METHODOLOGY + TRADECRAFT

How we seewhat othersmiss.

Source triangulation, peer review, adversary modeling. The intellectual discipline behind every SCRYER briefing, documented and signed.

INTELLECTUAL LINEAGE

SCRYER was founded by analysts who served at national intelligence agencies, corporate security advisory firms, and investigative journalism operations. We left those institutions not because they were wrong, but because their incentive structures produced work optimized for institutional survival rather than truth. A government intelligence product must survive interagency review. A corporate advisory must not alarm the client. An investigative story must fit the news cycle. SCRYER has one constraint: analytical integrity.

Our intellectual lineage runs through three traditions. From the intelligence community, we take the tradecraft: source triangulation, compartmentation, confidence calibration. From investigative journalism, we take the accountability ethic: sign your work, cite your sources, publish what you find even when the client does not want to hear it. From academic security research, we take the adversarial mindset: model the opponent, not the threat surface.

We work with a small number of clients precisely because the quality of our work depends on analyst continuity, not analyst volume. Each engagement team is assigned for the duration of the threat lifecycle, not the contract period. When an analyst who has tracked an adversary for three years leaves SCRYER, their institutional memory does not leave with them. It lives in the methodology, the documentation standard, and the peer review record.

The market for threat intelligence is crowded. Most of it is noise. Automated feeds, repackaged government advisories, and indicator lists sold as intelligence have created an environment where security teams are drowning in data and starving for judgment. SCRYER does not produce data. We produce judgment, grounded in methodology, signed by analysts who stand behind it.

THE 6 PRINCIPLES

Scroll to advance ⟶

Source Triangulation

No claim survives this firm on a single source. Every assertion is corroborated across at least three independent streams: technical telemetry, primary documents, and human-source verification. When the third stream conflicts, we pause the engagement.

SCRYER METHODOLOGY CHARTER · SECTION 2.1

1 / 6

Peer Review

Every briefing is read by two analysts not on the engagement before it leaves the firm. Disagreement is documented, not flattened. Confidence levels are explicit. We sign what we publish, and the signatures carry real accountability.

SCRYER METHODOLOGY CHARTER · SECTION 3.4

2 / 6

Adversary Modeling

We do not chase indicators. We model operators: their training, their constraints, their tempo, their politics. Indicators are downstream of intent. A firm that chases indicators is always one step behind the adversary.

SCRYER METHODOLOGY CHARTER · SECTION 4.2

3 / 6

Counter-Intelligence Hygiene

Operations security applies to us, too. Source identities are compartmented, draft documents are watermarked, and our research infrastructure is treated as a target by a sophisticated adversary at all times.

SCRYER METHODOLOGY CHARTER · SECTION 5.1

4 / 6

Long-Horizon Tracking

Adversaries operate in years. Our threat profiles run on multi-year timelines, with continuity across analyst tenure. We refuse the seduction of the latest IOC. The most dangerous adversaries are the ones you stopped watching.

SCRYER METHODOLOGY CHARTER · SECTION 6.3

5 / 6

Assumption Stress-Testing

Every assessment includes a red-team review of its own premises. Where we are guessing, we say so. The most dangerous sentence in intelligence is the one that sounds certain but rests on a single inference step no one has challenged.

SCRYER METHODOLOGY CHARTER · SECTION 7.1

6 / 6

COUNCIL OF ADVISORS