Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Risk Management

Don’t Overlook the Importance of Feedback in an Intelligence Operation

The intelligence cycle, just as its name implies, is cyclical. Similar to the scientific method or even the water cycle, the successful execution of each step of the intelligence cycle relies on the successful execution of the step that came before it. And this is especially crucial to remember once you reach the cycle’s final step: dissemination and feedback. 

The intelligence cycle, just as its name implies, is cyclical. Similar to the scientific method or even the water cycle, the successful execution of each step of the intelligence cycle relies on the successful execution of the step that came before it. And this is especially crucial to remember once you reach the cycle’s final step: dissemination and feedback. 

In theory, this step is supposed to entail delivering the finished intelligence you produced to its intended consumer, seeking feedback on it from that consumer, and then using that feedback to inform, adjust, and ideally, optimize ongoing and future intelligence operations. 

But in practice, this doesn’t always happen. In many cases, once an intelligence report has been delivered, feedback is little more than an afterthought. Time constraints, communication barriers, and misaligned priorities are frequently (and understandably) cited as culprits, but often the root cause is simply that a team doesn’t fully grasp what sort of feedback they should seek to obtain and why.

As someone who’s spent most of my career supporting intelligence operations, I’ve found that posing these two questions to intelligence consumers can be a great place to start:

1. Did you use the intelligence? Why or why not?

This question is critical because it can help you determine whether your reporting was actionable for its intended consumer. The fundamental purpose of intelligence, after all, is to inform decisions and ultimately spur action. If your intelligence wasn’t able to do this, you need to figure out why. Was it not timely enough? Was the analysis not clear enough? Did it lack context? No matter the reason, quickly identifying and addressing it is imperative, especially given the often extensive amounts of time and resources involved in intelligence production.

2. To what extent did the intelligence satisfy your intelligence requirements?

If you receive an answer of yes to the previous question, it’s still important to try and dig deeper. Just because your intelligence was used doesn’t necessarily mean it fulfilled all of the operation’s intelligence requirements (IRs). As I’ve discussed previously, IRs are the foundation—and integral to the success—of every intelligence operation. Understanding which IRs your intelligence report did or did not fulfill can help shed light on gaps in your collections coverage, weaknesses in your analysis, or even misaligned expectations, among other issues that you may need to address moving forward.

Advertisement. Scroll to continue reading.

These two questions, as I mentioned earlier, should serve merely as a starting point and, ideally, should precede additional questions that aim to seek additional feedback from whoever consumed your intelligence. But in situations where time constraints or communication barriers make obtaining any feedback whatsoever exceedingly difficult, receiving even just a brief answer to only one of these questions can still be valuable. And regardless of what feedback you receive, remember that feedback is essentially a form of intelligence; it is only truly valuable if it is actionable and, ultimately, actioned. 

This means that once you do obtain feedback on an intelligence report or operation, you then need to evaluate it and determine whether, and how, it should be implemented. In situations where feedback reveals that certain IRs were not fully satisfied, for example, implementing such feedback might entail backtracking, re-strategizing, and re-doing previously completed steps in the intelligence cycle for the operation at hand until the desired outcome is achieved and IRs fulfilled. Or, let’s say you learn that, for instance, your intelligence wasn’t considered timely enough to be useful. Implementing this sort of feedback could mean streamlining your intelligence production process to help expedite the rate at which future reports are produced.

Above all else, keep in mind that the intelligence cycle is meant to operate as a continuous feedback loop. So while we often refer to dissemination and feedback as the cycle’s final step, it’s really not so final after all.

RelatedWhy All Security Disciplines Should Use the Intelligence Cycle

Related: Questions to Ask Before Choosing a Threat Intelligence RFI Service

Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

People on the Move

Attack detection firm Vectra AI has appointed Jeff Reed to the newly created role of Chief Product Officer.

Shaun Khalfan has joined payments giant PayPal as SVP, CISO.

UK cybersecurity agency NCSC announced Richard Horne as its new CEO.

More People On The Move

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybersecurity Funding

2022 Cybersecurity Year in Review: Top news headlines and trends that impacted the security ecosystem

Endpoint Security

Today, on January 10, 2023, Windows 7 Extended Security Updates (ESU) and Windows 8.1 have reached their end of support dates.

Email Security

Many Fortune 500, FTSE 100 and ASX 100 companies have failed to properly implement the DMARC standard, exposing their customers and partners to phishing...

Artificial Intelligence

Two of humanity’s greatest drivers, greed and curiosity, will push AI development forward. Our only hope is that we can control it.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...