Cyber Threat Intelligence Planning

Cyber threat intelligence has a discipline problem. Analysts are asked to make high-stakes judgments about adversary intent and capability, yet the field still lacks the structured, repeatable tradecraft that other intelligence disciplines have relied on for decades. Cyber Threat Intelligence Planning: A Special Forces Approach closes that gap by bringing battle-tested U.S. Army Special Forces and intelligence doctrine into civilian CTI practice.

Drawing on the Military Decision-Making Process (MDMP) and Intelligence Preparation of the Operational Environment (IPOE), authors Christopher Ruel, a U.S. Army Special Forces veteran, and Ivan "Ajay" Menendez translate planning frameworks built for the battlefield into a rigorous methodology for identifying, assessing, and countering cyber adversaries. Rather than treating threat intelligence as an ad hoc collection of indicators and feeds, the book reframes it as a formal planning cycle: mission analysis, adversary courses of action, red-teaming assumptions, and decision-focused reporting that gives leadership what it actually needs to act.

The book grounds this Special Forces planning methodology in the standards civilian practitioners already work within, mapping its approach to the NIST NICE Workforce Framework for Cybersecurity and NIST Cybersecurity Framework (CSF) 2.0. The result is a methodology that is doctrinally sound and immediately usable inside existing security operations, GRC, and workforce-development programs.

Written for CTI analysts, SOC leads, threat hunters, security program managers, and students in cybersecurity and intelligence studies, the book combines conceptual grounding with practical exercises, giving readers a repeatable planning process rather than a one-off case study. It is as much a workforce-development tool as an analytic one, useful for training new analysts, standardizing team tradecraft, and building intelligence functions that can withstand scrutiny.

At its core, the book makes an argument that has been overdue in the field: Cyber Threat Intelligence will not mature as a discipline until it adopts the same planning rigor that Special Forces intelligence work has always demanded. Cyber Threat Intelligence Planning offers the field-proven structure to get there.