Field Notes: What Is F3EAD? The Intelligence Cycle That Doesn't Stop at "Finish"

Most incident response ends when the threat is contained. F3EAD treats that as the halfway point.

While researching intelligence cycles, I came across F3EAD. It was initially developed for military special operations, where intelligence drives kinetic action. The cybersecurity community has since adapted it, and in cyber it's used mostly for defensive work like threat intelligence and incident response.

The six steps

F3EAD stands for Find, Fix, Finish, Exploit, Analyze, Disseminate. Here are common cyber examples of each:

• Find: Suspicious activity is identified.
• Fix: IOCs identify the suspected hosts or attack vector.
• Finish: Hosts are isolated or removed, or the initial threat is otherwise mitigated.
• Exploit: IOCs, malware, or the attack itself are initially analyzed to determine scope and threat.
• Analyze: Discovered IOCs, exploit analysis, and third-party tools are used to determine whether an APT exists and to hunt for indications of one.
• Disseminate: Analysis is passed on to both tactical partners (SOC, engineers) and strategic partners (C-suite and others with an interest in the issue).

Two halves, one loop

The first three steps belong to the security operations cycle, and the last three are the intelligence cycle. That split is the point. The goal isn't just to eliminate the threat (Finish) but to gather intelligence from the engagement and analyze it so the next Find starts from a better position.

Where it fits

F3EAD wasn't built with cybersecurity in mind, and it fits best when a specific threat has already been identified in your network. The cyber version has been discussed in the community since at least 2015.

Takeaway

It's tempting to call an incident closed once the hosts are cleaned up. F3EAD's argument is that Finish is where the intelligence work starts. Exploit, Analyze, and Disseminate are what turn one incident into better detection, better hunting, and better decisions for everyone who needs to hear about it.

Sources

• Chad Warner. (2023, December 11). F3EAD Cycle in Cyber Threat Intelligence. Medium.
• Kraven Security. (2026, March 9). The F3EAD Intelligence Loop Explained: A Complete Guide 2026.
• Authentic8. (2025, November 24). Establishing an intelligence process for your CTI team. Authentic8 Blog.
• Scott Roberts (@sroberts). (2015, March 24). Intelligence Concepts: F3EAD.