Key takeaway
Verify reports from people: record the source, use restrictions and level of confidence, compare reports with technical records and respect agreed limits on sharing.
Human reporting complements technical observation
Human intelligence (HUMINT) is intelligence derived from human sources. In cybersecurity, an employee’s report of a suspicious email or a supplier’s notice of disruption can provide an investigative lead, but is not yet a finished intelligence assessment. An interview published in an open report can also be material for open-source intelligence (OSINT). Analyze these reports alongside technical records. They may add context, but do not by themselves establish who conducted an attack or whether a system was compromised.
Record source, time and confidence
For each report, record who provided it, when, whether it is firsthand, whether sharing was authorized and any use restrictions. Separate hypothesis, hearsay and corroborated fact; remove identifying details from public sharing when needed to protect the source. Where appropriate, compare the report with independent technical logs, a timeline, a public report or another source. Document uncertainty when evidence conflicts and avoid premature conclusions.
Protect sources and respect legal boundaries
For staff interviews and voluntary reports, establish procedures that explain in advance why information is collected, how it will be used and who will receive it. Do not coerce or deceive people into disclosing passwords or secrets, collect private correspondence without authorization or access someone else’s account without permission. Confirm requirements for collecting, retaining and sharing personal data with the people responsible for legal and privacy matters. Share a source’s identity only with authorized people who need it for the investigation.