Intelligence Collection Disciplines

---
name: intelligence-collection-disciplines
description: >-
  Run competitive research like an intelligence agency: eight collection disciplines
  (OSINT to MASINT), signal-to-inference chains, and fusion. Use when one-source research
  isn't enough.
slug: intelligence-collection-disciplines
version: 1.1.0
displayName: intelligence-collection-disciplines
---

# Intelligence Collection Disciplines

## Purpose

Stop doing competitive research like a term paper. The intelligence community solved this problem
decades ago: they don't collect "data," they run **collection disciplines** — independent channels,
each with its own sources, tradecraft, and blind spots — and then they *fuse* them. This skill gives
product managers that playbook: eight disciplines, each telling you (1) what to collect, (2) where to
collect it, (3) which signal → inference chains to run, and (4) which PM artifact it feeds
(TAM/SAM/SOM, ICPs, personas, battle cards, roadmap bets, win/loss, positioning, pricing). One signal
is an anecdote; three correlated signals from independent disciplines is intelligence.

## Input

**Works best with** the six instantiation variables below — fill them once and every discipline
becomes engagement-specific. Leave them blank and this stays a teaching artifact.

~~~
[TARGET]      = The competitor, partner, or acquirer you're researching
[MARKET]      = The category and its NAICS/SIC/NACE codes (or nearest equivalent)
[GEOGRAPHY]   = Regions in scope, at COUNTRY level, not continent level
[BUYER]       = Who signs the check (drives review sites, job titles, conferences)
[CAPABILITY]  = The strategic move you suspect (platform play, market entry,
                pricing shift, compliance land-grab, etc.)
[DECISION]    = What this research will change (roadmap bet, positioning,
                pricing, market entry, deal defense, ICP refresh)
~~~

**If [DECISION] is blank, stop. Research without a decision is a hobby.**

Anything supplied with the invocation itself — text after the skill name, a pasted context dump, or an
appended `ARGUMENTS:` line — counts as variables already filled. Use it; don't re-ask.

**Arriving empty-handed? That works too.** Read the disciplines as a course in tradecraft, or ask the
agent to walk the instantiation block with you one variable at a time.

**Example invocation:** `Use intelligence-collection-disciplines — [TARGET]: Meridian Freight Systems,
[CAPABILITY]: suspected move into warehouse robotics, [DECISION]: whether we accelerate our own
integration roadmap.`

## Key Concepts

### The Eight Disciplines

| Discipline | Intel Community Name | Plain English | Primary PM Artifact |
|---|---|---|---|
| 1. OSINT | Open Source Intelligence | Press, social, periodicals, analysts | Battle cards, positioning |
| 2. FININT | Financial Intelligence | Filings, earnings calls, procurement | Battle cards, SOM capture rates |
| 3. GEOINT/DEMOINT | Geospatial & Demographic Intelligence | Census, labor, trade, economic statistics | TAM/SAM/SOM, ICPs, personas |
| 4. TECHINT | Technical Intelligence | Patents, technographics, changelogs | Roadmap bets |
| 5. HUMINT | Human Intelligence | Talent moves, employee chatter, win/loss | Roadmap bets, battle cards |
| 6. SIGINT | Signals Intelligence | Web diffs, pricing changes, job posts | Battle cards, pricing strategy |
| 7. MASINT | Measurement & Signature | Supply chain, ops indicators | Threat assessment |
| 8. All-Source Fusion | n/a | Cross-validation and confidence stacking | Everything above |

- **Independence is the design.** The disciplines matter because they fail differently: a press
  release can lie, but a customs record, a patent filing, and thirty job posts are three separate
  bureaucracies that would all have to be lying in the same direction.
- **Signal → inference chains** are the tradecraft: each observable signal maps to a bounded
  interpretation, labeled per the `autonomous-investigation` protocol (Fact / Inference / Assumption).
- **What this is NOT:** espionage. Every source below is published, filed, posted, or publicly
  observable. See Guardrails in Common Pitfalls.

## Application

### 1. OSINT — The Journalist's Desk

*What a good beat reporter knows before the press release drops.*

Source list: see [`references/source-registry.md`](references/source-registry.md) (fast-changing data, 2026-09-29 snapshot).

