Antares field dossiers · osint · threat intelligence // osint · threat intel

Chapter 01 — Thinking About Thinking

Why intelligence failures are usually thinking failures — mind-sets, mental models, and why smart analysts still get it wrong.

Note: These are my study notes for Chapter 1 of Psychology of Intelligence Analysis by Richards J. Heuer, Jr. (Center for the Study of Intelligence, CIA, 1999). Everything below is written in my own words, with my own examples. It is a summary and commentary, not a copy of the book. The original is available free from the CIA’s website.

The big idea of the whole book

When an intelligence agency misses something big, the first question people ask is: “Why didn’t we have the information?”

Heuer, who spent decades working with the CIA, gives an uncomfortable answer: most of the time, the information was already there. The failure happened inside the analyst’s head. The facts were collected — but they were understood wrongly.

Think of a jigsaw puzzle. All the pieces are on the table. The analyst still builds the wrong picture, because before starting, he was already sure what the picture “should” look like — so he forced the pieces to fit that idea.

So this book is not about collecting more data. It is about the machine that processes the data: the human mind.

Thinking about thinking

Analysts train for years on what to think about — countries, weapons programs, or in our field, malware families and threat actors. Almost nobody trains them on how they think.

Heuer’s point is simple: the mind is the analyst’s main tool, and every professional checks their tools. A carpenter sharpens his saw. A pilot inspects the aircraft before takeoff. But most analysts never inspect their own thinking process. Chapter 1 asks you to start doing exactly that. There is a fancy word for it — metacognition — but it just means thinking about thinking.

You never see the world directly

Here is the core concept of the chapter: you do not see reality as it is. You see it through a lens built from your past experience, your training, your culture, and your assumptions. Heuer calls this lens a mind-set.

Important: a mind-set is not a character flaw. It is necessary. The real world is far too big and messy for any brain to process raw. The researcher Herbert Simon explained that because the mind is limited, it builds a simplified model of reality and works with the model instead of the real thing.

A simple example: a metro map. It is “wrong” on purpose — the distances are not real, the curves are straightened, and most streets are missing. That is exactly why it works: it is simple enough to use. But try to use a metro map to plan a walk across the city, and you will get lost.

Mental models are the same. They are excellent for the situations they were built from — and quietly dangerous when the situation changes but the model does not.

A threat-intel example: suppose your mental model of an APT group says “they only target banks.” One day their tooling shows up in a hospital network. A locked mind-set will explain the evidence away — “must be a different actor,” “probably a false positive” — because the lens filters out anything that does not fit.

Being smart does not protect you

Maybe the hardest lesson of this chapter: these traps are built into every human brain. Experienced experts fall into them too. Sometimes experts fall harder, because their lens is stronger and they trust it more. So the solution is not “be smarter” or “try harder.”

What actually helps

Heuer’s answer has two parts.

First, awareness. You cannot remove the lens, but you can remember that it is there, and regularly ask yourself: What am I assuming right now? What would the evidence look like if my assumption was wrong?

Second, tools and procedures. Structured techniques force your assumptions into the open and make you consider explanations you would naturally skip. It works like a pilot’s checklist: pilots are highly trained, yet the checklist still catches the mistakes that skill alone misses. The rest of the book builds that checklist for analysts — how perception works, how memory fails, which biases distort judgment, and structured methods like Analysis of Competing Hypotheses (ACH).

Heuer also argues that agencies should invest in this directly: train analysts in how judgment actually works, not only in subject knowledge and report writing.

Chapter 1 in one sentence

The biggest danger to good analysis is not missing data — it is the invisible model inside the analyst’s head that decides what the data is allowed to mean.

Next up: Chapter 02 — Perception: Why Can’t We See What Is There To Be Seen?