Adversary Targeting Structured Targeting Methodology for Cyber Counter-Intelligence
Adversary targeting is the structured methodology for building target packages — comprehensive characterizations of specific adversary entities (organizations, networks, individuals) that support both intelligence production and authorized operational action. Without a structured targeting methodology, CI work produces scattered observations that never cohere into actionable packages. With one, individual adversary observations roll up into target packages that drive collection planning, support decision-makers, and close out as actionable.
This course covers adversary targeting methodology for cyber counter-intelligence — target package construction, F3EAD applied to adversary characterization, integration with the collection-discipline band, and the tradecraft that turns individual adversary observations into operationally coherent packages. Entry-tier of the CI-tradecraft band at $299 and the natural starting point for analysts building structured CI capability.
What You'll Learn
Adversary targeting methodology for cyber counter-intelligence
- Target Package Construction — the structured documentation framework that captures comprehensive adversary characterization: identification, capability, intent, infrastructure, operational history, behavioral indicators, and the analytic-grade dossier that supports both intelligence production and authorized operational decisions.
- F3EAD Applied to Adversary Characterization — Find, Fix, Finish, Exploit, Analyze, Disseminate as the operational targeting loop. Adaptation of the IC and special-operations framework for cyber-domain adversary targeting where "Fix" and "Finish" have different operational meaning than in kinetic contexts.
- Multi-Source Target Development — building target packages from OSINT, technical telemetry, persona-based engagement, behavioral profiling, and ALL-SOURCE integration. The integration tradecraft that turns scattered observations into coherent packages.
- Targeting-Collection Integration — how adversary targeting drives collection planning and how collected information feeds back into target package refinement. The closing-the-loop discipline that connects Collection Management to target development.
- Behavioral Profile Integration — how the behavioral-profiling toolkit (Dark Triad, Big Five, MBTI, Seven Radicals, Cialdini) integrates into target packages for adversary individuals and group leaders. Operator characterization that supports both prediction and engagement planning.
- Package Maintenance Discipline — target packages are living documents. The operational discipline for refresh cadence, version control, multi-analyst handoff, and the working pattern that keeps target packages useful over multi-quarter campaigns rather than letting them decay into reference relics.
Course Content
Turning Adversary Observations into Operationally Coherent Packages
Adversary targeting sits at the operational intersection of counter-intelligence, threat intelligence, and operations planning. The discipline emerged from IC and special-operations practice and adapts naturally to cyber-domain CI work. The basic operational logic is the same: identify the adversary entity, characterize its capability and intent comprehensively, integrate observations from all available sources into a structured target package, drive collection against gaps, refine the package iteratively, and produce intelligence and authorized operational action grounded in the package. The cyber-domain calibration is in the specifics — what "infrastructure" means for a cyber adversary, how technical telemetry feeds into capability characterization, how persona-based engagement contributes to intent assessment, and how the F3EAD loop's "Finish" step translates from kinetic to cyber operational contexts.
This course operationalizes adversary targeting methodology for cyber counter-intelligence work specifically — target package construction calibrated to cyber adversary entities, F3EAD adapted for cyber-domain loops, multi-source target development across OSINT / technical / persona-based / behavioral inputs, and integration with the broader CI curriculum (behavioral profiling, persona work, elicitation methods) and the collection-discipline courses. At $299 this is the entry-tier of the CI-tradecraft band, accessible as standalone introduction or as on-ramp to the broader CI curriculum.
Included in Advanced Topics in Cyber Intelligence
This Adversary Targeting course is included in the Advanced Topics in Cyber Intelligence bundle ($7,799, 24 courses), with Collection Management, Intelligence Requirements, Stakeholder Analysis, and the wider analytic and cognitive-warfare catalog. At $299 it is the most accessible entry into the CI-tradecraft courses, and it pairs operationally with Insider Threats & Elicitation Methods ($999) and Personas / OPSEC ($499), both included in The CounterIntelligence Stack ($9,699).
Common Questions
Adversary Targeting — FAQ
Counter-intelligence analysts building target packages on adversary entities, cyber threat intelligence professionals working sustained adversary characterization, IC analysts in CI portfolios, security operations leaders integrating adversary targeting with broader CTI work, authorized red-team operators planning engagement against specific targets, and analytic methodology trainees building the CI-tradecraft discipline.
Generic threat-actor profiling produces descriptive characterization. Adversary targeting produces structured target packages that drive operational action — collection planning, intelligence production, and authorized engagement. The package construction methodology, F3EAD loop integration, and multi-source development tradecraft distinguish targeting from descriptive profiling. The two are complementary; targeting builds on profiling to produce operationally actionable packages.
At $299 this course is the most accessible entry into the CI-tradecraft band. The pricing reflects focused scope — it covers the targeting methodology itself rather than the broader CI tradecraft. The other CI-tradecraft components (Insider Threats & Elicitation Methods at $999, Personas / OPSEC at $499) expand the discipline laterally. Most learners benefit from the full CI-tradecraft band combination.
None formal. Most learners benefit from the behavioral-profiling courses for adversary characterization, the other CI-tradecraft courses for full-band coverage, and the collection-discipline courses for the operational integration angle.
Yes. It is included in the Advanced Topics in Cyber Intelligence bundle ($7,799, 24 courses). It is also sold individually.
Treadstone 71 has worked adversary targeting methodology applied to cyber counter-intelligence continuously since 2002 — target package construction across nation-state, criminal, ideological, and insider adversary entities; F3EAD adapted for cyber-domain operational loops; multi-source target development integrating OSINT, technical telemetry, persona-based engagement, and behavioral profiling. The course reflects two decades of operational targeting practice across financial services, defense industrial base, federal civilian agencies, MSSP and consulting practices, and critical infrastructure operators. Woman-owned, veteran-led, NICCS-listed, IAFIE-aligned.
Turn Scattered Observations into Coherent Packages
Self-paced. Intermediate-level. Adversary targeting methodology, target package construction, F3EAD applied to cyber CI. Entry-tier of the CI-tradecraft band. Scroll up to enroll, or consider the Advanced Topics in Cyber Intelligence bundle, which includes this course.
$299 USD Self-paced · Intermediate · Lifetime access · CPE credits