Chapter 2

The Research Cycle: Hypothesis → Collection → Verification → Correlation

The Intelligence Cycle, the NATO Admiralty code, thinking like an adversary, and the core hypothesis-driven loop.

Whether you're doing corporate due diligence, journalism, or a personal project, your work follows a cycle — usually without you noticing. Learning it explicitly is valuable because it shows you exactly where investigations usually fail: almost never in Collection (the part everyone wants to do), almost always in Planning or Analysis.

2.1 The Intelligence Cycle

1. Planning & Direction — what question are you actually trying to answer, and for whom? An investigation without a clear question turns into an endless, directionless pile of data.
2. Collection — targeted, disciplined gathering of public data that can prove or disprove your hypothesis.
3. Processing & Evaluation — cleaning, translating, decoding, and — critically — judging how reliable each source and each piece of data actually is.
4. Analysis & Production — what does the data actually mean, and why should anyone care?
5. Dissemination & Consumption — delivering the finding in a form the recipient can actually use, and feeding their reaction back into the cycle.

In practice the cycle is messy. Most analysts don't wait for perfectly clear direction before they start collecting — a better mental model treats Planning and Collection as running in parallel, constantly revising the question as you learn more. This is called scoping: refocusing and narrowing an investigation as it develops, so you don't waste weeks chasing the wrong thing.

Rating reliability: the NATO Admiralty Code

Here's a tool that most introductory OSINT material skips entirely, even though it's standard practice in the intelligence community: the NATO Admiralty Code. It's a two-part grade — one letter (A through F) for how reliable the source is, and one number (1 through 6) for how credible the specific piece of information is.

Source Reliability	Information Credibility
A — Completely reliable	1 — Confirmed
B — Usually reliable	2 — Probably true
C — Fairly reliable	3 — Possibly true
D — Not usually reliable	4 — Doubtful
E — Unreliable	5 — Improbable
F — Cannot be judged	6 — Cannot be judged

A finding graded "B2" (a usually-reliable source, probably true) tells the reader far more than a flat "we found that..." — it communicates exactly how much confidence to place in it. We'll come back to this in Chapter 15 when we talk about report writing.

Data enrichment

Enrichment means combining your open-source findings with additional, authorized sources — internal databases, paid lookup services — to fill gaps. Example: a fraud analyst has only one lead, an email address. Running it through internal fraud databases and an OSINT lookup tool that automates the discovery of linked accounts reveals that the address is active, appears in several credential breaches, and shows up in posts on a hacking forum. None of that comes from the initial search alone — it comes from deliberately enriching the one data point you started with.

2.2 Thinking Like the Adversary

Before you assess anyone's security or exposure, put yourself in the attacker's shoes. A useful mental exercise: imagine four houses on a street and ask yourself which one a burglar would target first — which has the fewest obstacles, the best cover, the biggest potential payoff? A cyber attacker runs the same cost-benefit calculation a burglar does. If a company or a person leaves the "front door" open — an exposed file, a weak password, forgotten infrastructure — that's where an attacker goes, not toward the more tempting but well-guarded target.

As an OSINT researcher, this mindset makes your work sharper. Instead of just cataloguing what you find, you start asking "if I were the adversary, what's the first thing I'd exploit here?" — and that turns a flat list of findings into something genuinely useful for a decision-maker. One practical technique: sketch a quick "card" for a plausible attacker — their motive, their skills, their resources. We'll build this out into a full threat-modeling technique in Chapter 14.

2.3 The OSINT Mindset: Hypothesis → Collection → Verification → Correlation

This is the core loop you'll see repeated in every technical chapter that follows. Amateurs start with tools. Professionals start with questions.

1. Hypothesis — form a clear, falsifiable theory. Not "let's search for this person online" but "if this person is running an illicit crypto operation, they'll have technical infrastructure linked to their public identity."
2. Collection — gather data that can specifically confirm or deny the hypothesis, staying passive throughout.
3. Verification — switch into radical skepticism. Every piece of data is assumed corrupted, outdated, or manipulated until you can technically confirm it — check a PDF's metadata, reverse-search a profile photo.
4. Correlation — look for overlapping technical signatures and patterns across completely different platforms. When several independent, verified data points converge on the same conclusion, your hypothesis holds.

If Verification or Correlation breaks your original hypothesis, that's not a failure — you just adjust the theory and run the loop again. This is really the small, everyday version of the bigger Intelligence Cycle above — same shape, different scale — and you'll see it resurface in every technique-focused chapter from here on.