Methodology

Threat intelligence has never suffered from too little collection. It suffers from too little structure. The same actor carries a dozen names across a dozen vendors. Findings sit locked inside unlinked PDFs. Claims travel without their source. The problem is not missing data. It is disconnected data, with no shared language to connect it.

Collecting an artifact is information. Structuring it, tracing it, and knowing how far to trust it is where intelligence begins. Most of an analyst's time goes to the first, re-reading and re-linking the same reports by hand, before any of the second can start. That is the tax Babel is built to remove.

This page explains the principles behind how Babel does it. Not the machinery, the discipline. What Babel promises about every piece of data it holds, and why the structure around that data can be trusted.

The problem Babel is built around

Attribution in this field is fragile. A single group can appear under six names because six vendors named it independently. Two genuinely separate groups can be merged into one because they happened to share a piece of infrastructure. Once two names are collapsed together, pulling them apart again is close to impossible, and everything downstream inherits the error.

This is not a naming inconvenience. It is an intelligence failure. When it is unclear whether a claim describes the group in question or a neighbour that got folded into it, the assessment built on that claim is already compromised. Babel is built to hold these distinctions carefully, and to refuse the shortcuts that erode them.

Source traceability

Every claim traces back to its source. The foundational rule is simple. Nothing in Babel exists on its own authority. Every entity, every relationship, every attribution is tied to the specific report that introduced it. There are no orphan claims.

Behind each connection is the source that reported it, and that source can be followed back. Intelligence that cannot be traced is intelligence that cannot be checked, and intelligence that cannot be checked is not intelligence. It is a rumour with good formatting.

Extraction discipline

Extraction says what the source says, and nothing more. When Babel reads a report, it extracts only what the text actually states. This sounds obvious. In practice it is the hardest discipline in the field, and the one most often abandoned.

Three commitments govern it.

Babel will not invent an actor. If a report describes an intrusion but names no group and offers no tracking designation, Babel does not manufacture one from the victim's country, the targeted sector, or the malware involved. An unattributed incident stays unattributed. A name that is not in the source is not born inside Babel.

Babel will not attribute a technique on proximity. A technique is linked to an actor only when the report explicitly describes that actor using it. Two things appearing in the same document is not a relationship. The report has to state it.

Babel will not fill gaps from outside knowledge. Extraction draws on the source text in front of it, not on what a model happens to know about a group from elsewhere. If the report does not contain a fact, Babel does not supply it. The word "unknown" in a generated description is treated as a defect, not a flourish.

The result is narrower than what looser approaches produce. That is the point. A confident wrong link is worse than an honest gap.

Names and reversible merges

The hardest problem in structuring intelligence is deciding when two names are the same group and when they are not. An error in the direction of over-merging fuses two adversaries into a single distorted picture that no longer describes either of them.

Babel treats this asymmetrically, because the errors are asymmetric. Keeping two names separate that turn out to be one group is a minor inconvenience, easily corrected. Merging two names that turn out to be separate groups is a serious corruption, painful to reverse. So Babel stays conservative about collapsing names, keeps every alias attached to its canonical entity rather than dissolving it, and treats a merge as a deliberate, reversible act. The distinctions are preserved so they can always be re-examined.

Confidence

Confidence reflects the source's language, not certainty. Not every claim carries the same weight, and Babel does not pretend otherwise. Every relationship carries a confidence level, and that level reflects one thing: how firmly the source itself stated the claim.

A report that calls a link "confirmed" is not the same as one that calls it "suspected," and Babel does not flatten that difference into a single binary. The confidence shown mirrors the language of the analyst who wrote the original report. It is a faithful reading of their certainty, not a fresh verdict layered on top of theirs.

This matters because intelligence is probabilistic by nature. Presenting an assessment as ground truth is a category error. Babel shows how sure the source was, and leaves the judgment where it belongs, with the analyst reading it.

Organizational attribution

Organizational attribution is always someone's assessment. Deciding who a group belongs to, which nation, which agency, which larger operation, is among the most consequential claims in intelligence and among the easiest to get wrong. Babel handles it with matching caution.

When Babel states that a group is affiliated with a government body, or is tracked as a subgroup of a larger operation, that statement is anchored to the source that made the assessment and phrased as that source's assessment, not as fact. When the reporting offers no organizational attribution, Babel says exactly that and invents nothing. Attribution is never Babel speaking. It is always Babel reporting who assessed what.

Why no raw judgment numbers

Babel does not publish raw judgment numbers. It forms internal views about how much weight to give different reporting. Those views stay internal, and that is a deliberate methodological choice, not an omission.

Publishing a raw score against a named vendor or publication would mean issuing a public quality verdict on that organization's work. That is not Babel's role, and it is not sound intelligence practice. A source's reliability is a working judgment used to arbitrate conflicts, not a grade to be posted on a scoreboard. What Babel exposes instead is the thing that actually lets a reader judge for themselves: the source behind every claim, and the confidence language that claim was reported with. The reader sees where a claim came from and how firmly it was stated, and draws their own conclusion. That is more honest, and more useful, than a number Babel assigned in private.

What Babel is not

Babel is not a feed of indicators to block and forget. It is not a replacement for the analyst, and it does not try to be. It works at the base of the intelligence effort, the tactical layer where raw reporting has to be collected, structured, and connected before anything can be built on it. That layer is where an analyst's hours quietly disappear, and it is the layer Babel is built to take off their plate.

The assessment does not live there. Reading the picture, weighing it against a defender's own posture, deciding what it means for the decision at hand, the operational and strategic work, is what only a person can do. Babel does not do that work and does not pretend to. It clears the ground beneath it, so an analyst's time goes to the judgment instead of the plumbing.

Structure is not the same as intelligence. Babel provides the first so that people are freer to produce the second. The dictionary is not the conversation. It is what makes the conversation possible.