What Is Activity-Based Intelligence (ABI)?

Last updated: October 19, 2026

Why it matters to your mission. The entity that matters most is often the one no analyst is watching yet, because its activity is scattered across disciplines and systems that never reference each other. Activity-based intelligence integrates those observations of activity and transactions over time so an unknown actor surfaces from the pattern instead of from a prior tip. The outcome is an analyst who can discover an emerging threat from its own footprint rather than waiting for a named target to investigate.

Definition

Activity-based intelligence is an analytic methodology that integrates large volumes of multi-source, multi-domain observations of activity and transactions over time to establish a baseline, reveal relationships, and discover previously unknown entities by resolving them from the activity itself rather than starting from a known target. It is sometimes written ABI, or described as a spiral process of intelligence fusion for big-data analytics. It inverts the traditional workflow: instead of collecting against a known entity, it collects activity broadly and lets the entity emerge from the data.

The shift changes everything downstream. Classic intelligence workflows begin with a target and task collection against it. Activity-based intelligence begins with the activity in an area or a domain and works backward to the actor, which is why it works when the actor is unknown. The methodology is only as sound as the integrated, resolved, time-stamped data beneath it.

Key takeaways

• What it is: a methodology that integrates multi-source activity and transaction data over time to surface relationships and discover entities that were not previously known.
• How it differs from the classic workflow: it starts from the activity and derives the actor, rather than starting from a named target and collecting against it.
• What it depends on: entity resolution and multi-INT fusion. Activity you cannot correlate to a single resolved entity produces false discoveries, not real ones.
• What to require: multi-source and temporal coverage, provenance on every observation, analyst adjudication, and a deployment that runs where the mission runs.
• The payoff: an emerging actor or network becomes visible from its own footprint, assembled at machine speed, with every element traceable to its source.

Why Does Activity-Based Intelligence Matter for Defense?

Most of the hard mission questions are not about a target already on a list. They are about what is happening in an area, which actors are behind it, and which of them nobody has named yet. A workflow that can only collect against known targets cannot answer those questions, because it has nothing to task collection against. Activity-based intelligence exists to close that gap: it treats the activity as the starting point and discovers the actor from it.

Consider a suspected logistics node with no known operator. Classic collection has no target to assign. Activity-based intelligence instead correlates everything observable in and around the location over weeks: vehicle movements, device activity, financial transfers, and open-source registrations. A recurring set of behaviors emerges, then a cluster of identifiers that keep co-occurring, and finally a probable operator who was never on any list. The actor was discovered from the activity, not matched against a watchlist.

This is where the cost of weak data foundations compounds. If the underlying records are not resolved to single entities, the methodology discovers entities that do not exist, or splits one real actor into several. Independent oversight has documented how fragmented the starting condition usually is: the U.S. Government Accountability Office found that in current command and control, "data comes into the operations centers from multiple systems and on multiple displays," after which "analysts then collect, assess, and package the data by manually entering and transferring them into yet another system" (see GAO, Defense Command and Control: Further Progress Hinges on Establishing a Comprehensive Framework, GAO-25-106454, 2025). Activity-based intelligence is only credible when that manual, swivel-chair correlation is replaced by resolved, fused, time-stamped data the discovery can rest on.

How Does Activity-Based Intelligence Work?

Activity-based intelligence is a methodology layered on top of fused data, not a single tool. It runs through these stages:

• Integrate before you exploit. Pull multi-source, multi-domain observations into a common, georeferenced, time-stamped representation first, so activity can be compared across disciplines rather than examined one feed at a time.
• Georeference to discover. Place observations in space and time so that co-location and co-occurrence become visible. Activities that repeatedly happen together are the thread that leads to an actor.
• Establish a baseline. Sort the integrated activity to find the normal structure of a place or domain, so that what is routine and what is anomalous can both be seen.
• Resolve entities from the activity. Cluster the identifiers, locations, and behaviors that keep co-occurring into candidate entities, surfacing actors that were never named in advance.
• Map relationships. Link the discovered entity to the people, places, objects, and transactions that recur around it, building the network rather than a single actor.
• Adjudicate with a human in the loop. Route ambiguous discoveries and anomalies to an analyst with a confidence score attached, rather than asserting a new entity automatically.
• Preserve provenance. Keep every observation in the discovery linked to its source report and original classification, so a derived actor can be inspected, briefed, and reversed.

