Anticipating Surprise: Analysis for Strategic Warning (declassified and published 2002; expanded edition as Handbook of Warning Intelligence 2004) by Cynthia Grabo is the discipline’s most systematic treatment of warning intelligence — the methodology for detecting adversary preparations for hostile action and communicating assessed threats to decision-makers. Originally classified and used internally within the intelligence community, the work codifies decades of Grabo’s experience as a warning analyst at the Defense Intelligence Agency.
Core argument
Grabo’s framework treats warning as a distinct analytical discipline with its own indicators, methods, and institutional requirements. Her key contributions include:
Indicator identification and validation. Grabo systematized the process of identifying indicators of adversary hostile intent — specific observable actions (troop movements, logistics preparations, communications changes, diplomatic behavior) that, in combination, constitute evidence of preparation for attack. She emphasized that individual indicators are rarely diagnostic; warning depends on the accumulation and correlation of multiple indicators across domains.
The warning-response problem. Grabo documented the structural difficulty of translating analytical warning into decision-maker response: warnings must be specific enough to be actionable, confident enough to overcome decision-maker skepticism, and timely enough for the response to be effective. The analyst who warns too early risks crying wolf; the analyst who waits for confirmation risks warning too late. This timing problem has no stable solution — only successive approximations.
Institutional requirements. Warning intelligence requires institutional structures — dedicated warning staffs, regular warning assessments, established communication channels to decision-makers — that must be maintained in peacetime to function in crisis. Ad hoc warning arrangements fail because the analytical frameworks, indicator lists, and communication protocols must be established before the crisis they are meant to detect.
Influence
Grabo’s framework structures the warning function across the U.S. intelligence community. The National Intelligence Officer for Warning, the community’s warning conferences, and the indicator-based methodology used for strategic warning all derive from her work. The 2026 Iran war analysis applies her framework to the post-strike environment — where the warning function must shift from detecting adversary attack preparations to monitoring dispersed, multi-domain retaliatory actions.
Related concepts
- Indications and warning — the function her work systematized
- Signal-to-noise — the problem warning methodology addresses
- Intelligence failure — the consequence when warning fails