Methodology Digital Security Human Security Iran & AI Thinking About Get in touch →

Doctrine Security · Hani Early

Intelligence-
led Security

Intelligence-led security · Hani Early

Analysis, frameworks, and independent thinking on enterprise cybersecurity and executive protection — written by a practitioner, for practitioners.

The Framework → Read the thinking
Scroll

The Problem

Most security programs
are built to respond.
Not to anticipate.

01 · The gap
Reactive by design
Enterprise security programs instrument for known threats, wait for alerts, and respond to incidents. The adversary has already succeeded by the time the SOC sees the alert.
See the methodology →
02 · The blind spot
People left exposed
Organizations protect systems but leave the people who run them unprotected. In December 2024, a Fortune 500 CEO was shot outside a Manhattan hotel. His cybersecurity was world-class. His personal threat exposure had never been assessed.
See human security →
03 · The accelerant
AI on both sides
Adversaries use AI to accelerate reconnaissance, generate convincing spearphishing at scale, and probe detection environments before executing. The capability gap is growing.
See Iran & AI →
Why this approach
"The military figured out how to think about adversaries decades before enterprise security existed. Intelligence Preparation of the Battlefield. Opposing Forces doctrine. Commander's Estimate. These are not metaphors — they are methodologies that translate directly to enterprise defense. Most organizations have simply never made the connection."

The Framework

Nine phases.
One continuous program.

Intelligence-led security is not a checklist. It is a cycle — each discipline feeding the next. Click any phase to go deep.

Phase 1
Threat Landscape & Attack Surface
Know who is coming for you before you build a single detection
Read more →
Phase 2
Log Intelligence & Infrastructure
Your logs are intelligence — manage them that way
Read more →
Phase 3
Detection Engineering & Automation
Close the gap between what you can detect and what you need to
Read more →
Phase 4
Intelligence-led Threat Hunting
Threat hunting is not a calendar event
Read more →
Phase 5
Human Security
Your strongest firewall has a LinkedIn profile
Read more →
Phase 6
Validation
Does your defense actually work? Here is how to find out
Read more →
Phase 7
DFIR
You will be breached. The question is whether you are ready
Read more →
Phase 8
Intelligence-led Recovery
Recovery is not restore-from-backup. It is a security operation.
Read more →
Phase 9
The Integrator
The role enterprise security is missing
Read more →
Read the full methodology →

Two Tracks

Same methodology.
Two domains.

The adversary does not distinguish between your systems and your people. Neither should your security program.

Digital Security
Track 1 — Digital
Intelligence-led Cyber Defense
From threat landscape through detection engineering, automation, threat hunting, validation, DFIR, and recovery — a continuous, intelligence-driven cycle.
Threat Landscape Log Intelligence Detection Threat Hunting Validation DFIR Recovery
Explore digital security →
Human Security
Track 2 — Human
Intelligence-led People Security
Executive threat profiling, digital footprint assessment, continuous monitoring, OPSEC, surveillance awareness, foreign travel, family protection — for executives and all personnel.
Threat Profiling Digital Footprint Dark Web Monitoring OPSEC Advance Work Foreign Travel
Explore human security →

Thinking

Recent articles

Deep dives on each phase of the framework — written for CISOs and security leaders, not for vendors.

The Methodology
Intelligence-led enterprise security: the complete framework
Read →
 Phase 1 · Threat Landscape
Before you build a single detection, know who is coming for you
Read →
 Phase 3 · Detection Engineering
Close the gap between what you can detect and what you need to
Read →
 Phase 5 · Human Security
Your strongest firewall has a LinkedIn profile
Read →
 Phase 9 · The Integrator
The role enterprise security is missing
Read →
 Use Case · Iran & Adversarial AI
What a real threat actor teaches us about defense
Read →
View all 11 articles →
Hani Early — Doctrine Security

About Hani Early

"Most security analysis is written from inside one culture, about adversaries operating from another. That gap — between how analysts assume adversaries think and how adversaries actually think — is where programs fail. Closing it requires more than better tools."

A decade in military intelligence — CENTCOM, the full MENA theater — where the analytical tradecraft of understanding adversaries at the level of intent, grand strategy, and institutional logic became a professional discipline. The questions that tradecraft answers sit upstream of the kill chain.

In the private sector: nation-state threat intelligence at a global consulting firm, executive risk protection, detection engineering methodology. Doctrine Security is the formalization of what I have observed and built.

Read the full background →

Contact

If something here resonates —
I'm happy to chat.

This is a think tank, not a sales page. I write about what I've seen, what I've built, and what I believe security programs need to get right.

Get in touch → About Hani Early