Writing Intelligence Assessments That Executives Actually Read

Most CTI reports written for executive audiences fail in the first paragraph. The analyst opens with context. The executive wanted the conclusion. The analyst lays out the chronology. The executive wanted the implication. By the time the report's central claim arrives on page three, the executive has moved on.

The fix is not better writing in the colloquial sense. It is a different structural choice. The structure most professional communicators use to brief senior decision makers is sometimes called the Pyramid Principle. The name is from Barbara Minto, but the practice predates and outlives any one framework. Once you see the shape, you cannot unsee it.

This post is about how to use the structure for cyber threat intelligence assessments specifically.

The shape of a Pyramid report

A report built on the Pyramid Principle starts with the answer and works down toward the evidence. It has three levels.

The top level is one sentence. The single most important thing the audience needs to know. Not the topic. The conclusion. If the report had to be one sentence, this would be it.

The middle level is three to five supporting claims. Each one stands on its own and contributes to the top sentence. Each one is itself a complete thought, not a heading. If the audience reads only the middle level, they have the argument.

The bottom level is the evidence. For each supporting claim, the data, the reasoning, and the qualifications. The bottom level is where the analyst's craft lives. It is also where the executive may or may not read, depending on how much of the middle level they accept.

The shape is opposite to the chronological or evidentiary order in which the analyst built the assessment. That is the discipline. The reader does not need to follow the analyst's process. The reader needs to receive the conclusion in a form they can act on.

A worked example

Suppose the assessment is about ransomware risk in the company's sector for the next quarter. Here is the same assessment in two shapes.

The chronological shape. The team reviewed twelve ransomware operator leak sites over the last sixty days. The team observed an increase in posts targeting peer organizations. The team analyzed the operator profiles and their stated targeting rules. The team compared the operator profiles to the company's exposure. Based on the analysis the team assesses with moderate confidence that the company has elevated risk in the next quarter from two specific operators.

The Pyramid shape. We assess with moderate confidence that the company faces elevated ransomware risk in the next quarter from two specific operators, and we recommend three actions before the end of this month. First, the company's sector has seen a thirty percent increase in leak site posts in the last sixty days, and the two operators driving the increase fit the company's profile. Second, our current controls leave two gaps that match the operators' known initial access patterns. Third, the recommended actions reduce the risk window from weeks to days without major project work. The supporting analysis follows.

Both shapes contain the same information. Only the second one gets read. Only the second one gets acted on in a thirty minute meeting.

Common failures and how to fix them

The most common failure is opening with what the team did instead of what the team concluded. The team conducted a review. The team analyzed. The team observed. None of these are conclusions. The executive does not care what the team did. The executive cares what is true and what to do.

The fix is to open the report with the conclusion and to move the method into a clearly marked methodology section near the end. The executive who needs to verify the method can find it. The executive who trusts the team's process can skip it.

The second most common failure is treating uncertainty as a reason to soften the conclusion. The team assesses, with caveats, possibly, that something may be the case. This sentence carries no information. The reader cannot tell what the team actually believes.

The fix is to state the conclusion with a specific confidence level and a specific scope. We assess with moderate confidence, defined as roughly fifty to seventy percent likely, that two specific operators pose elevated risk to the company in the next quarter. This sentence is honest about uncertainty and still actionable.

The third most common failure is using passive voice to avoid attribution. The infrastructure was observed. The technique was assessed. The recommendation was made by whom. The reader loses track of who is claiming what and on what authority.

The fix is to write in the active voice as a team. We observed. We assess. We recommend. The collective subject is correct. It also forces the analyst to own the claim.

Recommendations are part of the report

A CTI assessment that does not include recommendations is a research paper. It may be excellent. It is not an assessment. An assessment exists to drive a decision.

Three rules on recommendations.

Recommend specific actions, not general postures. Patch this. Rotate these credentials. Enable this control. Block this category. Not improve cyber hygiene. The executive cannot act on the second.

Tie each recommendation to a cost and a timeline. The executive needs to know what the action costs in money, time, and disruption, and when it has to be done. A recommendation without a cost is a wish.

Mark the recommendations clearly and put them near the top. The executive's eye goes to the bold text. Use that. Do not bury the recommendations in the appendix.

Length, format, and the inverted pyramid

A typical executive intelligence assessment is two pages, plus an appendix that can be any length. The first page is the Pyramid top. The conclusion, the supporting claims, the recommendations. The second page is the most important pieces of evidence. The appendix is the full analysis.

This shape lets the executive read for two minutes, five minutes, or thirty minutes depending on their time. It also lets the analyst preserve the full reasoning for the audiences who need it. Detection engineers, peer analysts, auditors, and the team's future self all read deeper than the executive does. Build for all of them.

A reasonable visual budget per page is one chart or one diagram. More than that and the reader is decoding visuals instead of reading. A chart should communicate one thing. If the chart needs a paragraph of caption to explain, it is the wrong chart.

The verbal briefing is the same shape

When the report becomes a verbal briefing, the shape does not change. The first sentence out of the analyst's mouth is the conclusion. The next three sentences are the supporting claims. The next minute is the recommendations. Then the analyst stops and asks for questions.

Most analysts find this uncomfortable on the first try. Years of writing have trained them to build to a conclusion. The discipline of leading with the conclusion takes a few practiced briefings to internalize. Once it does, the briefings get shorter, the questions get sharper, and the decisions get made in the room.

What to do when the executive disagrees

A well structured assessment that ends in disagreement is still a success. The executive heard the conclusion and the reasoning, weighed it against information the analyst does not have, and made a different call. That is how decision making is supposed to work.

What you do not want is a well structured assessment that ends in confusion. The executive heard a recommendation but cannot tell what the team actually believed, what the confidence level was, or what the cost of inaction is. That outcome is on the analyst, not the executive.

Two practices help. First, write down the disagreement and the executive's reasoning in the meeting notes. The next assessment on the same topic can engage with the actual disagreement instead of producing the same paper again. Second, agree in advance on the triggers that would reopen the decision. If we observe X, we revisit. If the cost of action drops below Y, we revisit. This converts disagreement into a future commitment instead of leaving it as a permanent stalemate.

The point

Executive intelligence assessments fail when the analyst builds to a conclusion instead of leading with one. Use the Pyramid Principle. One sentence conclusion. Three to five supporting claims. Evidence and qualifications below. Include specific recommendations with costs and timelines. Keep the front matter to two pages. Use the same shape for verbal briefings. Engage with disagreement honestly and capture what would change the call. Done that way, the team's analytic work earns the seat at the table that the work deserves.