**Signal → inference chains:**

- [TARGET] exec suddenly posting about a new problem space → positioning pivot incoming (execs test messaging on social 3-6 months before launch)
- Sponsor tier jump at a [MARKET] conference → market entry or doubling down
- Review complaints clustering on one feature → their roadmap pressure point = your battle card ammo
- Analyst briefing requests (visible via analyst posts) → category creation attempt
- Webinar topics shifting → what they're teaching the market is what they're about to sell
- Sudden silence on a product line → sunset in progress
- Prediction-market odds moving on a regulation or milestone that gates [MARKET] → crowd-priced expectations for scenario planning; treat as a leading indicator of consensus, not ground truth, and check liquidity before trusting the number

**Feeds:** battle cards (objection handling from review mining), positioning (their words vs. customer words gap), win/loss context.

### 2. FININT — The Forensic Accountant

*Follow the money. Companies lie in press releases. They lie less in filings, because lying there is a felony.*

Source list: see [`references/source-registry.md`](references/source-registry.md) (fast-changing data, 2026-09-29 snapshot).

**Signal → inference chains:**

- **Risk Factors section changes year-over-year in an annual filing** → what genuinely scares them (they must disclose it)
- Segment reporting restructure → strategic reprioritization; follow which segment got promoted
- Earnings call Q&A dodges (analysts ask, execs deflect) → soft spot; probe it in your positioning
- New entity registrations or branches in [GEOGRAPHY] → market entry before any announcement
- Deferred revenue trends → actual sales momentum vs. stated momentum
- Merger filings → market definitions and named competitors, straight from [TARGET]'s own lawyers
- Sovereign fund or state-aid money backing [TARGET] → their runway math just changed; discount-pressure plays won't work
- Prior Information Notices and expressions of interest → tenders telegraphed 3-24 months out

**Feeds:** battle cards (financial stress = "they'll be desperate at quarter-end" plays), SOM capture
rates (their revenue ÷ claimed customer count = deal size reality check, feeding the GEOINT/DEMOINT
sizing recipe), account targeting (procurement award patterns).

### 3. GEOINT/DEMOINT — The Cartographer

*The terrain map, not troop movement. Government statistics are free intelligence most PMs never open —
and the backbone of every ICP, persona, and TAM that survives scrutiny.*

Source list: see [`references/source-registry.md`](references/source-registry.md) (fast-changing data, 2026-09-29 snapshot).

**Signal → inference chains:**

- Establishment counts by industry code and employee band → the denominator for bottom-up TAM
- Regional industry concentration → where your SOM actually lives, and where field sales should live
- Occupation growth curves for your [BUYER] roles → is the population you sell to growing or shrinking
- Wage trends in buyer roles → willingness-to-pay ceiling shifts; pricing corridor validation
- Firmographic distributions (size bands, legal forms, sectors) → ICP boundaries drawn from data, not vibes
- Buyer-title prevalence by [GEOGRAPHY] → persona localization; the "VP of Product" you message in Boston is a "Head of Digital" in Frankfurt and may not exist in Riyadh
- Trade-flow shifts in product-specific codes → market entry or supply relocation before any announcement

**The TAM/SAM/SOM Recipe (this discipline's signature dish):**

~~~
TAM: Establishment counts for [MARKET] (Census/NAICS, Eurostat/NACE,
     or national equivalent for [GEOGRAPHY])
     × employment/spend benchmarks (BLS, Eurostat, trade associations)
     (validate against two independent analyst reports; if they disagree by 3x, say so)

SAM: TAM filtered by your actual constraints: [GEOGRAPHY], segment, compliance
     requirements, tech prerequisites (see TECHINT technographics),
     local-content and vendor-registration eligibility where applicable

SOM: SAM × realistic capture rate derived from [TARGET] public filings via FININT
     (their revenue ÷ their claimed customer count = deal size reality check)
~~~

**Feeds:** TAM/SAM/SOM (the backbone — see the market-sizing activity), ICP definition, personas,
messaging localization, market entry prioritization, pricing corridor validation.

### 4. TECHINT — The Patent Examiner

*R&D leaves fingerprints 12-18 months before products ship.*

Source list: see [`references/source-registry.md`](references/source-registry.md) (fast-changing data, 2026-09-29 snapshot).

