Treadstone 71 Cyber Intelligence Subscription Program

The Cyber Intelligence 12-Month Online Subscription Program is designed to guide organizations in their cyber and threat intelligence program builds through online lectures, demonstrations, and templates covering a wide range of topics. After years of teaching intelligence courses and delivering intelligence programs to clients, Treadstone 71 now offers the subscription-based, automated program guiding clients through the strategic planning process, goals and objectives creation, maturity assessment, SOP development, threat intelligence platform selection, collection planning, intelligence analysis, analytic writing, and dissemination non-inclusively.

The program includes instructional videos tied to content with periodic direct access to Treadstone 71 for client deliverable reviews. The reviews follow a standard cycle including comments, suggestions, recommendations, and examples of previously finished products. Treadstone71 also offers regular ‘professor’ office hours for Q&A.

The program follows proven methods established over the years while creating intelligence programs. Clients move at a regular pace that corresponds with their internal schedules that Treadstone 71 helps to establish with the client. Clients may choose the entire subscription package or choose modules ala-cart. The subscription also includes the standard Cyber Intelligence Tradecraft Certification training and adds a new module assisting clients with the creation of table-top exercises.

An overview of some of the subscription content follows:

  • Strategic Plan development, acceptance, and dissemination
  • Mission
  • Vision
  • Guiding Principles
  • Roles and Responsibilities
  • Goals and Objectives
  • Roadmap
  • Cyber Intelligence Capability Maturity Model Assessment
  • Standard operating procedures
  •               RACI(S)
  •               Process flow diagrams
  •               Associated metrics
  •               Peer Reviews
  • Intelligence Functions
  • Communications, Responsibilities, Methods
  • Practices and Activities
  • Organizational interfaces
  • SOC and IR
  • Other intelligence groups
  • CISO/CSO and CIO
  • C-Suite
  • Department leadership
  • External groups
  •                            Vendors
  • Cyber Intelligence Lifecycle definition
  • Stakeholder Analysis
  • Collection Planning
  • Production
  • Structured analytic techniques
  • Analysis
  • Analytic Writing
  • Reporting and Briefing
  • Dissemination
  • Intelligence Information Sharing
  •               Enterprise objectives
  •               Communities of Interest
  •               Your internal ISAC
  • Threat Intelligence Platforms
  •               RFP and Selection process
  •               Maturation
  •               Vendor data feeds
  • Training and Knowledge Transfer
  •               Cyber Intelligence Tradecraft Certification
  •                            In-person
  •                            8-week online
  • Treadstone 71 Onsite Assessment and Assistance

Clients subscribing to the program create program content undergoing Treadstone 71 review prior to leadership delivery. The intent is to share our vast expertise in cyber intelligence to assist organizations in the timely building of their programs. Clients may choose to extend their program beyond a year or accelerate their program based upon their acceptance of agreed upon assumptions and requirements. Clients have the ability to speed up or slow down their programs throughout the subscription.


We see this model as an effective and efficient way to extend our knowledge, share our standards-based program information while setting up an industry model rooted in intelligence community tradecraft. That tradecraft follows the International Association for Intelligence Education Standards for Intelligence Analyst Initial Training, intelligence community directives (ICDs), content from the Sherman Kent School for Intelligence Analysis and Mercyhurst University as well as boots on the ground experience.

What do you have at the end of the program?

As clients carefully follow the training, timelines, and execute to the deliverables internally, clients will have built a complete cyber threat intelligence program. The program definition, strategy, policies, procedures, process flow diagrams, roles, responsibilities, templates, models, methods, tactics, techniques, reports, dissemination models, briefings, table-top exercises, as well as certified Cyber Intelligence Tradecraft professionals are all core components of the what clients achieve.

Our pricing model will be a fixed price for the core modules with add-on modules priced separately. Treadstone 71 onsite work options will be clear and defined with the ability of clients to purchase onsite and online ‘office hours’ over and above hours provided in the core modules. Clients will have the choice of selecting from several options.

For more information about this new program, contact Treadstone 71 at 888.714.0071 or We will respond to all inquiries as long as they are from corporate and business accounts.

