CTI Reporting & Briefing
Learn threat intelligence report writing: key judgments, estimative language, advisories, executive briefs and board pages that people act on. You work on real documents, from the declassified President's Daily Brief of 6 August 2001 to CISA and NCSC advisories, and four missions put you on the CTI desk of a fictional Dublin insurer. TLP 2.0 and PAP marking, tearlines, report templates (LaTeX included), drafting with AI and CTI metrics are covered too, across 33 lessons with a verifiable certificate at the end.
The first 2 modules are free. Premium unlocks the missions, the rest of the path and the certificate.
Curriculum
7 more steps behind a free account
Free account
Ready to start CTI Reporting & Briefing?
Create a free account to open the remaining 7 steps and track every step you finish. The first 2 modules are free. Premium unlocks the missions, the rest of the path and the certificate.
- First 2 modules free
- Progress saved on every step
- Certificate with Premium
Already have an account? Sign in
About this path
A lot of threat intelligence gets skimmed and filed. In the SANS 2026 CTI survey, 91% of the 67 security executives who answered, most of them CISOs, rated threat intelligence as valuable, yet only 26% said it significantly influences their decisions (another 42% said moderately). The survey's authors read that gap as a translation problem, and on the page it tends to look the same: the headline claims more than the body supports, the judgment that matters sits on page three, or the indicator list arrives without the warning to check it before blocking. This path teaches threat intelligence report writing as a set of decisions you can check line by line.
It works on real documents. You compare the declassified President's Daily Brief of 6 August 2001 with the shorter version sent out the next day, and you look at how a 2016 indicator list fed a false "grid hacked" story. CISA and NCSC advisories, the UK and NATO probability scales and published corrections all get the same treatment. Then you fix drafts sentence by sentence and decide which product a given reader needs.
The first section, Readers and the First Page, starts with the people who act on your intelligence. You keep one stakeholder register that includes the lawyer and the deal team as well as the SOC, and you learn how to interview a stakeholder about the decisions they make. Then you write the first page most readers stop at: a headline the body supports, a key judgments box whose judgments still read correctly when quoted alone, a plain statement of what you don't know yet, and an annex that lets a lawyer and a detection engineer use the same product. These two modules are free.
The second section, Uncertainty and Evidence on the Page, is about how sure you are and why. You carry another agency's or a vendor's probability words onto your house scale without changing what they meant, using the ICD 203 scale, the UK PHIA yardstick and NATO's scale side by side, and you update a judgment in public without losing the reader. You write source summary statements, give every number its denominator, and draw charts that cannot be misread.
The third section, The Product Line, matches the product to the decision and the time horizon. You build an advisory with its indicator package, a technical report written for detection engineers, weekly summaries and answers to requests for information, and a strategic assessment. Then you write for leaders: an answer to "are we exposed?", a one-page board report, a decision briefing, intelligence tied to a business event such as an acquisition or an executive trip, and updates through the first 72 hours of an incident.
The fourth section, From Release to Results, covers what happens after the draft. You mark products with TLP 2.0 and PAP so the label survives forwarding and printing, and cut a tearline that says exactly what the internal version says. You stop flawed reports with a review before release, use templates that print the label on every page and keep estimative words and confidence statements consistent (with a real LaTeX example), draft with AI while tracing every line to a source you have read, and correct a published report so its readers notice. The path ends with running the programme: one register for competing stakeholders, triaging requests and saying no, metrics that count decisions rather than reports, a decision log with a quarterly value report, and a public writeup for your portfolio.
Four missions put you on the CTI desk of Kilmorra Insurance, a fictional Dublin insurer, through the lab VPN. You fix the first page of a supplier breach assessment, red-pen a colleague's draft that mixes probability with confidence, build three products for three readers during a live incident (the SOC, the CFO and the legal team working to the DORA reporting clock), and release the finished assessment with the right markings, a sanitised tearline and a correction that lands after it has gone out. Each mission ends with the product as it should have gone out.
You should know the basics of threat intelligence first. If PIRs, Admiralty grading or estimative language are new to you, start with the free Cyber Threat Intelligence path, then come back here to turn that analysis into reports people act on.
What you will learn
- Know who acts on your intelligence. Keep one register of the people who use your products, security and non-security alike, and what each of them decides.
- Write a first page that survives being read alone. Headlines the body supports and numbered key judgments that carry their basis and gaps.
- Quote other people's probability words correctly. Carry a UK, NATO or vendor estimate onto your house scale without changing its meaning, and update your own line in public.
- Back every judgment and every number. Write a source summary statement and give every number its denominator, so charts and figures cannot be misread.
- Pick the product that fits the reader. Decide whether a reader needs an advisory, a technical report, a weekly summary or a strategic assessment, and build it.
- Give leaders a decision, not a threat summary. Turn a threat into a decision package, report to the board once a quarter, and keep leaders updated while an incident is still moving.
- Release intelligence safely. Mark products so TLP and PAP survive forwarding, and write a partner version that says what the internal one says.
- Produce reports the same way every time. Review drafts against a checklist, build releases from templates (LaTeX included) and use AI without losing the source trail.
- Show what your team is worth. Rank competing requests, report metrics that count decisions, and publish a writeup for your portfolio.
Who this path is for
- CTI analysts who know the basics and want their reports read and acted on.
- SOC, IR and detection engineers moving into threat intelligence who need to write for readers outside engineering.
- New CTI team leads who own requirements, executive briefings and board reporting.
- Job seekers who need a strong writing sample for CTI applications.
Guides for this path
- How to Write a Threat Intel Report Nobody IgnoresHow to write a threat intelligence report people actually act on: the BLUF method, the so-what test, standardized probability and confidence language, and the seven-part structure that survives a busy reader. Includes the ICD 203 rule almost nobody follows about never mixing confidence and likelihood in the same sentence.
- Traffic Light Protocol (TLP 2.0), ExplainedThe fastest way to get quietly cut out of an information sharing community is not leaking something. It is mislabeling it. The Traffic Light Protocol exists to prevent exactly that: four short labels, standardized as TLP 2.0 by FIRST, that tell a recipient how far they may pass something on.
Frequently asked questions
A threat intelligence report is a finished product that tells a specific reader what is happening, what it means for them and what they should do about it, with the evidence and the confidence behind each judgment. Common types are the advisory with its indicator package, the technical report, the weekly summary, the answer to a request for information, the strategic assessment and the executive or board brief. CTI Academy's CTI Reporting & Briefing path builds each of them.
Start from the reader and the decision they face, not from the data you collected. Put the bottom line and numbered key judgments on the first page, state likelihood with a defined estimative scale and give confidence separately, say what each judgment rests on, give every number its denominator, and move indicators and technical detail into an annex. Before release, mark the report with TLP and have someone review it against a checklist.
Key judgments are the few numbered conclusions at the top of an assessment. Each one states how likely something is, with what confidence, and what that rests on, and is written so it still reads correctly when someone quotes it alone. Most readers stop after them, so the path spends one lesson on the key judgments box and another on writing what you don't know yet.
No. Every lesson is about threat intelligence products: key judgments, source statements, advisories, indicator packages, strategic assessments, board pages, TLP marking and tearlines. The examples come from real government and security-vendor documents, alongside fictional drafts from invented companies.
It helps. This path assumes you know the intelligence cycle, PIRs, Admiralty grading and the ICD 203 estimative scale, and it builds on them rather than teaching them again. The Cyber Threat Intelligence path covers all of them and is free.
Yes. One module covers marking a product so its TLP 2.0 and PAP labels survive forwarding and printing, and writing a tearline: a version for partners that leaves out the sensitive detail but says exactly what the internal version says. The Release Day mission puts both into practice, along with a correction issued after release.
Not your free writing. The platform grades multiple-choice and short answers, so the quizzes and missions ask you to find the faults in real and fictional drafts, choose the better rewrite and check a draft against a review checklist. Most lessons also end with a writing task you check against the lesson's criteria, and the last lesson plans a public writeup you can use as a writing sample.
Yes. One lesson shows how a LaTeX build prints the TLP label on every page and keeps estimative words and confidence statements consistent, and compares it with two free Word and Markdown templates, MITRE's CTI Blueprints and Lenny Zeltser's.
Yes. One lesson in the CTI Reporting & Briefing path covers drafting and summarising with AI while keeping every sentence traceable to a source you read. It also sets out what never goes into a consumer or public chatbot: TLP:AMBER and TLP:RED text, victim names and unreleased indicators.
About nine hours. The 33 lessons take roughly six, at 10 to 11 minutes each, the four missions about two, and the quizzes and writing tasks the rest.
Yes. Completing every step of the path, all nine modules and the four missions, issues a CTI Academy certificate in your name. Each certificate carries a unique ID, and its QR code opens a public verification page, so an employer can confirm it without contacting us.
The first two modules, Who Reads Your Intelligence and The First Page, are free: seven lessons on finding the people who act on your intelligence and writing the first page they read. The missions and the later modules need a premium subscription.