The Analyst Mindset
What is it?
The CTI analyst mindset is disciplined skepticism: separate what is observed from what is inferred, state uncertainty honestly, seek disconfirming evidence, and never present a hypothesis as a fact. It is the habit of thinking in probabilities, not certainties.
Why it matters
Intelligence deals in incomplete, sometimes deceptive information; the analyst's discipline is the only guard against confidently reporting something false.
Where you see it
The reasoning behind every assessment in a product.
What normal looks like
An assessment that distinguishes evidence from inference and carries an explicit, defensible confidence.
What suspicious looks like
Not applicable directly.
How analysts investigate
By stating what is known, what is assessed, and how confident the assessment is — and by actively looking for evidence that would prove the assessment wrong.
Common beginner mistakes
- Presenting a plausible guess as established fact — the single most damaging habit in intelligence, because decisions get made on it.
A Sahab analyst sees an attack using a tool associated with a known group. The disciplined write-up separates observation ('the tool was used') from inference ('this MAY indicate that group') and states confidence — because tools get shared and copied, and a false attribution could misdirect the whole response.
Quick check
An analyst sees a tool linked to Group A. What is the disciplined way to report it?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.