crowd threat.

LOCAL EYES ON GLOBAL THREATS

ANALYST EDUCATION

OPEN SOURCE INTELLIGENCE · METHODOLOGY

INTELLIGENCE METHODOLOGY · BEGINNER'S GUIDE

Analysis of
Competing Hypotheses

ACH is a structured analytical technique designed to help intelligence analysts evaluate evidence fairly across multiple competing explanations — rather than gravitating toward whichever conclusion feels most familiar. It was developed at the CIA to combat one of the most persistent problems in human reasoning: we tend to find evidence for what we already believe.

Developed by Richards Heuer Jr. at the CIA's Directorate of Intelligence and published in Psychology of Intelligence Analysis (1999). Now standard methodology across intelligence agencies, OSINT communities, and strategic analysis teams worldwide.

THE PROBLEM ACH SOLVES

Most analysts unconsciously start with a conclusion and work backwards to find supporting evidence. ACH reverses this — you start with evidence and ask which hypothesis it is most inconsistent with. The hypothesis that survives the most inconsistencies is the most credible, not the one with the most supporting facts.

THE EIGHT STEPS

Identify hypotheses

List all plausible explanations, including unlikely ones. A good ACH has 3–7 hypotheses — too few misses possibilities, too many becomes unmanageable.

List evidence & arguments

Compile all significant evidence, assumptions, and logical arguments. Include evidence that cuts both ways. Note the source and its reliability for each item.

Build the matrix

Create a grid: hypotheses as columns, evidence as rows. Assess each cell — is this evidence Consistent (C), Inconsistent (I), or Not Applicable (–)?

Refine the matrix

Delete evidence consistent with all hypotheses — it is not diagnostic and adds noise. Focus on evidence that discriminates between hypotheses.

Draw tentative conclusions

Identify which hypothesis has the fewest inconsistencies — weighted by source reliability. This is your most credible hypothesis.

Sensitivity analysis

Test how robust your conclusion is. If you removed or challenged one key piece of evidence, does your lead hypothesis change? Flag fragile dependencies.

Report conclusions

State what you believe, why, and with what confidence. Be explicit about what would change your assessment. Avoid overstating certainty.

Set watch indicators

Define observable events that would increase or decrease confidence in each hypothesis. These become your active collection requirements.

WHY ACH MATTERS IN OSINT

Defeats confirmation bias

Forces you to actively look for evidence that breaks your preferred hypothesis, not just confirms it.

Creates audit trails

Every conclusion is traceable to specific evidence items. Clients and colleagues can see exactly why you reached your assessment.

Handles uncertainty

OSINT rarely gives complete pictures. ACH works with incomplete evidence — absence of inconsistency is itself meaningful data.

Identifies collection gaps

Step 8 produces your watch indicators — the specific things you still need to find to resolve ambiguity between hypotheses.

KEY TERMS

C — Consistent

The evidence is compatible with this hypothesis. Note: consistent evidence is weak — most things are consistent with many explanations. Do not over-weight it.

I — Inconsistent

The evidence actively argues against this hypothesis. This is the most powerful signal in ACH. High-reliability inconsistencies carry significantly more weight than unverified ones.

– Neutral

The evidence has no bearing on this hypothesis. Not every piece of evidence is relevant to every hypothesis — and that is fine.

Diagnostic

Evidence that discriminates between hypotheses — consistent with some and inconsistent with others. Non-diagnostic evidence should be removed from the matrix.

Sensitivity

How much your conclusion depends on a single piece of evidence. If removing one item flips your lead hypothesis, flag it — your assessment is fragile and needs more collection.

COMMON PITFALLS

Stacking consistent evidence. A hypothesis with 20 C scores and 3 I scores is weaker than one with 5 C scores and 0 I scores. ACH is about surviving inconsistencies, not accumulating support.

Treating all sources equally. A confirmed official statement inconsistent with a hypothesis is far more damaging than an unverified social media post. Always weight evidence by source reliability — unweighted matrices produce misleading results.