**Signal → inference chains:**

- Patent **clusters** (5+ filings in one classification in 12 months) → committed bet on [CAPABILITY], not exploration
- Inventor names repeating across filings → the actual product team behind the initiative; track their conference talks and LinkedIn
- Trademark filing for a product-sounding name → launch inside 6-12 months (trademarks are cheap; companies file close to launch)
- [TARGET] repeatedly appearing in funded consortia → their long-range bet, 12-48 months of lead time
- Research pilot sites → likely launch customers, named in public deliverables
- [TARGET] chairing a standards committee → they intend to shape the rules of [MARKET], not just play by them
- [TARGET]-affiliated authors publishing preprints → R&D direction 6-24 months before patents; a paper cluster plus a hiring surge in the same specialty is one of the strongest fusion pairs available
- Author affiliations shifting from university to [TARGET] on successive papers → they hired the lab, not just the idea
- API docs adding endpoints for an unreleased capability → beta program running now
- Your prospects' tech stacks (technographics) → your SAM refinement: who *can* actually buy you

**Feeds:** roadmap bets (where to accelerate vs. concede), SAM refinement, battle cards (feature-gap
countdown clocks), build/buy/partner decisions.

### 5. HUMINT — The Sports Scout

*Organizations announce strategy through job boards long before press releases. People are the tell.*

Source list: see [`references/source-registry.md`](references/source-registry.md) (fast-changing data, 2026-09-29 snapshot).

**Signal → inference chains:**

- Hiring surge in one specialty (30+ postings in a quarter) → building [CAPABILITY], not a feature
- Regional specialist roles appearing for a [GEOGRAPHY] you haven't seen them in → expansion pre-announcement
- Job posts naming specific technologies → confirmed stack choices → integration roadmap intel
- Senior product/tech leader exits within 6 months of a strategy announcement → the strategy is in trouble
- Your own alumni landing at [TARGET] → assume they know your playbook
- Employee reviews mentioning "pivot," "reorg," "leadership churn" → 2 quarters of internal distraction = your window
- Win/Loss interviews: the only source that tells you *why* deals actually close (everything else is inference)

**Feeds:** roadmap bets (their build signals), battle cards (org instability plays), win/loss program
(ground truth for everything).

### 6. SIGINT — The Wiretap You're Allowed to Have

*Companies broadcast constantly through what they change on the public internet. Most competitors never listen.*

Source list: see [`references/source-registry.md`](references/source-registry.md) (fast-changing data, 2026-09-29 snapshot).

**Signal → inference chains:**

- New subdomain SSL cert (e.g., `[capability].[target].com`) → product launch staging, often weeks ahead
- Pricing page removes a tier → packaging overhaul, usually toward enterprise
- Sudden SEM bidding on *your* brand terms → they consider you the threat now (congratulations)
- Case study page pattern shifts (new vertical or [GEOGRAPHY] appearing) → segment push
- Messaging A/B visible via Wayback diffs → they're unsure of positioning; hit the wound

**Feeds:** battle cards (the freshest layer — this is what keeps cards from going stale), pricing
strategy, positioning counter-moves.

### 7. MASINT — The Satellite Photo

*Measure the physical and operational exhaust. Abnormal resource allocation never lies.*

Source list: see [`references/source-registry.md`](references/source-registry.md) (fast-changing data, 2026-09-29 snapshot).

**Signal → inference chains:**

- 20%+ volume change in critical inputs → pre-launch or demand collapse (check which via FININT)
- New supplier geographies or country-of-origin shifts → market entry, tariff hedging, or resilience play
- Compliance certification "in process" listings → 12-36 month runway into a regulated segment, visible to anyone who checks the registry
- Product recalls or repeated safety-alert patterns → quality strain; battle card ammunition with a public citation
- Land allocation, power/water capacity reservations, or engineering-design contracts preceding equipment procurement → facility buildout 6-36 months before any launch announcement
- Support response times stretching + hiring freeze in support roles → cash constraint or overwhelmed by growth (disambiguate via employee sentiment)
- Office consolidations → cost compression; expect pricing aggression to follow

**Note:** supply chain and facility signals are strongest for hardware and industrial players. The
software equivalent is ops capacity plus infrastructure-scale language in job postings.

**Feeds:** threat assessment, launch prediction and capacity estimates, battle cards (capacity-stretch
objections: "ask them about their support SLAs lately").

