is much harder to determine whether it is worthy of influencing an intelligence assessment. Professionals need strong research skills to locate relevant material in government documents, databases, academic research, public records, the press, technical sources and other information channels.
Assessing sources is equally important. Who created the information? Why was it produced? Can it be independently verified? Does the source have access to the information it claims to possess? Could political, financial, ideological or personal motives affect its reliability? These questions become all the more important when working with information from open sources. Public information can reveal valuable patterns, but disinformation and deliberate influence campaigns can distort the picture. Intelligence professionals therefore need curiosity combined with scepticism, rather than simply accumulating information.
Clear and concise communication
Excellent analysis is of limited value if decision-makers cannot understand it. Intelligence professionals often need to transform complex findings into concise reports, briefings, presentations or assessments. Their audience may include military commanders, directors, law enforcement officials, political decision-makers, cyber security teams or other analysts. These readers do not, as a rule, have unlimited time.
Good intelligence writing prioritises the most important information, explains why it matters, and distinguishes established facts from analytical judgements. Verbal communication is also important. Analysts may need to brief senior officials and answer difficult questions without time to consult their notes. The aim is not to impress the audience with technical jargon, but to convey complex information accurately enough for someone to make a better-informed decision.
Cultural and political awareness
Security threats do not arise in a vacuum. History, religion, the economy, political institutions, ethnicity, geography and social relations can all influence the way individuals, governments and organisations behave. An action that appears irrational when viewed from outside a region may make much more sense once the local history and political incentives are understood.
Intelligence professionals therefore stand to gain from studying the environments they analyse. Knowledge of languages offers a further advantage, as it reduces reliance on translations and enables analysts to understand the local press, speeches, documents and cultural nuances more directly. Cultural awareness also helps them avoid assuming that people in other societies will interpret events or make decisions in line with their own expectations.
Technical and data skills
Modern intelligence increasingly involves vast amounts of digital information. Professionals may encounter geospatial data, network intelligence, communications records, satellite imagery, databases, financial transactions or social media activity. They do not all need to become software engineers, but basic technical knowledge is becoming increasingly valuable. Analysts should understand how data is collected, organised, compared and visualised; depending on the role, data analysis, geographic information systems, cybersecurity concepts, programming, machine learning or social media analysis may be useful.
Technology also creates limitations. Automated tools can process information quickly, but their results still require human assessment. Intelligence professionals need sufficient technical understanding to recognise when a system produces something questionable, rather than assuming that a sophisticated tool must be correct.
Collaboration across different specialisms
Intelligence issues are rarely confined to a single discipline. A cyber attack may involve technical analysts investigating the malicious software, regional specialists examining the suspected country of origin, financial analysts tracking payments, and geopolitical analysts assessing the attacker’s strategic objectives. Collaboration allows these different perspectives to form a more complete picture.
Professionals must be willing to share relevant information, listen to specialists, respectfully challenge assumptions and acknowledge the limits of their own expertise. Cooperation between agencies can be just as important. Domestic threats, for example, may require coordination between national, state and local organisations, whilst international threats may involve foreign partners. In intelligence, teamwork is not merely a workplace preference. Complex threats often become comprehensible only when different pieces of expertise are brought together.
Ethical reasoning and respect for legal boundaries
Access to sensitive information entails a considerable responsibility. Intelligence professionals must understand the laws, policies, privacy safeguards and organisational rules governing how information may be collected, stored, analysed and shared. This becomes all the more important when intelligence activities concern citizens, personal data, surveillance or politically sensitive issues.
Ethical reasoning goes beyond the question of whether an action is technically feasible. Professionals must also consider whether it is authorised, necessary, proportionate and appropriate. Upholding these standards protects both individuals and the legitimacy of intelligence agencies. Trust is hard to build and easy to lose, so professionals working with sensitive information must demonstrate discretion, integrity and responsibility throughout their careers.
