The Intelligence Lifecycle

Every other page in this pillar covers a stage of work: collecting, analyzing, writing, briefing. This page is the loop that connects them — the intelligence cycle — and an honest account of how it behaves once a real team tries to run it.

The model earns its place by forcing one claim: intelligence is production, with a customer at both ends. The loop starts with someone’s question, ends with an answer delivered to that person, and continues only when they say whether it helped. Every failure mode this pillar warns about — reports nobody reads, analysis without a “so what” — is a phase of this loop quietly missing.

The six phases

• Direction: deciding what needs to be known, and for whom. The output is a set of requirements with a named consumer attached. This is the phase most often skipped entirely, and everything downstream inherits the omission.
• Collection: gathering against those requirements — feeds, OSINT, internal telemetry. The craft lives in Collection & Sourcing; the lifecycle’s contribution is the word against. Collection without a requirement is hoarding.
• Processing: turning raw material into something analysable: parsing, normalizing, deduplicating, enriching. Mostly engineering, chronically under-resourced, and the one phase no other subsection owns — covered in full in Processing & Enrichment.
• Analysis: the step where observations become a judgment — the whole subject of Analytic Methods.
• Dissemination: the judgment, in a form its consumer can act on: reporting and briefing.
• Feedback: whether it answered the question, what the consumer did, and what the requirement should become next. Instrumenting this phase is its own page.

Three parts of the loop earn pages of their own; the rest of the phases live with their craft elsewhere in the pillar:

Page	What it covers
F3EAD	The targeting cycle translated to defense, phase by phase, and the exploit discipline defenders skip
Processing & Enrichment	Normalization, deduplication, enrichment and indicator aging — the phase that eats analyst time invisibly
Feedback & Product Health	The signals that reveal whether intelligence changed anything, ranked by strength, and retiring products

Feedback separates programs from report factories

A report factory runs the first five phases on a calendar and measures itself by output: reports shipped, indicators pushed, briefings held. The loop never closes, so production drifts toward whatever is easiest to produce — and the weekly digest that nobody reads can run for years on pure momentum, because no mechanism exists for its irrelevance to register.

The feedback phase is one question asked with a straight face: what did you do differently because of this? It is uncomfortable precisely because it is diagnostic. A consumer who cannot name an action, a decision, or a changed prior is telling you the product serves no requirement — and that finding should flow back to direction and change what gets made. This is also the honest basis for program metrics: work produced against a requirement counts differently from work produced because it was interesting. Which signals count, how to collect them without begging, and when to retire a product are covered in Feedback & Product Health.

F3EAD, the loop at operations tempo

Targeting doctrine runs a different cycle: find, fix, finish, exploit, analyze, disseminate. Where the classic cycle runs on requirements and a production calendar, F3EAD runs on contact — the incident response arc up front, and behind it the exploit phase, which names something defenders systematically waste: a finished incident is ground truth about your own environment, your actual adversary, and your controls under load, richer than anything a feed will ever deliver. The two loops fit different teams and compose — what the fast loop’s exploit phase surfaces becomes an update to the standing requirements the slow loop runs on. The full defensive translation, phase by phase, is in F3EAD.

Where the neat loop breaks

The cycle is a useful model carrying some honest caveats:

• The phases run concurrently. An analyst mid-analysis goes back and collects. A team is in all six phases at once across a dozen products. Anyone auditing a team for clean sequential phase transitions is measuring the diagram rather than the work.
• The model assumes an institution. It was drawn for an apparatus with separated roles — tasking authorities, dedicated collectors, all-source analysts. A two-person CTI team is the whole diagram, and imposing ceremony at the phase boundaries adds cost without adding rigour.
• Most programs run the loop backwards. Collection arrives first — the feeds were bought, the alerts flow — and “requirements” get reverse-engineered to justify what is already coming in. Supply-driven intelligence answers the questions the vendor’s visibility can answer, which overlap only by luck with the questions your organization needs answered.

Read as a workflow to enforce, the cycle produces process theater. Read as a diagnostic checklist, it earns its keep: when intelligence is being produced and nothing is changing, “which phase is missing?” almost always has a specific answer — usually direction or feedback, the two phases where the customer lives.

The loop in a working week

The abstraction maps onto a calendar more directly than it first appears, because the loop is fractal — it runs at several cadences at once:

• Morning triage is collection and processing against standing requirements.
• An ad hoc question from IR runs the entire loop in miniature, inside a day.
• The weekly product is a dissemination cadence, and the two minutes spent asking its readers what they used is the feedback phase.
• The incident retrospective is F3EAD’s exploit phase wearing blameless-postmortem clothes.
• The quarterly requirements review is direction, done deliberately.

The test is concrete: point to where direction and feedback happen in your team’s actual calendar. If no meeting, ritual, or document does either job, those phases are aspirational — and the loop is an assembly line with nobody ordering and nobody receiving.

Where this connects

The detection lifecycle is this loop’s mirror image — idea intake through deployment to retirement, the same shape with a rule as the artifact — and this loop’s dissemination phase is that one’s front door. Within the pillar, collection is the second phase as a craft, analytic methods the fourth, and reporting with communication the fifth. Incident response is F3EAD’s find-fix-finish arc, and its retrospectives are the exploit phase this page argues defenders waste.