Chapter 1 — Mathematical reasoning
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Three kinds of inference"]
N2["1.2 Fallacies in reports"]
N3["1.3 Proportions and ratios"]
N4["1.4 Assumptions"]
N5["Estimating before computing"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Three kinds of inference"]
N2["1.2 Fallacies in reports"]
N3["1.3 Proportions and ratios"]
N4["1.4 Assumptions"]
N5["Estimating before computing"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Three kinds of inference]
|
v
[1.2 Fallacies in reports]
|
v
[1.3 Proportions and ratios]
|
v
[1.4 Assumptions]
|
v
[Estimating before computing]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) distinguish deduction, induction and abduction in intelligence work; (2) spot common fallacies in threat reporting; (3) use proportions and ratios correctly; (4) state the assumptions behind a conclusion.
1.1 Three kinds of inference
Deduction moves from rules to certain conclusions: if every TLP:RED report goes only to named recipients and Amara is not named, she may not read it. Induction generalises from cases: five sector reports began with phishing, so phishing is a common entry route. Abduction proposes the best explanation for an observation: a burst of failed logins at night may be password guessing. Intelligence analysis relies heavily on abduction, which is why its conclusions must be stated with uncertainty.
Amara labels each conclusion with the inference that produced it.
1.2 Fallacies in reports
Post hoc reasoning: an outage followed a phishing email, so the email caused it. Base-rate neglect: a detector with a 99% hit rate sounds decisive until you remember how rare real attacks are. Survivorship: studying only incidents that were detected tells you little about those that were not. Naming the fallacy in a peer's draft is a useful review skill.
In Amara's first review of an HSSC draft, she marks one sentence that blames a ransomware outbreak on a supplier because the supplier's update came the day before. The draft offers no other link. She suggests rewording it as a hypothesis and listing what evidence would confirm or rule it out, which turns a fallacy into a useful question for the next analyst.
1.3 Proportions and ratios
"Phishing appeared in 3 of 5 reports" is a proportion, 60%. Reporting "60%" alone hides that the sample is five. Always give the numerator and the denominator, especially when the denominator is small.
Amara writes "3 of 5 reports" in her notes and adds the period they cover. When a later quarter brings twenty reports, the proportion can be compared fairly, and readers can see that the first figure rested on very few cases. A percentage from five items can swing by twenty points with one more report, so presenting it alone suggests far more precision than the evidence has.
1.4 Assumptions
Every conclusion rests on assumptions. Writing them down — the reports are representative; the timestamps are accurate — lets readers judge how far to trust the result.
Amara keeps a short list of assumptions at the end of each note she writes for HCHT's security team. When one turns out to be wrong, such as a feed whose timestamps use a different time zone, she can see at once which conclusions depended on it and revise only those. Unstated assumptions are the hardest errors to find, because nobody knows to check them.
Estimating before computing
Before running numbers, Amara writes a rough expectation: about half the sector reports will mention phishing. If the computed figure is wildly different, she checks the data and the code before believing the surprise. Rough estimates catch spreadsheet errors, duplicated rows and misread columns early.
Worked example
A vendor blog claims "ransomware attacks on hospitals rose 300%". Amara asks: 300% of what baseline, over what period, counted how? The blog counts publicly reported incidents, which may rise because reporting rules changed. She records the claim as "reported incidents increased; underlying rate unknown".
Synthetic case. The blog claim is invented; HCHT is fictional.
Errors and limits
Logic tidies reasoning but cannot replace evidence. Percentages from tiny samples mislead even when arithmetic is right.
Exercises
- EX001 — Inference type. Which kind of inference is "night-time failed logins suggest password guessing"? Rubric: 3 = abduction (best explanation), with reason; 2 = name only; 1 = deduction; 0 = none.
- EX002 — Spot the fallacy. "The outage happened after the phishing email, so the email caused it." Name the fallacy. Rubric: 3 = post hoc ergo propter hoc, with why; 2 = name only; 1 = wrong fallacy; 0 = none.
- EX003 — Baseline question. List three questions to ask about "attacks rose 300%". Rubric: 3 = baseline, period, counting method (or reporting change); 2 = two; 1 = one; 0 = none.
Synthesis
Name your inference type, catch fallacies, give numerators with percentages and write assumptions down.