Specialized Intelligence Products

The standard intelligence report is the bread and butter of the IC, but it is far from the only tool in your toolbox. From the rapid-fire daily brief to the exhaustive intelligence estimate, each product type exists because decision-makers need different information in different formats at different speeds. This lesson covers the major specialized product types, when to use each one, their typical formats, and the production timelines that will govern your life as an analyst.

The Daily Intelligence Brief (DIB) is the heartbeat of any intelligence organization. Whether it is called the President's Daily Brief (PDB), the Daily Intelligence Summary (DISUM), or your agency's local equivalent, the purpose is the same: deliver the most critical developments to senior leaders every single morning.

Format and Structure

• Length: Typically 1-2 paragraphs per item. Brevity is not optional -- it is survival. Your reader has 15 minutes and 12 items to get through.

• Lead with the "so what." The first sentence should tell the reader why they should care. Background comes second, if at all.

• Source transparency: Note the reliability and recency of the intelligence. "According to a reliable source with direct access" tells the reader something "reporting indicates" does not.

• Outlook: End each item with a forward-looking sentence. What should the reader watch for next?

Production Timeline

The daily brief operates on an unforgiving cycle. Typically, reporting is cut off in the late evening, drafting happens overnight or in the early morning hours, editorial review occurs at dawn, and the product is delivered by 0700. If you are a morning person, this is your dream assignment. If you are not, it will make you one.

The PDB is the only document in the world where the editor's feedback at 4:00 AM is "This is too long" and the correct response is "Yes, you're right, I'll cut it in half" -- not "I just woke up, who are you?"

Keep a running "watch list" of developing situations so you are never scrambling for content. The worst morning is the one where nothing happened overnight and you still need to fill the brief. Have evergreen items ready -- trend pieces, updates on slow-burning issues -- that can fill gaps without feeling like filler.

Target Packages

A target package is a comprehensive dossier on a person, group, facility, or network of interest. It is the intelligence product most likely to directly drive operational action -- which means getting it wrong has immediate, sometimes irreversible consequences.

• Purpose: Provide operators, commanders, or case officers with everything they need to act on a target -- identification, location, patterns of life, vulnerabilities, and associated risks.

• Audience: Tactical operators, law enforcement teams, military commanders, or case management officers.

• Key elements: Biographic data, photograph/physical description, known associates, communication patterns, location history, threat level assessment, and operational considerations (collateral concerns, legal authorities, etc.).

• Format: Highly structured and often templated. Consistency matters because operators need to find information in the same place every time, especially under stress.

Threat Assessments

Threat assessments evaluate the capability and intent{" "} of a hostile actor to cause harm. They are the product type most likely to land on a senior leader's desk with a "read immediately" flag.

• Capability analysis: What can the threat actor do? Weapons, personnel, technical skills, funding, and access.

• Intent analysis: What does the threat actor want to do? Stated objectives, historical behavior, ideological drivers, and recent indicators.

• Vulnerability assessment: Where are our weaknesses that the threat actor could exploit?

• Threat level: Use a standardized scale (Critical, High, Medium, Low) and be explicit about what drives your assessment. "High" means nothing without an explanation.

In threat assessments, always address both capability and intent. An actor with high capability but no intent is not an immediate threat. An actor with strong intent but no capability is a concern, not a crisis. The danger zone is where both converge -- and that is where your assessment should focus the reader's attention.

The Intelligence Estimate

The intelligence estimate is the heavyweight of the product world. It represents the coordinated judgment of the intelligence community (or a significant portion of it) on a major question. The U.S. National Intelligence Estimate (NIE) is the most famous example, but every intelligence organization produces some version of this product.

• Scope: Broad, often addressing an entire country, conflict, or strategic issue. "Iran's Nuclear Intentions and Capabilities" is a classic NIE topic.

• Coordination: Multiple agencies contribute, and dissenting views are documented in footnotes. This is one of the few intelligence products where disagreement is a feature, not a bug.

• Key judgments: The front matter contains a list of key judgments -- the bottom-line assessments that busy policymakers will read even if they skip everything else.

• Timeline: Months. Sometimes many months. The NIE on Iraq's WMD capabilities was famously compressed into a few weeks, and the result was... not the IC's finest hour.

Warning Intelligence

Warning intelligence exists to prevent surprise. It is the product type where failure is most visible and most consequential -- Pearl Harbor, 9/11, and the Yom Kippur War are all case studies in warning failure.

• Indicators and warnings (I&W): Predefined observable activities that, taken together, suggest an adversary is preparing for action. Moving troops to the border, recalling ambassadors, activating reserve units -- each is a data point in the warning mosaic.

• Warning memoranda: Short, urgent products that escalate a potential threat to senior leadership. The bar for issuing one is high because crying wolf erodes credibility, but failing to warn is worse.

• Watch conditions: Many organizations use a tiered watch system (WATCHCON) that ratchets up attention and collection as indicators accumulate.

Warning intelligence is the only job where success means nothing happened. "Remember that war we prevented last Tuesday?" "No." "Exactly. You're welcome."

Technology Assessments

Technology assessments evaluate the capabilities, proliferation risks, and strategic implications of emerging or adversary technologies. They bridge the gap between technical experts and policymakers who need to understand what a new weapons system, cyber capability, or surveillance tool means for national security.

• Technical description: What does the technology do? Explain in terms a non-engineer can understand. If your reader needs a PhD to parse your assessment, you have failed.

• Capability assessment: How effective is it? What are its limitations? Is the adversary's claimed performance realistic?

• Proliferation risk: Who else might get this technology, and how quickly?

• Strategic implications: How does this technology change the balance of power, the threat landscape, or our own defensive posture?

Choosing the Right Product

Selecting the wrong product type for your intelligence is like mailing a novel when a text message would do. Use this quick decision matrix:

• Urgent, tactical: Warning memo or spot report.

• Daily situational awareness: Daily brief item.

• Operational planning: Target package or threat assessment.

• Policy decision: Intelligence estimate or strategic assessment.

• Technical evaluation: Technology assessment.

• Recurring update: Periodic report or situation report (SITREP).

When you are unsure which product type to use, ask the consumer. A five-minute conversation about what they need and when they need it will save you days of work on the wrong product. The best analysts spend as much time understanding the question as they do answering it.