Adaptability and continuous learning
Intelligence professionals prepare for threats that rarely stand still. Cyber capabilities are evolving. Political alliances are shifting. New technologies are transforming military operations. Criminal organisations are adapting their methods. Artificial intelligence, drones, encrypted communications and sophisticated influence campaigns constantly create new analytical challenges, and professionals cannot rely solely on what they learnt at the start of their careers.
They must keep abreast of developments in technology, geopolitics, security, and methods of research and intelligence gathering, whilst continually questioning established assumptions. Adaptability also means being prepared to revise an assessment when new evidence contradicts it. Changing a conclusion because the facts have changed is not a sign of analytical weakness; refusing to reconsider it may be. Ultimately, intelligence work depends on disciplined thinking. Technical tools and classified information can broaden what professionals see, but their skills in analysis, communication, research, cultural awareness, collaboration, ethical judgement and adaptability determine how well they understand what they see.
Competing hypotheses have a method, and that method has an author
The article’s advice to consider competing explanations rather than latching onto the first convincing theory has a specific history within the profession. Richards Heuer, a CIA analyst for decades, published *Psychology of Intelligence Analysis* in 1999, an internal manual that was made public, in which he describes how the analyst’s mind is deceived by its own mental shortcuts. His solution – the analysis of competing hypotheses – turns the usual approach on its head. Instead of gathering evidence for your preferred theory, you list all plausible hypotheses from the outset. You weigh up each piece of evidence against each hypothesis and look for evidence that refutes them, not that which confirms them. The hypothesis that remains is the one with the least evidence against it, not the one with the most evidence in its favour.
An example from the article illustrates the mechanism. A cyberattack has three plausible explanations: a state, a criminal group, or a disgruntled employee. The time of the attack, the language of the malicious code and the chosen target all fit all three. This is of no help, however convincing it may seem. The payment account tracked by the financial analyst rules out one of them. That is the evidence that matters, because it distinguishes between the hypotheses. Heuer called this quality ‘diagnostic’, and most of the evidence we gather lacks it.
Viewed through Heuer’s lens, the list of questions about sources in the article takes on a precise meaning. Who created the information, why, with what access and for what reasons are the questions that determine how much weight a piece of evidence carries in the table of hypotheses, and evidence from an unverifiable source carries no weight at all, however convincing it may sound. The method also explains why the article emphasises communicating the degree of certainty. An assessment produced by ruling out hypotheses comes with its own stated uncertainty, because the analyst knows exactly what evidence is missing and what would alter the conclusion.
The method has its limitations, which Heuer acknowledged and which subsequent research has quantified. It takes time, which is in short supply during a crisis. It depends on the initial list of hypotheses, and a hypothesis that nobody has put down on paper cannot be tested. It does not produce probabilities, but rankings, and experimental studies have found modest effects on accuracy, more noticeable among novice analysts than among experienced ones. Practitioners have therefore adapted it into simpler forms, with short tables and periodic reviews, which maintain the discipline without its full cost. What remains intact is the principle: evidence that cannot rule anything out says nothing. It remains, however, the clearest procedure for what the article calls sound judgement: a discipline of rejection, applied before believing.
Most information is public, and ‘public’ does not mean ‘verified’
The article mentions open-source intelligence as one of the categories of work. Institutions in the field now treat it as a discipline in its own right. In March 2024, the Office of the US Director of National Intelligence and the CIA published the first joint strategy for open-source intelligence, valid for 2024–2026, which defines the discipline as information obtained exclusively from public or commercial sources and describes it as the foundation underpinning all other forms of intelligence. The strategy sets out four priorities, ranging from coordinating the acquisition of open-source data to training a new generation of specialists, and designates the Director of the CIA as having operational responsibility for the entire community. In other words, the profession described in the article is increasingly carried out using material that anyone can read. This is precisely why verification has become the central skill, and analysis courses now teach it before data collection. When sources were secret, access was rare and valuable. When they are public, access is no longer valuable; what matters is only what you can confirm from what you have read.
