What does bottom line up front mean in a threat intelligence report, and what belongs in it?

## Why the order is the whole technique An intelligence product is not a record of your work. It is an instrument for moving a decision, and it is read by someone whose attention you get for perhaps ninety seconds before they triage it against everything else in their morning. **Bottom line up front** — a discipline borrowed from military staff writing — means the first lines carry the conclusion and the ask, and the supporting material comes after in decreasing order of importance. A reader who stops anywhere still has everything above where they stopped, and everything above is the most important part. ## What the opening must contain Four elements, in roughly this order: 1. **The judgement.** One sentence saying what you now believe to be true, in the active voice, about a named actor or activity. Not "this report examines" — that says nothing. 2. **The so-what for us.** The judgement is about the world; this clause is about our estate. If the crew monetises stolen commercial data and our merchandising file share is exactly that, say so. Without this clause the reader silently supplies "so this is somebody else's problem", and they are usually right to. 3. **The recommendation.** A specific action, not an aspiration. 4. **The owner and the horizon.** Who can actually do it, and by when it matters. A recommendation with no owner is an observation. The rest of the document — the evidence, the cases, the technique detail, the annexes — exists so that a reader who wants to challenge you can. Most will not, and that is fine. ## The so-what clause is the one people drop A report that says a crew is targeting the retail sector is describing the news. A report that says the crew's model depends on bulk access to commercial data, that our merchandising share carries that data, that eleven hundred accounts can read it and nothing watches how much any of them takes, is describing us. The second one gets funded. The evidence for both is identical; the difference is a sentence of analysis the author had to be willing to commit to. ## Recommendations that are not recommendations `Continue to monitor` is the most common non-recommendation in intelligence writing. It names no decision, no owner and no change, so nothing happens and nobody can tell that nothing happened. If monitoring genuinely is the answer, make it real: say what would change the judgement, who is watching for it, and when you will revisit. Similar empty forms: `raise awareness`, `consider reviewing`, `ensure controls are adequate`. Each of them survives the meeting precisely because nobody can refuse them. **A recommendation an owner can refuse is a good recommendation.** Refusal means the ask was concrete enough to have a cost, and a documented refusal with the risk stated is a real outcome. An ask so soft it cannot be refused produces nothing you can point at later. ## Length is set by the forum, not by the evidence If your slot is fifteen minutes at a quarterly risk committee, the note is a page. That is not a compromise on rigour; it is the constraint the product exists inside. The evidence goes into annexes for the person who asks. Writing six pages because you have six pages of research is writing for yourself. ## What good looks like in the room A well-formed opening lets a reader who never gets past it repeat your conclusion accurately to someone else and know what they are being asked to do. That is the test. If the first paragraph could be deleted without changing what the reader can do, you have written a preface rather than a bottom line. ## Common structural traps - **Burying the judgement inside the evidence** so it reads as an inference the reader should draw themselves. They will not draw it, and if they do they will draw a different one. - **Leading with sourcing.** How you know matters and belongs in the body; it is not the point of the document. - **Hedging by deferral** — pushing an uncomfortable conclusion to the end so it feels less exposed. If you are not confident, say what you believe and how strongly in the same breath, up front. - **Ending on the recommendation** as a rhetorical climax. That is essay structure. Your reader is not reading an essay.