Copyright 2018 Treadstone 71 LLC

2017 Training Courses – Treadstone 71

2017 Training Dates

Main Page to Treadstone 71 Training – 2017

(or on demand including in-house or by location)

Treadstone 71 is working with FS-ISAC for training in London, Singapore, Malaysia, and Australia.

FS-ISAC Sponsored Courses:

Cyber Intelligence Tradecraft Training
3-7 April | Reston, VA
More | Register
Cyber Intelligence Tradecraft Training
8-12 May | London
More | Register
Cyber Intelligence Tradecraft Training
19-23 June | Reston, VA
More | Register
Cyber Intelligence Tradecraft Training
21-25 August | Reston, VA
More | Register

Full Suite of Cyber-Threat Intelligence and Counterintelligence Courses Ready for Global Delivery

Treadstone 71 today announced a full suite of Cyber and Threat Intelligence and CounterIntelligence training courses. The courses drive the expansion of Treadstone 71’s accelerated, academically validated, intelligence training to global markets. Treadstone 71 delivers courses in California, Virginia, Canada, the United Kingdom, and the Netherlands and is set to expand to the Middle East and Asia later this year. (

Treadstone 71 offers a compelling business model that delivers rapid cyber and threat intelligence strategic planning, program build, and targeted training in sectors such as financial services, government, healthcare, energy, and other critical infrastructure verticals. Treadstone 71’s format, curriculum, and instruction model are helping meet critical global demand for cyber and threat intelligence and analysis expertise. Treadstone 71 training provide graduates with an attractive pathway to compensation increases, career progression, and much-needed attention to intelligence. The organization has been teaching cyber intelligence at the Master’s level and commercially for seven years. New courses include a focus on campaign management, the use of Tor, Tails, I2P, and Maltego as well as covering persona development and management. Students create a series of identities, character development, and dimensions, storyline, plot synopsis, story drive and limit, story weaving, applicability, scope, tools to be used, methods of interaction with other identities, engaging secondary characters, refining targeting while developing a campaign to gain street credentials.

“Our courses provide academic instruction combined with real-world, hands-on collection, analysis, analytic writing, dissemination, and briefings that many liken to an apprenticeship,” said Jeff Bardin, Chief Intelligence Officer for Treadstone 71. “Our curriculum follows the teachings of Sherman Kent and Richards Heuer giving students the tools necessary to perform targeted collection, structured analysis while authoring reports modeled after intelligence community standards. We teach methods of cyber infiltration, information and influence operations, counterintelligence strategies, mission based counterintelligence, denial and deception, and counter-denial and deception.”

Treadstone 71 courses are validated and proven by intelligence professionals creating job-ready threat intelligence professionals for global organizations suffering a talent shortage. “Intelligence analysis as an inherently intellectual activity that requires knowledge, judgment, and a degree of intuition,” continued Bardin. “Treadstone 71’s intelligence, counterintelligence, and clandestine cyber HUMINT training and services help organizations transform information into intelligence pertinent to their organization.”

Analysis includes integrating, evaluating, and analyzing all available data — which is often fragmented and even contradictory — and preparing intelligence products. Despite all the attention focused on the operational (collection) side of intelligence, analysis is the core of the process to inform corporate stakeholders. Analysis as more than just describing what is happening and why; identifying a range of opportunities… Intelligence Analysis is the key to making sense of the data and finding opportunities to take action. Analysis expands beyond the technical focus of today providing organizations with core capabilities for business, competitive, cyber, and threat intelligence.

Treadstone 71’s Cyber Intelligence Tradecraft Certification is the gold standard in the industry today derived from both academia and from Treadstone 71’s experience in building cyber intelligence programs at Fortune 500 organizations worldwide.

Treadstone 71

888.714.0071 – osint@treadstone71.com

The Treadstone 71 Cyber Intelligence Program

Treadstone 71 Cyber Intelligence Program – Align with the needs of leadership

Years ago, Treadstone 71 crafted a series of training classes at the Master’s level for students eager to learn about cyber intelligence. Since then, Treadstone 71 continued to hone the courses to current events and organizational needs.  Organizations need training in cyber intelligence. All too often we find a dire lack of understanding outside of collection. Most organizations have staff that are proficient at collecting data well. But the next steps in the cyber intelligence lifecycle is lacking. Our training solves that problem providing students with the tools necessary to organize, produce, analyze and deliver recommendations and opportunities to leadership.