The most common task in this field is also the most mundane: establishing whether an entity exists. A company, a foundation, a supplier, an address. Public company registers, licensing lists and verified directories are the open sources with which any network analysis begins, and the difference between them is the difference between assertion and verification. A website says what the company wants people to believe about it. A front company has a website, an address and a telephone number; it has no track record, no real employees and no entry in a register that requires evidence.
The difference only becomes apparent when you ask to see the source for each claim – which is precisely what the article requires. An entry in a curated directory, verified by a human before publication, states what a third party has been able to confirm, and the criteria by which a citation in a directory becomes trustworthy—source, date, consistency—are precisely Heuer’s questions about sources, applied on the scale of a register. For a network analyst, such a register is not a conclusion, but a clean starting point: the entities within it have passed an initial filter, whilst those missing from it are either insignificant or of interest.
The same distinction governs the reference sources with which the analyst works on a daily basis. An editorial collection of verified reference and scientific resources answers Heuer’s first question—who produced the material and with what access—before the material enters the table. The problem is not unique to intelligence: any large collection of data gathered from diverse sources, with different formats, duplicates and inconsistent data, poses the same difficulties, described at length in an analysis of the challenges of data collection in today’s digital markets. The analyst resolves them methodically; for the rest of the world, editorial verification carries out part of that work once and for all. A journalist, a compliance officer and an industrial buyer are, without realising it, asking the same questions as the intelligence analyst. The difference is that the analyst has them written down, puts them in the same order every time and notes down what they were unable to verify.
The sophisticated tool that confidently gets it wrong
The warning in the article about automated tools whose results require human assessment has, in two years, become the central issue of the profession. Systems that compose responses from existing text produce fluent, plausible and sometimes fabricated assessments, featuring a company that does not exist, an incorrectly attributed address or a connection that never took place. For an analyst, a machine’s hallucination is evidence of unknown origin. It does not go into the table until it has been independently confirmed. The practical test is simple: you ask the tool for the source, open it, and read the passage. If the source does not exist or does not say what is attributed to it, the entire response is treated as unreliable, however well it may be written. The general mechanism is described in an analysis of directories as anchors of trust against AI hallucinations: a generated response is only as good as the verified sources it draws upon, and the only defence is the requirement that every statement carry a reference that can be accessed. This is Heuer’s discipline, transferred from the analyst to his tool.
The cyber domain makes this rule even more pressing, as entities there can invent themselves with just a domain name and a webpage. Security providers, investigative tools and consultants are chosen from hundreds of similar names, and an editorial category of IT security services and resources carries out the initial check – verifying existence and classification – before the one that really matters: a test on a known case, with the result cross-checked against what the team already knows. A provider that refuses to undergo the known-case test has already given an answer, in its own way.
Preparation for such a career, as the article shows, involves formal study, and programmes in intelligence, security or analysis are chosen in the same way as any service that is difficult to assess in advance. A specific category of vocational training providers offers the first check; accreditation confirmed in the register of the body that granted it – not by the logo on the website – offers the second; and a discussion with graduates offers the third. A candidate who applies Heuer’s approach to their own choice of school has already carried out the first exercise of the profession. Three hypotheses about the programme, evidence for each, verified sources, and a conclusion with its degree of certainty.
What no level of verification can achieve must be stated just as clearly. An editorially verified listing confirms that an organisation exists, that it can be contacted, that it operates in the category shown, and that it can still be found a year later. It does not say what the entity does behind closed doors; it is no substitute for analysis; nor does it replace official records or evidence gathered directly. Editorial verification reduces noise; it does not eliminate it, nor does it claim to do so. Those who use it as a starting point save time; those who use it as an end point have broken Heuer’s rule. Each layer answers a different question. And in Heuer’s terms, all together they do one thing: they remove unsourced evidence from the table before it determines a hypothesis.
