Your quarterly threat intelligence products are read and praised but change nothing — how do you fix that?

## The honest measure An intelligence function that measures itself by output — reports published, feeds ingested, briefings delivered — will optimise for output, because that is what people do with measures. The only measure that reflects why the function exists is **decisions named and their disposition recorded**. Not decisions *taken*: you do not control that, and a function graded on getting its way learns to only recommend things that will be approved. What you control is that every product names a decision, reaches someone with the authority to take it, and gets an answer. So the instrument is small: each product ends with one recommendation, one named owner, one date. You keep a register. Weeks later each entry carries a disposition — **taken**, **refused with risk accepted**, **deferred to a date**, or **no response**. The first three are all successes of the product; the fourth is the failure this question is about. ## Refusal is not failure This is the part that is hard to internalise. You write a note saying an extortion crew hitting retailers has abandoned encryption and now steals and publishes, that the merchandising file share is exactly the asset that model monetises, and you ask the divisional VP to fund volume monitoring on it. He says no — the share is being decommissioned next year, and he would rather spend the money accelerating that. **That is the system working.** A risk owner made an informed decision with the risk in front of him. Record it, note the assumption it rests on, and diarise a check that the decommissioning is actually happening. The outcome to fear is the one where he says "very useful, thank you" and nothing appears in any plan. Nobody disagreed with you, and nothing changed, and there is no record of anything to point at. ## Four diagnoses for silence **Wrong reader.** You wrote for a security audience because that is who you talk to, and the person who controls the file share's budget is not in that group. An ask reaches an owner or it does nothing. **Wrong-sized ask for the forum.** A quarterly board risk committee can approve a budget line, accept a risk, or direct that something be done. It cannot design a control, and it will not make a decision it feels under-informed about in fifteen minutes with a technical annex it has not read. Match the ask to what the forum can actually grant, and push the design work to where design happens. **No pre-brief.** If the first time the owner sees the problem is in the meeting, the meeting will end with "let's take that away and look at it", which is the polite form of nothing. Pre-brief the owner so the forum confirms a decision rather than discovering a problem. The meeting is where a decision is ratified, not where it is formed. **Wrong moment.** A funding recommendation that lands two weeks after planning closed has a twelve-month wait built into it, whatever its merits. Intelligence writing has a calendar, and it is the organisation's calendar rather than the adversary's. ## Negotiate the decision before writing The strongest structural change is to stop writing into the void. Before the product exists, go to the owner and ask: what would change your mind about this, and what would you need to see? You often learn that the ask is unfundable for a reason you did not know, that a cheaper control is already planned, or that the evidence they need is different from the evidence you find persuasive. The product then answers a question someone is actually holding. This inverts the usual model, where analysis is produced and then a consumer is sought for it. ## Then stop writing some things Apply the same test to the recurring products. A monthly report that has never named a decision anyone took is consuming analyst time that could go into work someone is waiting for. Cancelling it is a legitimate and underused move, and the honest way to do it is to ask the recipients what they would lose. Sometimes the answer reveals a real use you did not know about; often it reveals nobody has read it in a year. **The willingness to stop producing something is what separates a function that serves decisions from one that serves a publication schedule.** ## What an interviewer is listening for That you distinguish being read from being acted on; that you treat refusal as a recorded outcome rather than a defeat; that you understand a forum's authority and calendar as constraints on the product; and that you would go and ask a consumer what they need rather than inferring it. Candidates who answer this purely by proposing to write better reports have missed the point — the fix is mostly outside the document.