Interview question
What is F3EAD, and why do some CTI teams prefer it to the traditional intelligence cycle?
F3EAD comes up because it fixes the intelligence cycle's weakest joint — the handoff between analysis and operations.
What a strong answer covers
- Expands the acronym correctly: Find, Fix, Finish, Exploit, Analyse, Disseminate.
- Identifies the split — Find/Fix/Finish is operations, Exploit/Analyse/Disseminate is intelligence.
- Explains the advantage: it makes the intelligence-operations handoff explicit rather than implicit.
- Names the failure it prevents — an incident is remediated and nothing durable is learned because nobody owned the Exploit step.
- Applies it to a concrete CTI or IR situation.
- Notes it originated as a military targeting cycle adapted to cyber use.
- Does not present it as replacing the intelligence cycle so much as tightening one part of it.
Expert answer
F3EAD is Find, Fix, Finish, Exploit, Analyse, Disseminate. It comes from a military targeting cycle and was adapted for cyber operations and intelligence.
The structure that matters is the split down the middle. Find, Fix and Finish are operational: identify the target, pin it down in your environment, and take action — contain, remediate, block. Exploit, Analyse and Disseminate are intelligence: mine what the operation produced, turn it into assessment, and push it back out so it drives the next Find.
Teams prefer it to the plain intelligence cycle because the traditional cycle is weakest exactly where F3EAD is strongest. The classic cycle describes dissemination and feedback, but in practice the joint between intelligence and operations is where things fall apart, and the cycle does not name it. F3EAD does, by putting both halves in one loop with an explicit handoff.
The specific failure it prevents is the common one: an incident gets remediated, everyone is relieved, the ticket closes, and nothing durable is learned. The forensic artefacts, the samples, the infrastructure, the credentials used — all of that is Exploit material, and if nobody owns that step it evaporates. Naming Exploit as a phase with an owner is what stops that.
Concretely: we detect a compromised host beaconing out. Find is identifying the activity, Fix is scoping which hosts and accounts are affected, Finish is containment and remediation. Exploit is collecting the memory image, the sample, the C2 configuration and the authentication logs. Analyse is turning that into a TTP profile and an assessment of what the actor was after. Disseminate is the detection rules that go to engineering, the hunt hypotheses that go to the hunters, and the report that goes to leadership — which then feeds the next Find.
I would not say it replaces the intelligence cycle. It tightens one part of it, and it is more natural to use in an organisation where intelligence sits close to IR.
Mistakes that cost candidates points
- Getting the acronym wrong or missing the Exploit phase.
- Not identifying which phases are operational and which are intelligence.
- Describing it abstractly with no worked application.
- Claiming it replaces the intelligence cycle entirely.
You have read the answer, which is the easy part. Answer it in your own words and get graded against this same rubric, with the follow-up probe an interviewer would ask next.
Go deeper
Related questions
- Explain the difference between tactical, operational and strategic threat intelligence, with an example of each.
- On the same morning: a new critical vulnerability is being exploited in the wild, the CISO wants a board paper by Friday, and IR needs support on a live case. You cannot do all three. How do you decide?
- You are the first intelligence hire at a company with a working SOC but no CTI function. What do you do in your first 90 days?
- Your CISO says "I want to know about ransomware." Turn that into something you can actually collect against.
- How do the Diamond Model, the Cyber Kill Chain and MITRE ATT&CK relate to each other? Do they compete?