Chapter 4 — Academic writing
Lesson map
Lesson 04 published. Map, example, EX010.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Claim, evidence, reasoning"]
N2["4.2 Citation"]
N3["4.3 Hedging"]
N4["4.4 Academic versus intelligence style"]
N5["4.5 Revision"]
N6["Writing for non-specialists"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX010"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Claim, evidence, reasoning"]
N2["4.2 Citation"]
N3["4.3 Hedging"]
N4["4.4 Academic versus intelligence style"]
N5["4.5 Revision"]
N6["Writing for non-specialists"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX010"]
[Learning outcomes]
|
v
[4.1 Claim, evidence, reasoning]
|
v
[4.2 Citation]
|
v
[4.3 Hedging]
|
v
[4.4 Academic versus intelligence style]
|
v
[4.5 Revision]
|
v
[Writing for non-specialists]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX010]
Learning outcomes
You will (1) structure an argument with claim, evidence and reasoning; (2) cite sources correctly; (3) write with appropriate hedging; (4) adapt academic habits to intelligence writing.
4.1 Claim, evidence, reasoning
A paragraph makes one claim, presents evidence and explains why the evidence supports the claim. "Phishing is the most common entry route in HSSC reports (claim); it appears in 3 of 5 reports from 2026 (evidence); the other routes appear at most twice (reasoning)." Readers can then challenge the evidence rather than guess your meaning.
Amara uses this pattern in every paragraph of her reports. Her supervisor can then check the evidence quickly, and a reader who disagrees knows exactly which part to question. When a claim has no evidence yet, she labels it as a hypothesis and says what would test it.
4.2 Citation
Cite specifications for definitions (STIX 2.1 for object types), papers for models (Hutchins et al. for the kill chain), and data sources for numbers. Paraphrase and cite; quote only when exact wording matters. Never cite a TLP-restricted report in public coursework.
Amara keeps a reference list for each piece of coursework and checks that every TLP marking allows the use she makes of a source. For an essay on phishing in health care she cites public reports only, and describes HSSC trends in general terms without naming any restricted report, so the essay can be shared with her class.
4.3 Hedging
"Proves" is rarely justified. "Suggests", "is consistent with" and calibrated words such as "likely" signal uncertainty honestly. Over-hedging — "might possibly perhaps" — is as unhelpful as overclaiming.
Amara learns to choose one calibrated word per judgment and to say what it rests on, such as "likely, based on two independent reports". A reader can act on that, or ask for more evidence, which is the point of hedging honestly. She avoids stacking qualifiers, which hides the judgment rather than expressing its uncertainty.
4.4 Academic versus intelligence style
Academic writing often builds to a conclusion. Intelligence writing states the bottom line first. ICD 203 asks analytic products to be clear and logical; both styles share that aim but differ in order. Amara learns both.
In practice, Amara writes coursework essays in academic style and her HCHT notes with the bottom line in the first sentence, followed by the evidence. Busy readers in the security team may read only that first line, so it must be accurate on its own. Her supervisor checks that the evidence below actually supports it.
4.5 Revision
Read drafts aloud, cut words that do not change meaning, and ask a peer to restate your main claim.
Amara reads her first HCHT note aloud and finds two sentences that say the same thing. A peer restates her main claim as "block these domains" when she meant "monitor these domains", so she rewrites the opening line to make the action clear. Revision is where most of the clarity in a report comes from, and she plans time for it rather than treating it as optional.
Writing for non-specialists
Clinical managers read HCHT security notes too. Replace jargon with plain words or define it once: 'phishing (fraudulent email that tricks people into acting)'. Short sentences, active voice and concrete actions — 'report suspicious invoices to the service desk' — make guidance usable by busy ward staff who have minutes, not hours, to read it.
Worked example
Amara's first essay paragraph mixes three claims about phishing, ransomware and insiders. Her tutor asks for one claim per paragraph. She splits it into three, each with its own evidence, and moves her conclusion to the opening sentence for the intelligence-style version.
Synthetic case. The essay is invented.
Errors and limits
Citing a source does not make it reliable; assess it. Academic integrity rules forbid presenting others' analysis as your own.
Exercises
- EX010 — Build a paragraph. Write a claim-evidence-reasoning paragraph about one ATT&CK technique in a fictional sector. Rubric: 3 = all three parts clear; 2 = two; 1 = claim only; 0 = none.
- EX011 — Restricted source. May Amara cite an HSSC TLP:AMBER report in a public essay? Rubric: 3 = no; use public sources or synthetic examples; 2 = no; 1 = yes with attribution; 0 = none.
- EX012 — Order difference. How does intelligence writing order differ from typical academic writing? Rubric: 3 = bottom line first vs build-up to conclusion; 2 = partial; 1 = no difference; 0 = none.
Synthesis
One claim per paragraph, cite precisely and lawfully, hedge honestly and know when to lead with the conclusion.
Continue studying — chapter 04 of 40
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →