The Intelligence Analyst’s Playbook

The Intelligence Analyst's Playbook, published by SANS Institute in February 2026, is a desk-side reference poster distilling structured intelligence analysis methodologies for OSINT investigators, threat intelligence teams, and other analysts producing assessments for decision makers. Created as a companion to SANS's OSINT training curriculum, it condenses frameworks for report writing, source evaluation, and cognitive bias mitigation into a single practical reference.

Key takeaways:

• The 7-part Intelligence Product Structure — Bottom Line Up Front (BLUF), Key Judgments, Evidence Summary, Analysis, Alternatives, Implications, and Outlook — puts the assessed conclusion first so a decision maker can act even if they read only the first paragraph
• Calibrated probability language maps confidence terms to fixed numerical ranges, from "Almost certain" (93–99%) down to "Remote" (1–2%), and analysts should never state 100% or 0% confidence
• The six-phase Intelligence Cycle (Direction, Collection, Processing, Analysis, Production, Dissemination) is iterative rather than linear, with a feedback loop that can send analysts back to any earlier phase
• The Admiralty/NATO system rates source reliability (A–F) and information credibility (1–6) on two independent axes, since a reliable source can still provide inaccurate information and vice versa
• The CRAAP test evaluates sources across five criteria — Currency, Relevance, Authority, Accuracy, and Purpose — each scored 1–10 for a total out of 50
• Analysis of Competing Hypotheses (ACH), developed by Richards J. Heuer Jr. at the CIA in 1999, is an eight-step process that scores evidence against every hypothesis in parallel to find the least inconsistent explanation, rather than confirming a preferred one
• Dator's Four Futures framework — Continuation, Collapse, Discipline, and Transformation — serves as a completeness check when developing strategic scenarios
• The STEEP+S scanning framework covers seven sectors — Security, Technology, Economic, Environmental, Political, Legal, and Societal — for systematic horizon scanning
• Cognitive biases affecting intelligence analysis fall into four groups — search and attention, social and group, evaluation and estimation, and output and action — each with structured countermeasures such as devil's advocacy and pre-mortem analysis

Across all of these frameworks, the poster pushes toward the same underlying discipline: state judgments with explicit confidence levels, trace every judgment back to evidence, actively seek disconfirming information, and never let intuition substitute for a structured process. Cognitive biases can't be eliminated, only surfaced and challenged through techniques like ACH and devil's advocacy before a product reaches the decision maker. The poster distills methodologies taught in SANS's OSINT training curriculum, including SEC497 and SEC587, into a practical field reference for analysts.