Threat Intelligence

Colonel John Hughes-Wilson's case studies — Barbarossa, Pearl Harbor, Tet, Yom Kippur, the Falklands — argue that intelligence rarely fails at collection. It fails at dissemination, reception and institutional incentive.

The definitive account of Stuxnet, read here as an operational case study: how attackers crossed an air gap, borrowed trusted credentials, and made a control room see normal.

A documentary history of the NSA built from declassified paper. Aid's real subject is the gap between what an organization collects and what it actually understands.

How Britain moved American opinion in wartime Washington through dinner parties, patrons and placed stories — a study in influence operations that needed no burglary, only access.

A vice president's unapologetic account of four decades in power, read not as settled history but as one participant's contested testimony about deciding under extreme uncertainty.

A security studies professor traces thirty years of Western self-overestimation, from post-Cold War triumphalism to today's disorder, and asks what a more honest foreign policy would look like.

A general and a historian survey seventy years of war and find the same failure repeated: leaders who misread a conflict at the outset and never adapt.

Ric Prado ended as chief of operations in the CIA's Bin Laden unit. Strip out the biography and what remains is method: how trust is tested, and how operations are built to survive failure.

A former Director of GCHQ sets out the four-part method analysts use under uncertainty: situational awareness, explanation, estimation, strategic notice. Our review of why due diligence needs all four.

Two German volumes on cyber conflict, written from Berlin rather than Washington. Gaycken's argument: for European industry the threat is patient theft of technical intellectual property, not spectacular disruption.

The former NSA and CIA director on what happens when shared facts break down. We read it for the corporate lesson: confusion as an objective, credibility as a depleting asset.

Gavin de Becker spent a career predicting violence. His argument: the unease you cannot yet explain is data. Our review: pre-incident indicators, manufactured trust, and what they mean for diligence.

Fred Kaplan's history of cyber warfare finds the threat was foreseen almost immediately and repeatedly deprioritized. Your organization probably has its own version of that pattern in a filing cabinet.

A seventy-five-cent accounting error at Berkeley in 1986 led Clifford Stoll to a KGB-linked intruder. The founding text of intrusion investigation, and still the best argument against ignoring small anomalies.