Name the decision first
Define what the intelligence must support. Is the team deciding whether to investigate an alert, prioritize a defensive review, change a monitoring assumption, or brief an executive? The same report can have different relevance to each question.
Record the relevant systems, period, and decision deadline. An accurate report about another environment may be useful context without establishing exposure in yours.
Use four source checks
- Origin: Identify the original observation or analysis. Track which later reports repeat it.
- Time: Separate the event date from publication and collection dates. Check whether the conditions still apply.
- Scope: Record the systems, versions, sectors, and regions the source actually describes.
- Support: Distinguish directly reported evidence from interpretation and unresolved claims.
Black Atlas’s evidence model publicly emphasizes source history and the distinction between fact and inference. These checks turn those ideas into questions a reader can ask of an intelligence brief.
Repetition is not independent corroboration
Three reports repeat one vendor advisory. They may improve distribution, but they still trace back to one evidence origin. A separate observation could add support if it is relevant and methodologically sound.
Maintain a short source lineage: original record, later reporting, added analysis, and any independent observation. Do not count the number of links as a measure of certainty.
When two sources disagree, first compare dates and scope. One may describe a different version or a later change. If the disagreement remains material, show both accounts and identify the check needed to resolve it.
Build a brief the reader can question
| Brief element | What to make explicit |
|---|---|
| Decision | The question, owner, and time horizon. |
| Observed facts | The supported statements and their sources. |
| Interpretation | What follows from the facts and under which assumptions. |
| Relevance | Why the information might matter to the defined environment. |
| Uncertainty | Gaps, contradictions, and evidence that could change the conclusion. |
| Next step | A proportionate review or check within approved authority. |
MITRE ATT&CK can help analysts describe and compare adversary behavior. Preserve the evidence behind the mapping, and do not treat a shared technique as sufficient proof of actor identity.
Do not conceal uncertainty in a confident summary
A brief can be useful even when the evidence does not settle the question. State what the reader can act on, what needs another source, and what remains unresolved. Unsupported numerical confidence can be as misleading as unsupported certainty.
A concise conclusion should retain the conditions that make it accurate. If the full report says “only for this version under these conditions,” the executive summary needs those limits too. Read the evidence standards for a practical claim-checking example.
Sources & context
- Black Atlas evidence and provenance ↗First-party description of source handling and claim status.
- MITRE ATT&CK resources ↗Common vocabulary for describing and comparing behavior.
Sources reviewed 18 October 2026. First-party descriptions establish the source’s stated approach; they are not independent validation of security outcomes. About our sources.