### 8. All-Source Fusion — The Situation Room

*One signal is an anecdote. Three correlated signals from independent disciplines is intelligence.*

Apply the **Confidence Stacking Rule** from the `autonomous-investigation` protocol: 1 discipline =
watch item; 2 = working hypothesis; 3+ = actionable intelligence; conflicting disciplines = someone is
bluffing — dig. And treat announcements as intent until funding, procurement, land, permits, hiring,
or contracts corroborate them: **ambition is OSINT; commitment shows up in FININT, MASINT, and HUMINT.**

**Fusion template — detecting [TARGET]'s [CAPABILITY] play:**

| Discipline | Signal (fill in what you found) |
|---|---|
| MASINT | Resource/input anomaly: ____ |
| TECHINT | Patent cluster or repo activity: ____ |
| HUMINT | Hiring pattern: ____ |
| SIGINT | Infrastructure or web change: ____ |
| FININT | Filing language, procurement award, or earnings dodge: ____ |
| GEOINT/DEMOINT | Terrain check: does the market they'd enter actually exist at the size the move implies? ____ |

**Fusion verdict:** ____ disciplines, one story → confidence level → recommended response.

**The fusion cadence:**

- **Weekly:** SIGINT sweep (site diffs, pricing, job posts). 30 minutes.
- **Monthly:** OSINT + HUMINT digest. Review mining, employee sentiment, conference intel.
- **Quarterly:** FININT + TECHINT deep pass. Filings, patents, procurement awards.
- **Annual + every TAM refresh:** GEOINT/DEMOINT pass. Statistics releases lag; sizing rot is slow but real.
- **Event-driven:** MASINT alerts, material filings, leadership exits. React within 48 hours.

### Mapping disciplines to PM artifacts

| Artifact | Primary Disciplines | Refresh Cadence |
|---|---|---|
| TAM/SAM/SOM | GEOINT/DEMOINT + FININT (capture rates) + TECHINT (technographics) | Annual, plus event-driven |
| ICPs & Personas | GEOINT/DEMOINT + HUMINT (win/loss ground truth) | Semi-annual |
| Messaging & localization | GEOINT/DEMOINT + OSINT | Semi-annual |
| Battle cards | SIGINT + OSINT + HUMINT (win/loss) | Weekly SIGINT layer, monthly rebuild |
| Roadmap bets | TECHINT + HUMINT | Quarterly |
| Positioning | OSINT + FININT (earnings language) | Semi-annual |
| Pricing strategy | SIGINT + FININT + GEOINT/DEMOINT (wage/WTP corridors) | Event-driven |
| Threat assessment | All-Source Fusion | Quarterly brief + event-driven |

### Regional note

The disciplines do not change across markets; the sources do, and so does the evidentiary burden. Two
lessons that generalize: in rich-disclosure systems (EU), the challenge is finding the right record in
a fragmented landscape — no single portal holds it all. In announcement-heavy markets (MENA), the
challenge is separating national ambition from funded, procured, permitted commitment — and an
announced budget, an approved budget, committed financing, a tender value, and an awarded contract are
five different numbers wearing the same headline. Search in local languages; never assume the English
portal contains every notice.

**Localizing the source tables (e.g., China-market targets):** the discipline and its signal → inference
chains carry over unchanged; swap in the local equivalents per source type — corporate registries
(enterprise-credit/registration lookup platforms in the 企查查/天眼查/QCC class), the national
statistics bureau and its statistical yearbooks in place of Census/Eurostat, local procurement portals
in place of TED/SAM.gov, local job boards and review/community platforms in place of LinkedIn/G2, and
local patent offices (CNIPA) alongside USPTO/EPO. The discipline-specific tables above are the US/EU
baseline; for any other geography, name the local substitute per row before collecting, and apply the
same published-only sourcing bar.

A copy/paste **collection plan** — instantiation variables, discipline-selection table, cadence,
and fusion table — lives in [`template.md`](template.md).

## Examples

**Illustrative fusion fill (all names fictional):** you suspect [TARGET] = Meridian Freight Systems is
building a warehouse-robotics platform. The sweep finds: +20% specialized component orders in customs
records (**MASINT**, Fact), 15 new filings in one robotics patent class (**TECHINT**, Fact), 30+
platform engineers hired in a quarter (**HUMINT**, Fact), a new `robotics.meridianfreight.com` SSL
cert (**SIGINT**, Fact), the CFO dodging an analyst's capex question (**FININT**, Inference), and
establishment counts confirming the addressable segment supports the investment math
(**GEOINT/DEMOINT**, Fact). Six disciplines, one story: high-confidence platform threat. Response:
accelerate your own platform roadmap and arm sales with a maturity battle card *before* their launch,
not after.

