Where ASSURED sits
ASSURED did not invent triage, and the field around it is full of work worth reading. This page is the map: what each neighboring framework, course, and thinking tool actually covers, where it is excellent, and where the gap sits that ASSURED fills. If a claim on this page makes you want to read the source instead, follow the link; that is the point of a related-work section.
The claim, stated carefully
ASSURED does not claim that event triage was undocumented, unstudied, or unteachable before this project. Investigation Theory directly teaches vendor-agnostic investigation and alert-triage skills. Incident-response standards, books, courses, research, and thinking tools cover substantial parts of the work.
The defensible contribution is narrower and concrete: ASSURED publishes one open, named, versioned operational workflow for the work between an alert firing and the documented close-or-escalate decision. Its seven phases have explicit questions, deliverables, transitions, and depth rules. Its templates, exercises, teaching guide, adoption guide, version history, and citation record are public. That positive contribution can be inspected; a universal claim that no other methodology exists cannot.
The lifecycles and standards
NIST SP 800-61r3 incident-response recommendations
What it is: the U.S. standard for incident-response, revised in April 2025 to restructure around the CSF 2.0 functions. Its r3 revision deliberately dropped r2’s step-by-step detection-and-analysis guidance, stating that lifecycle-level operational detail is no longer feasible to maintain in a single static publication.
How it relates: that retreat is the strongest argument for something like ASSURED existing. 800-61 tells an organization what its IR program must cover; it now explicitly leaves the alert-by-alert how to each organization. ASSURED is one published answer to the how, ending exactly where 800-61’s response lifecycle takes ownership: the handoff.
SANS PICERL IR lifecycle
What it is: the six-phase incident-response process (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) that most IR teams can recite, and for good reason: it survives contact with real incidents.
How it relates: triage is a slice of Identification, and PICERL does not decompose that slice. ASSURED’s seven phases are, roughly, Identification expanded to full resolution, with the explicit rule that a confirmed criterion hands the case to the PICERL-shaped process mid-phase. See Triage vs. IR for the boundary in detail.
MITRE ATT&CK knowledge base
What it is: the public catalog of adversary tactics and techniques observed in the wild, and the industry’s shared vocabulary for describing attacker behavior.
How it relates: a vocabulary, not a process. ATT&CK tells you what the behavior you found is called and what tends to come before and after it; it does not tell you how to run the investigation that finds it. ASSURED uses ATT&CK inside Uncover as the mapping layer for reconstructed chains.
The training and the books
Investigation Theory and Chris Sanders’s public work course and research
What it is: Investigation Theory is vendor-agnostic training centered on the mental models used by investigators: diagnostic inquiry, evidence, questions, decisions, data transformation, playbooks, bias, and reporting. Sanders’s publications and presentations extend that work into analyst cognition and education. The 2019 Creative Choices study with Stef Rand used interviews, investigation scenarios, and quantitative self-report measures to derive a model of divergent and convergent analyst thinking, and his 2021 doctoral dissertation, The Analyst Mindset: A Cognitive Skills Assessment of Digital Forensic Analysts (Baylor University), used cognitive task analysis with practicing analysts to model how diagnostic inquiry works in investigations.
How it relates: the overlap is real: both projects try to make tacit investigative reasoning teachable, and both cover evidence selection, questions, bias, and decisions. Investigation Theory goes deeper into cognition and the transferable craft of investigation. ASSURED is narrower and more procedural: it defines the sequence and required artifacts for carrying one event from alert to close or incident-response handoff. ASSURED was not derived from Investigation Theory, but the earlier omission of this work made the related-work map incomplete. See Development and evidence for the provenance record.
SANS SEC450 commercial course
What it is: Blue Team Fundamentals: Security Operations and Analysis, SANS’s SOC-analyst course, and the closest neighbor to ASSURED in intent: structured, bias-aware alert triage, prioritization, and analysis under pressure.