We also found a desire of organizations to assist in the build out of their programs. On several occasions, Treadstone 71 provided oversight and guidance to companies looking to build their own capabilities. Most see significant dollars going to vendors who provide regular reports, but the reports are from a create once –  sell many paradigm. Treadstone 71 teaches you how to fish.

The Treadstone 71 Cyber Intelligence Program includes:

  • Strategic Plan development, acceptance, and dissemination
    • Vision, mission, guiding principles, roles, responsibilities, goals & initiatives
  • Program Plan development, acceptance, dissemination, and implementation
  • Standard Operating Procedures
  • Priority Intelligence Requirement development
    • Passive Intelligence Collection
      • Collection and analysis methods and techniques
    • Organization, Production, Processing – Decomposition
    • Structured Analytic Techniques – Analytic Writing and Dissemination
  • Incident Response
    • Improve and provide feeds for automation
    • Improve detection and response
  • Intelligence Lifecycle Development
  • Threat Intelligence Program Development
      • Improve and provide feeds for automation and remediation
      • Security operations
      • Enhance and improve remediation actions
      • Centralize threat intelligence – Intelligence as a Service – Analysis as a Service
      • Drive improvements to risk management
        • Effective
        • Efficient
    • Improve workflow through well-defined roles and responsibilities
      • People, process and technology enhancements
    • Drive the quality improvements of your intelligence
      • Credibility and relevance
  • Adversaries
    • Who are they?
      • Motivation, intent, capabilities,
      • Dossiers – Baseball cards
  • Attack surface awareness
    • Situational awareness of your attack surface – digital footprint
      • Web – Social Media – Darknet
  • Virtual HUMINT Creation and Management
  • Internet Exposure Assessment – Attack Surface Analysis – Perception Management – Sentiment Analysis
    • Deep Web, Forums, Social Networking, Closed Sites, Darknet
    • Deception Detection and Credibility Analysis
    • Pattern, Trends and Tendency Analysis
  • Competitive Intelligence Assessment and Program Analysis
  • Campaign Analysis with Recommendations and Opportunities
  • Darknet / Deep Web exploration

We also see analysis in organizations, security operations centers and CERTS being performed on a very simplistic level. That level is usually given to the most experienced and most technical person on the team. A method that leads to inherent cognitive bias, a lack of critical thinking and a focus on technology only. This leads to inaccurate information being provided to leadership or information that is very short term and tactical at best – not even actionable intelligence.

Since launching the Cyber Intelligence course, many have asked for the follow-on courses. These courses have been sitting in the wings waiting for organizations to reach the need. That need of moving from a purely defensive posture to a enterprise posture with the proper operational tempo, situational awareness, and targeting. In response to this, Treadstone 71 is now releasing the complete series of courses (Anonymity – Cyber Personas – Social Networking Intelligence – Cyber Intelligence – Cyber Counterintelligence – Cybercrime) wrapped with an opportunity to engage us for full program development.  Treadstone 71 works jointly with your staff to fully understand your priority intelligence requirements, educational needs, strategic and programmatic requirements, and staffing needs to create a program that fits you time frame and needs.  We teach you how to fish.


Most organizations have expend scores of thousands of dollars in security operations 2016-01-26_9-38-51centers, CERTs and other such organizations. This effort needs to be matured into a well-rounded organization moving from purely technical and tactical to a strategic arm providing daily actionable intelligence and methods to counter adversaries in early stages of planning and preparation.

Treadstone 71 Cyber Intelligence Training

Cyber Intelligence Tradecraft Certification (click on the image to the left)

Contact Treadstone 71 now to find out more about this evolutionary model. The program is sound, the training proven and now in its 5th year of use.  888.714.0074

Cyber Intelligence Tradecraft Certification

Program Outline  (July 17-23) Denver 

Program Outline 
CYBINT1 – Collection Methods and Techniques, Collection Planning, PIRs, Collection Process Flow, Collection Tools and Targeting, Alignment with Hunt and Detect Needs, Ties to CSIRT, TTPs, IoCs, Threat Intelligence, Open Source Intelligence, All-Source Intelligence – 1.5 Days (Case Study 1)
CYBINT2 – Organization, Production, and Structured Analytic Techniques, Use of Techniques, Production Management, Critical Thinking, Process Flow, Metrics, Intake forms, and templates – 1 Day (Case Study 2)
CYBINT3 – Types and Methods of Analysis, Decomposition, Recomposition, Methods for Fusion, Case Studies in Analysis, Cognitive Bias, Credibility and Reliability of Sources, Confidence Levels, Analysis of Competing Hypothesis, SOPs, Flow into Hunt, Detect, CSIRT, TTPs, IoCs, Inductive/Abductive/Deductive Reasoning  – 1 Day (Case Study 3)
CYBINT4 – Identifying Your Consumers, Stakeholder Identification, and Analysis, Standing Orders from Leadership, Analytic Writing, BLUF, AIMS, Types of Reports, Product Line Mapping / Report Serialization, and Dissemination, Cyber and Threat Intelligence Program Strategic Plan, Goals, Objectives, Cyber Operations Order (Cyber OPORD). Case Study Presentations 2 Days
Lecture, Hands-on, Apprenticeship, in class exercises, student presentations, analytic products, templates, course material—55-60 CPEs

All Case Studies use all methods, techniques, and tools referenced in the course material. The Case Studies used are straight from the headlines giving students real world experience during the class.


Register for the Denver Course here

The course will run over 6 consecutive days covering a Sunday through the following week with a wrap-up on Friday.  Students are expected to attend each hour of each day since the course is comprehensive with each day building upon the next. Days start at 7 AM and run to 6 PM. Breakfast, lunch, and afternoon snacks/tea are provided. Lunches are usually working lunches. Class minimum is 15 with a maximum of 25.

In addition to the cyber intelligence tradecraft, Treadstone 71 is partnering with Stellar Solutions ( to provide a table top exercise based upon one of the case studies delivered during the course. Former Air Force Major Generals Bio–Larry Wells and Bio–Punch_Moulton  will be on hand to drive this exercise. 

Tentative Dates (Approximate since the course will be 6 days) and Locations so far:

Denver July 17-23  now open for registration

Denver October 16-22

To stay abreast of locations and program information, please email

Students who successfully complete the course will be certified as Cyber Intelligence Tradecraft Professional. 55-60 CPEs awarded for the course. This course is highly specialized following intelligence community tradecraft. You won’t get this at SANS although emulated. If you want tradecraft that lays the foundation for a solid program, education that creates a lasting impact, then this is the course for you. This course started six years ago at Utica College as part of their Master’s program.

CyberIntelTradecraftCertification – SV

Course books and manuals will be provided to students upon accepted enrollment. This course follows traditional intelligence community tradecraft. Treadstone 71 has been teaching cyber intelligence courses in various forms for 5 years. From academic settings and corporate environments to government facilities. Our customers include some of the largest firms in the world many of whom are part of critical infrastructures recognizing the need to learn how to create intelligence ( We support our training with onsite consulting services that teach you how to create a sustainable program aligned to stakeholders. Ultimately, we teach you what most vendors cannot or will not – how to fish for yourself.

Students are evaluated based upon deliverables of each section and the final written project.


Course Fee, Course Lab and Materials Fee (includes books, templates, structured techniques application, etc.).

$5990.00 required 15 days prior to course start. Discounts available

This course combines lecture, research, and hands-on team assignments. Students need to bring a laptop that does not have corporate controls (tablets will not suffice).

How is this course different from the current Treadstone 71 Cyber Intelligence course?

This course provides definitive sections along the intelligence lifecycle that are in-depth. Students are required to demonstrate understanding and use of collection methods using defined targets and target case studies, understanding and applying analytic techniques, when and how to use analytic techniques and analytic types. Students are presented several case studies for analysis, required to use tradecraft methods, and provide written reports in standard analytic format. Students are also required to orally present their deliverables to the class.

(Learn about the Treadstone 71 Cyber Intelligence Development Program)


Who may attend this course?

Treadstone 71 urges organizations to send teams to this training in order to build the foundation of a program built upon standardized intelligence tradecraft. Treadstone 71 will consider all US-based organizations and organizations within NATO countries.

If we want this course to be taught to our organization privately?

Treadstone 71 will teach private courses.

To stay abreast of locations and program information, please email

Blog at

Up ↑

%d bloggers like this: