# Intelligence Gaps, Competing Hypotheses, and Analytical Bias

> Plan collection against intelligence gaps, test explanations with Analysis of Competing Hypotheses and challenge techniques, counter cognitive bias, and express likelihood and confidence precisely.

Canonical: https://codelivly.com/rooms/cti-hypotheses-gaps-and-bias
Last updated: 2026-10-28

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Lessons | 6 |
| XP | 100 |

Purpose: make analytic judgements that survive scrutiny. This module covers how to identify and close intelligence gaps through collection planning, how to apply Heuer's Analysis of Competing Hypotheses (ACH) with a worked matrix, how to use a key assumptions check, devil's advocacy and introductory red team analysis, how to recognise and mitigate cognitive biases, and how to express judgements with estimative language and confidence in line with widely used analytic standards (ICD 203).

Prerequisites: the four earlier paths of the Threat Intelligence Analyst career path, and module 1 of this path.

Measurable outcomes. After this module you can:
- Turn a requirement into a collection plan that names the gap, the indicator, the source, the owner and the deadline.
- Build and score an ACH matrix, identify non-diagnostic evidence and test sensitivity to key items.
- Run a key assumptions check and explain when devil's advocacy or red team analysis is appropriate.
- Name five common cognitive biases in CTI work and a practical mitigation for each.
- Write judgements that keep likelihood and confidence distinct and justify both.

Practical completion objective: complete the lab by scoring an ACH matrix for a fictional data leak, running a sensitivity check, and writing an assessment with calibrated likelihood and confidence.

## Lessons

1. Intelligence Gaps and Collection Planning (16 min)
2. Analysis of Competing Hypotheses (20 min)
3. Challenging Analysis: Key Assumptions, Devil's Advocacy and Red Team Analysis (16 min)
4. Cognitive Biases and Their Mitigations (16 min)
5. Estimative Language and Confidence (18 min)
6. Lab: ACH on a Disputed Patient Data Leak (45 min)

## Related

- [Learning path: Advanced Intelligence Analysis and Reporting](https://codelivly.com/learning-paths/cti-advanced-analysis-reporting)
- [All rooms](https://codelivly.com/rooms)