Too few hypotheses. If you only test two hypotheses, you may confirm one by default. Always include a "none of the above" or "deception" hypothesis for high-stakes assessments.

Conflating evidence with assumptions. Unverified OSINT is an assumption until corroborated. Label your sources — a C from a single social media post is not equivalent to a C from satellite imagery or an official statement.

Skipping step 8. The watch indicators are often more operationally valuable than the assessment itself. They turn your analysis into an active collection requirement, not a static document.

REAL WORLD EXAMPLE · OPERATION EPIC FURY

CONTEXT · 06 APRIL 2026 · DAY 38

On 28 February 2026, the US and Israel launched Operation Epic Fury — surprise strikes on Iran killing Supreme Leader Khamenei and targeting nuclear and missile infrastructure. Iran retaliated, closed the Strait of Hormuz, and an active war began. By Day 38, a 45-day ceasefire proposal was on the table and Trump had set a Tuesday Hormuz deadline. An OSINT analyst using ACH asks: what comes next?

STEP 1 — THE FIVE HYPOTHESES

Phased ceasefire deal within 72 hours

Egypt, Pakistan and Turkey have put a two-phase "Islamabad Accord" to both sides: a 45-day pause, then permanent negotiations. For this to happen, Iran would need to accept a temporary halt before getting its core demand — permanent no-attack guarantees — while the US accepts Hormuz does not fully reopen immediately. The diplomatic machinery is running but the gap between the two positions is structurally wide.

ANALYST ESTIMATE: 20%

US escalates to civilian infrastructure strikes

Trump has repeatedly threatened power grid, water, bridges, and energy infrastructure. This hypothesis says the Tuesday deadline is genuine. Supporting signals include the Army Chief of Staff fired mid-war and ongoing decapitation of IRGC leadership. The key constraint: Iran has explicitly warned of a "more severe and expansive" retaliation, Brent crude is at $109, and allied governments are nervous. Escalation faces more countervailing evidence than any other hypothesis.

ANALYST ESTIMATE: 10%

Protracted attrition — the war grinds on for weeks to months

Neither side has the combination of political will and acceptable exit conditions to end the war right now. Trump has extended his own Hormuz deadlines five times — a pattern that reads as signalling rather than genuine ultimatums. Iran's new Supreme Leader Mojtaba Khamenei is untested and structurally incentivised to demonstrate resolve. The war continues at roughly its current tempo. This is the least dramatic outcome but the one most consistent with the observable evidence.

ANALYST ESTIMATE: 40% · LEAD HYPOTHESIS

Iranian regime collapses or is overthrown

Iran entered this war already weakened: massive January 2026 protests, economic crisis, and now military degradation and leadership decapitation. This hypothesis says accumulated pressure tips the regime over. The counterargument is strong: the IRGC remains cohesive, the new leadership is issuing coordinated positions, and authoritarian regimes often consolidate under external attack rather than fracture.

ANALYST ESTIMATE: 10%

Regional conflagration — second front opens

Iran's proxy network — Houthis in Yemen, Hezbollah in Lebanon, PMF militias in Iraq — is active but not fully committed. This hypothesis says the Houthis activate the Bab al-Mandeb (a second global shipping chokepoint), Hezbollah opens a full northern front, and Iraqi militias begin sustained attacks. An adviser to the new Supreme Leader has already publicly flagged the Bab al-Mandeb as a target. If two chokepoints close simultaneously, the global economic shock would be qualitatively different from what we have seen so far.

ANALYST ESTIMATE: 20% · WATCH CLOSELY

STEP 2 — EVIDENCE WITH SOURCE RELIABILITY RATINGS

Source reliability weighting — not all evidence is equal. A confirmed official statement that contradicts a hypothesis is far more damaging than an anonymous tip that does the same. Real ACH practice requires each evidence item to carry a reliability weight. Inconsistencies from high-reliability sources score −2 in the weighted total; medium-reliability sources score −1; low-reliability sources score −0.5. Consistent evidence is not weighted upward — it remains weak regardless of source.

