Homework — Lesson 02
Two short tasks · ~25 minutes · Bring your answers to Day 2
Task 1 — Three questions before a feed drives action
Write the three questions you would require your team to answer before any threat-intelligence feed or report is allowed to trigger a costly action (a public statement, an emergency spend, a system shutdown). For each question, say what a bad answer would look like.
✓ Self-check: your questions force the distinction between evidence and inference and demand a stated confidence level.
Task 2 — Audit one real feed for theatre
Pick one intelligence product your organisation actually receives. Rate it honestly against the four theatre warning signs from the lesson (no prioritisation; never changes a decision; confident attribution without basis; volume metrics). Decide: keep, fix, or cancel — and write one line justifying it.
✓ Self-check: you reached an explicit keep/fix/cancel decision tied to whether the feed changes any decision.
Task 3 (optional) — Catch your own confirmation bias
Recall one time an attribution or threat claim was accepted in your organisation partly because it matched what people already believed. What would have caught it?
✓ Self-check: you identified a specific check (not just "be more careful") that would have surfaced the bias.