Lab Guide — Critical Read of a Threat Report
Facilitated exercise · 40 minutes · Worksheet-based
What this lab is
Participants read a short, fictional and sanitised cyber-threat-intelligence report and separate its evidence from its inference, then judge how much weight its attribution claim can bear. No real report, organisation, or actor is used.
The report excerpt (fictional)
"On 14 March, a phishing domain impersonating a well-known logistics provider was registered and used within 72 hours against three organisations in the energy sector. The malware deployed is a variant of a publicly documented toolkit. Command-and-control activity occurred predominantly between 06:00 and 15:00 UTC. We assess with high confidence that this campaign was conducted by a state-sponsored actor, Group Vega, operating on behalf of a foreign government, as part of a premeditated operation to disrupt regional energy supply."
Step 1 — Split the excerpt (individually, 8 min)
Draw two columns. Place every clause into Evidence (observed) or Inference (concluded).
Prompt
Be ruthless: "well-known logistics provider," "high confidence," "on behalf of a foreign government," and "to disrupt regional energy supply" are not all the same kind of statement. Which are observed, which are concluded, and which are pure assertion?
Step 2 — Weigh the attribution (pairs, 10 min)
Prompt
The report claims "high confidence." On the evidence given, is that justified? Identify at least two ways the attribution could be wrong (shared toolkit, faked time zone, false flag, borrowed infrastructure). What additional evidence would raise your confidence?
Step 3 — Decide (table, 10 min)
Prompt
You are briefed this report by your team, who recommend a costly public statement attributing the attack. Using the four questions from the lesson, what do you decide — and what do you ask for before deciding?
Debrief
- Compare columns across the room — where did people disagree on evidence vs inference?
- Surface the "high confidence" gap: a confident label resting on shared/forgeable signals.
- Note how the "to disrupt regional energy supply" clause smuggles in intent that nothing in the evidence supports.
✓ Self-check: the table can name at least two specific weaknesses in the attribution and the additional evidence that would address them.