**Single-discipline quick win:** your battle card claims a competitor is "financially strong." One
FININT pass finds deferred revenue declining three quarters straight while claimed customer count grew
— **Inference:** deal sizes are shrinking. The card gains a quarter-end discount-pressure play, with
the filing URL attached.

See [`examples/sample.md`](examples/sample.md) for a complete worked collection plan (fictional) —
four disciplines chosen and three consciously skipped, a fusion table that escalates to
actionable, and a June signal that correctly *stayed* a watch item until other channels corroborated.
[`examples/sample-industrial.md`](examples/sample-industrial.md) is the plan where MASINT stars —
customs, registries, permits — and an absence enters the fusion table as a Fact.

## Common Pitfalls

- **Feature-matching theater.** The goal is never "they shipped X so we ship X." Signals inform
  decisions about *outcomes* — "this changes which customer problem wins the next investment."
- **Single-discipline conviction.** A hiring surge alone is a watch item, not a strategy brief.
  Escalate confidence only as independent disciplines corroborate — that's the stacking rule.
- **Announcement inflation.** Re-planning your roadmap around a press release. Ambition is OSINT;
  wait for the money, the permits, or the hires.
- **Unsourced claims.** A battle card assertion without a source and date is an opinion wearing a
  badge. Document provenance on every claim; archive source documents at collection time, because
  portals restructure and files get replaced.
- **Crossing the line.** Pretexting, soliciting NDA-protected information, hiring someone specifically
  to extract their former employer's secrets, scraping against terms you agreed to — all off-limits.
  Everything in this skill is published, filed, posted, or publicly observable. The stage test: if
  you'd be uncomfortable explaining your method at [TARGET]'s user conference, don't use it.
- **Running every discipline on every question.** The artifact-mapping table exists so you run the two
  or three disciplines that feed your [DECISION], on the cadence that matches how fast that evidence
  actually changes.

## When to invoke (trigger summary)

Reach for this skill when **one** of these holds, and it is safe to run with nothing but the six
instantiation variables (all optional, `[DECISION]` strongly recommended):

- One-source research has already produced a claim you cannot act on confidently (a press release, a
  rumor, one review cluster) and you need independent corroboration before spending roadmap or sales
  capital.
- You are about to build a TAM/SAM/SOM, ICP, battle card, or threat assessment and want the
  source-discipline mapping and confidence-stacking rule behind it.
- You are setting up a recurring competitive cadence (weekly/monthly/quarterly) and need the
  discipline-to-cadence schedule.

Not needed when a single well-sourced answer suffices — that is ordinary research; the disciplines pay
for themselves only when being wrong is expensive.

## Failure Exits & Edge Cases

- **`[DECISION]` blank:** do not run the sweep — ask for the decision once ("research without a
  decision is a hobby — what will this change?"); if the user declines, stop after the tradecraft
  walkthrough. No discipline table is produced without it.
- **No network / paywalled sources only:** run the free tiers and public records, mark each
  unsubstantiated row as Assumption, and state in the fusion verdict which disciplines were starved —
  a 1-discipline finding stays a watch item, never a strategy brief.
- **Sources in the wrong region (e.g., US tables, China target):** apply the localization note above
  and name the local substitute per row; do not present US-portal absence as evidence of absence.
- **Empty-handed invocation:** the skill walks the instantiation block one variable at a time; if the
  user answers none, it stays a teaching artifact — say so, and do not fabricate a filled collection
  plan.

## References

- [`autonomous-investigation`](../autonomous-investigation/SKILL.md) (Workflow) — the protocol that
  labels and stacks what these disciplines collect
- Market sizing TAM/SAM/SOM (optional companion activity) — consumes the
  GEOINT/DEMOINT sizing recipe
- [`company-intel`](../company-intel/SKILL.md)
  — single-company deep dives built largely on OSINT + FININT + HUMINT
- Investigation skills that run these disciplines: [`market-landscape-scan`](../market-landscape-scan/SKILL.md),
  [`competitive-research-snapshot`](../competitive-research-snapshot/SKILL.md), [`competitive-intel-watch`](../competitive-intel-watch/SKILL.md), [`battle-card-builder`](../battle-card-builder/SKILL.md)
- SCIP Code of Ethics — the competitive-intelligence profession's reference standard
- Regional Source Overlays (EU/MENA companion; planned as a future component skill)
- Adapted from Dean Peters' "Competitive Research on Steroids" compendium and the Competitive Analysis
  Playbook (Productside).