How it relates: if your organization can send analysts through it, do; the instruction is excellent. The difference is form, not respect: SEC450 is paywalled courseware an individual takes once, not an open standard a team can adopt, cite, version, and hold each other to. ASSURED is free, public, versioned, and citable, which is what a shared methodology has to be.
Crafting the InfoSec Playbook book, 2015
What it is: the O’Reilly book on playbook-driven detection and response: build a library of plays, run alerts through them, handle false-positives as a first-class outcome.
How it relates: its play-library discipline is the direct ancestor of what ASSURED’s fast path calls the pattern library, and its false-positive seriousness anticipates the false-positive-as-finding doctrine. It is a decade old and book-shaped, but the thinking holds up; read it.
Blue Team Handbook: SOC, SIEM, and Threat Hunting field reference
What it is: Don Murdoch’s dense, practical desk reference for SOC operations: use cases, SIEM engineering, metrics, hunting.
How it relates: a reference, not a methodology; it answers “what should I know about X” rather than “what do I do next with this alert.” It pairs well with ASSURED the way a dictionary pairs with a writing course.
MITRE’s 11 Strategies of a World-Class Cybersecurity Operations Center free book, 2022
What it is: MITRE’s freely available book on building and running a SOC: staffing, tiering, tooling, metrics, program design.
How it relates: it operates one level up. 11 Strategies designs the SOC; ASSURED runs one function inside it (the triage desk). The program-level content ASSURED deliberately scopes away from the on-shift analyst is exactly the altitude 11 Strategies covers well.
The thinking tools
OODA decision cycle
What it is: John Boyd’s Observe, Orient, Decide, Act loop, the general-purpose model for decision-making under adversarial pressure.
How it relates: ASSURED is a domain-specific instantiation: Alert through Uncover observe and orient, Risk decides, Escalation acts, and the Scope → Uncover → Risk loop is the re-orientation cycle. OODA explains why the loop exists; ASSURED specifies what each turn of it produces.
ACH analytic technique
What it is: Richards Heuer’s Analysis of Competing Hypotheses, from CIA intelligence tradecraft: enumerate the explanations, test evidence against all of them, and privilege disconfirmation over confirmation.
How it relates: Uncover’s hypothesis ledger is ACH scaled to triage speed: competing explanations held open, negatives recorded, refuted stays refuted. If the ledger feels useful, ACH is the deeper well it draws from.
The Diamond Model intrusion-analysis model
What it is: the 2013 Caltagirone, Pendergast, and Betz paper modeling every intrusion event as adversary, capability, infrastructure, and victim, with pivots along the edges.
How it relates: a lens for the analysis inside Uncover, especially attribution and infrastructure pivoting. ASSURED covers the workflow around the lens: when to pick it up, what the output feeds, and when to stop pivoting.
OSCAR forensics methodology
What it is: Obtain information, Strategize, Collect evidence, Analyze, Report, from Davidoff and Ham’s Network Forensics: Tracking Hackers through Cyberspace (2012), and applied by some SOCs to alert investigations.
How it relates: the nearest open neighbor by shape. OSCAR structures the investigation itself, roughly ASSURED’s Uncover through Documentation; it does not carry the triage-specific decisions around it (validation, subject resolution, scoping, escalation criteria, the depth ladder). The two are compatible: an OSCAR-trained analyst will recognize Uncover immediately.
A name adjacency worth knowing
The UK’s National Cyber Security Centre operates “Assured” schemes: NCSC-assured services, consultancies, and training marks. This ASSURED methodology has no affiliation with the NCSC or its assurance schemes; the shared word is coincidence. When searching, “ASSURED triage” or “ASSURED methodology” finds this project.
Key Takeaway
The field already contains strong investigation training, research, IR lifecycles, books, and thinking tools. ASSURED does not claim to originate investigative reasoning. It contributes a specific open operational workflow: seven linked phases, explicit deliverables, a close-or-escalate boundary, and public material a team can teach, adopt, review, and revise.