Capability, intent, and the unglamorous question of what you will do about either
Eight lessons from the basic distinctions through models, indicators, behavior, priority, mitigation, and the watch that continues after the slide is filed.
The first three teach you to name the problem. The middle three teach you to see it coming and to say how sure you are. The last two are what a decision-maker can actually do on a Tuesday.
Threat, vulnerability, and risk — plus the capability-and-intent test that stops a capable actor from being treated as a plot.
Qualitative, quantitative, scenario, threat-based, and vulnerability-centric approaches — and when a hybrid is the honest choice.
NTAS, CARVER, OCTAVE, and the deter-detect-delay-defend idea, without pretending a framework replaces a judgment.
Observable precursors — behavioral, situational, capability, intent, network — and how not to treat smoke as the fire.
Document what was said and done, cap the judgment, and refer. Not a diagnosis, and not a description of how harm is done.
Likelihood, impact, and time to intervene — so the list can change someone's Tuesday instead of agreeing with the room.
Accept, monitor, reduce, transfer, or avoid. Each option names an owner and the risk it leaves behind.
Tripwires, thresholds, and the alert fatigue that arrives when everything is set to urgent.
Continue your intelligence analysis journey with these recommended learning paths
Develop skills in monitoring and assessing domestic terrorism threats
Domestic Terrorism MonitoringMaster advanced techniques for strategic risk assessment
Strategic Risk Assessment