How I rate things
contents
The research pages use three scales. They’re the standard ones, borrowed from US intelligence analytic standards (ICD 203) and the NATO Admiralty system, because inventing my own would just give you something else to decode.
Confidence: how good the evidence is #
| Level | What it means |
|---|---|
| High | Well-corroborated information from reliable sources, few assumptions, nothing seriously in conflict. Still not certainty. |
| Moderate | Credible and plausible, but not corroborated well enough for high, or resting on several assumptions. |
| Low | Thin, fragmented or poorly corroborated. Worth tracking, not worth acting on by itself. |
Confidence goes on judgments: who did it, why, what’s connected, what happens next. Facts don’t get a confidence label; they get a source. The Confidence field at the top of an Intel page is my confidence in that page’s main assessment.
Likelihood: how probable something is #
| Term | Probability |
|---|---|
| almost no chance | 1–5% |
| very unlikely | 5–20% |
| unlikely | 20–45% |
| roughly even chance | 45–55% |
| likely | 55–80% |
| very likely | 80–95% |
| almost certain | 95–99% |
The first time a page uses one of these, it gives the range. I never put a confidence level and a likelihood term in the same sentence, because they answer different questions.
Source grades #
Every source gets a letter for how reliable the source is and a number for how believable this particular piece of information is.
| Reliability of the source | Credibility of the information | ||
|---|---|---|---|
| A | Completely reliable | 1 | Confirmed by an independent source |
| B | Usually reliable | 2 | Probably true |
| C | Fairly reliable | 3 | Possibly true |
| D | Not usually reliable | 4 | Doubtful |
| E | Unreliable | 5 | Improbable |
| F | Can’t be judged | 6 | Truth can’t be judged |
My own analysis of a sample is A for reliability. Its credibility depends on corroboration, and two methods applied to the same file corroborate each other but are not independent sources. Vendor and research reports are usually B. Forum posts and victim reports are usually F until they check out.
How I know something #
Findings are labelled by how they were established: static (read out of the code, which shows what it’s built to do), lab (seen when the sample ran in an isolated test environment, which shows what it does when it runs), or reported (someone else said it, credited). None of those says what happened on any particular victim’s machine.