Conduct cost/benefit analysis

Leadership conducts a cost/benefit analysis that generates a compelling need for information gathering which triggers a Key Intelligence Toptic (KIT) or Key Intelligence Question (KIQ). For example, an adversary compares the cost of cyber intrusions with the expected benefits from increased intelligence collection on cyber adversaries. [1] [2]

ID: T1226
Sub-techniques:  No sub-techniques
Tactic: Priority Definition Planning
Version: 1.0
Created: 14 December 2017
Last Modified: 05 February 2019


Detectable by Common Defenses (Yes/No/Partial): No

Explanation: Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.

Difficulty for the Adversary

Easy for the Adversary (Yes/No): Yes

Explanation: Normal aspect of adversary planning lifecycle. May not be done by all adversaries.


  1. Mark M. Lowenthal. (n.d.). Ch 4: The Intelligence Process--A Macro Look; Who Does What for Whome?, Intelligence: From Secrets to Policy. Retrieved March 2, 2017.
  1. Jan P. Herring. (1999). Key Intelligence Topics: A Process to Identify and Define Intelligence Needs. Retrieved May 19, 2017.