HIGH Confirmed official statement, verified by multiple independent sources, or hard data (market prices, CENTCOM release)

MED Single credible source, named diplomat, verified news outlet with anonymous sourcing

LOW Unverified, single social media report, unconfirmed claim, state media only

Evidence item	Source reliability	Wt.	H1 Ceasefire	H2 Escalate	H3 Attrition	H4 Collapse	H5 Regional
Iran FM Araghchi: permanent ceasefire with no-attack guarantees required — official statement	HIGH	−2	I	C	C	I	C
IRGC navy official statement: Hormuz "will never return" to pre-war state	HIGH	−2	I	C	C	I	C
Iran official: will not reopen Hormuz for a temporary ceasefire only	HIGH	−2	I	C	C	I	C
Trump Truth Social: threatens to bomb Iran to "stone ages" if Hormuz not reopened	HIGH	−2	I	C	C	–	C
Pentagon confirms: IRGC intel chief Khademi killed — decapitation campaign Day 38	HIGH	−2	I	C	C	C	C
Iran warns of "more severe and expansive" retaliation — official MFA statement	HIGH	−2	I	I	C	I	C
Brent crude at $109 (+50% since Day 1) — verified market data	HIGH	−2	C	I	C	C	C
Pentagon confirms: Hegseth fires Army Chief of Staff George mid-war	HIGH	−2	I	C	C	–	C
Trump White House: "in deep negotiations," extends Tuesday deadline again	MED	−1	C	I	C	–	I
45-day "Islamabad Accord" proposal submitted to Witkoff and Araghchi — 4 regional sources, anonymous	MED	−1	C	I	I	–	I
Pakistan Army Chief Munir in all-night contact with Witkoff, Vance, Araghchi — Islamabad source	MED	−1	C	I	I	–	I
Kpler and LSEG data: Iran selectively letting vessels transit Hormuz for payment	MED	−1	C	I	C	I	–
Velayati (adviser to new SL Mojtaba Khamenei) publicly flags Bab al-Mandeb as target — state media	MED	−1	I	–	C	–	C
Hezbollah active in Lebanon — 1,400+ dead confirmed by UN/WHO	MED	−1	I	C	C	–	C
Unconfirmed social media: IRGC moving additional missile systems to launch sites near Bab al-Mandeb	LOW	−0.5	I	–	C	–	C
Unverified Telegram report: Iranian opposition figures in contact with US intermediaries	LOW	−0.5	–	–	I	C	–
RAW INCONSISTENCY COUNT			8	7	2	7	5
WEIGHTED SCORE (I×weight, lower = more credible)			−17	−12	−2	−13	−5

H3 ATTRITION — 40% · LEAD H5 REGIONAL — 20% H1 CEASEFIRE — 20% H2 ESCALATION — 10% H4 COLLAPSE — 10%

WHY WEIGHTING CHANGES THE PICTURE On a raw count, H2 (escalation) scores 7 inconsistencies vs H5 (regional) at 5 — suggesting H5 is more credible. But the weighted scores tell a different story: H2 scores −12 while H5 scores only −5. This is because many of H2's inconsistencies come from high-reliability sources — official Iranian statements, confirmed market data, a direct Trump extension — while H5's supporting picture contains more LOW and MED rated items. Source reliability weighting is not optional in professional ACH — it materially changes your conclusions.

STEP 6 — KEY INTELLIGENCE GAP The single item that most changes the assessment is the content of Iran's "formulated response" to the ceasefire proposals. It is currently undelivered — meaning it is a collection gap, not a scored item. If it contains partial Hormuz flexibility, H1 could displace H3 as lead hypothesis. That is your Step 8 watch indicator: track Araghchi's next public statement above all other indicators.