This must be a common problem in intel spaces where you are presenting evidence to support a hypothesis but you don’t have absolute definitive evidence, and so you need to assert some confidence level other than “certain”. Especially in attribution, I would imagine. So how do you calculate confiden…

“Quantify” is tricky, but we actually touched on this in our own posting guidelines. Big fan of the Admiralty Code for assessing intelligence: [image] Intel Posting Guidelines IFIN What is threat intelligence and what is “cyber news?” It isn’t always immediate…

For individual pieces of information or sources, you have the Admiralty Scale . However, it doesn’t really apply when talking about the confidence level of an analysis or conclusion I can mostly speak about threat intel where we frequently use confidence levels for attribution, and there’s not reall…

I like this a lot. Thank you for sharing. It does beg a question one layer deeper though - how are you defining your attribution hypothesis and other competing hypothesis?

Regarding attribution, I wouldn’t sweat it too much: [image] Why We Won't Release a Threat Actor Taxonomy | IFIN Every intel vendor has their naming scheme. We won't play a pointless game. But if you mean behavioral clustering, you should absolutely be able …

Attribution is just one scope of confidence measuring. What I’m looking for is a way to quantify confidence in a hypothesis-driven case analysis. In particular I am looking for a way to harden an LLM-driven IR investigation because I absolutely do not trust an LLM to just give me a vibe-answer for …

This is not a complete answer, but if we’re looking for a number, I think you have it embedded there somewhat in the way you’ve done the analysis so far. The number of correlating suspicious signals increases the likelihood of malicious activity. This is exactly how EDR heuristics work, albeit noisi…

Ask IFIN: How do you quantify confidence levels?

General

mttaggart (Taggart) August 20, 2026, 3:20pm 2

“Quantify” is tricky, but we actually touched on this in our own posting guidelines. Big fan of the Admiralty Code for assessing intelligence: