Which analytic process must a threat intelligence manager use to identify the most consistent theory about malware?

• A. Application decomposition and analysis (ADA)
• B. Automated technical analysis
• C. Analysis of competing hypotheses (ACH)
• D. Threat modelling

Answer: (C)

Analyzing competing hypotheses is about weighing multiple plausible explanations for a malware observation and selecting the one most supported by evidence. In threat intelligence, this means formulating distinct theories—such as attribution to a particular actor, a specific supply-chain vector, or a novel malware capability—and then testing each against all available data: indicators, behaviors, timelines, attacker capabilities, and any contradictions or gaps. The goal is to gather evidence that would support or disconfirm each hypothesis and to look for disconfirming data rather than only collecting supporting bits. This approach helps you avoid jumping to a single conclusion and instead continuously refine the understanding as new information comes in.

Why this is the best fit here is that malware scenarios are often uncertain and multifaceted. ACH provides a structured way to compare competing explanations, quantify how well each one explains the observed facts, and update conclusions when new evidence appears. It emphasizes negative evidence and falsifiability, which is crucial for staying objective and reducing bias. Other analytic activities—like breaking down an application into components, running automated analyses, or outlining potential threat scenarios—address important tasks but don’t inherently prioritize choosing the most consistent theory among competing explanations for malware.