U.S. Marine Corps doctrine describes the same shape. It defines activity-based intelligence as methods that "integrate large volumes of multidiscipline, multi-domain data to establish and maintain a baseline that reveals patterns and anomalous behavior, identifies gaps in knowledge to drive further collection, and provides a real-time understanding of the operational environment," and frames it as "a spiral process of intelligence fusion within the intelligence cycle for big data analytics" (see U.S. Marine Corps, MCWP 2-10, Intelligence Operations, 2021). The "identifies gaps to drive further collection" clause is the spiral: each discovery sharpens the next collection decision.

What Data Does Activity-Based Intelligence Need?

Activity-based intelligence is only as rich as the activity it can observe, and no single discipline is sufficient, because the whole point is to correlate across them. It draws on:

• Geospatial and movement data: tracks, locations, and imagery-derived observations that place activity in space over time.
• Signals and technical data: selectors, device identifiers, and network activity that reveal who is active, when, and in contact with whom.
• Human and open-source reporting: context, associations, registrations, and events that technical collection alone cannot explain.
• Transactional and financial records: payments, logistics, and other transactions that expose supporting activity behind an operation.

Two properties decide whether the methodology works. First, time: every observation needs a reliable timestamp, because discovery lives in the temporal and spatial structure of activity, not the raw volume of records. Second, provenance: because an activity-based discovery can create a new entity and drive a collection or operational decision, each observation has to stay traceable to its source and classification, so an analyst can defend why an entity was surfaced and why the activity was read the way it was.

What Is the Difference Between Activity-Based Intelligence and Pattern-of-Life Analysis?

These two terms travel together and are routinely blurred, but they operate at different scopes and start from opposite ends. The table separates them so each can be cited on its own.

In short, activity-based intelligence is how you find the entity worth watching; pattern-of-life analysis is how you characterize it once you are watching. Both run on the same foundation of resolved, fused, time-stamped, multi-source data, which is why neither is more reliable than the entity resolution and fusion beneath it.

What Makes Activity-Based Intelligence Hard?

• It rests on everything beneath it. A discovery is only as sound as the resolution and fusion under it. Fail to resolve and you invent entities; over-resolve and you merge distinct actors into one.
• Discovery can hallucinate. Correlating enough activity will always surface apparent patterns. Separating a real emerging actor from coincidence is analytic judgment backed by provenance, not a threshold.
• Adversaries hide in the noise. An actor that blends into normal activity, or deliberately injects misleading activity, is attacking the baseline the methodology depends on.
• Collection is uneven. Gaps in coverage look like gaps in activity; a quiet area may be inactive or simply unobserved, and the methodology has to distinguish the two.
• Classification and releasability constrain correlation. Observations arrive at different classification levels and compartments, and discovery has to proceed without pooling data that rules say cannot be combined.
• It has to be defensible. An entity discovered from activity, with no traceable line back to the observations that produced it, is a liability rather than a lead.

How Torch.AI Approaches Activity-Based Intelligence

Torch.AI builds reasoning infrastructure the customer can own and govern, available as a government-owned (GOTS) deployment when a mission requires it. It produces the foundation activity-based intelligence depends on, not an activity-based intelligence product itself. The reasoning layer connects to mission data where it lives and does not replace the systems of record it draws from.

Three capabilities map to the problem this page describes. NEXUS normalizes records and extracts entities and events from unstructured text, so scattered activity carries consistent, time-stamped representation and can be compared across disciplines. HALO resolves records into single entities through graph-based fusion and ties them to the people, places, objects, and transactions that recur around them, the relationship structure an activity-based discovery is read from. ORCUS provides the multi-source ingestion, normalization, and cross-classification data availability underneath both, so activity observed at different classification levels and in different compartments can be correlated without being improperly pooled. Every resolved entity and relationship stays traceable to its sources. See how this is packaged as a capability on the Torch.AI software page.

Because the reasoning layer acts as a system of reason on top of the customer's existing systems of record, the authoritative observations stay intact and interoperable, and an analyst can inspect why an entity was discovered and why the activity was read the way it was. The harder the entity resolution and multi-INT fusion problem, the more the underlying infrastructure decides whether a discovery can be trusted. For the pillar behind this page, see multi-INT fusion.

For evaluators scoping a capability, see how Torch.AI delivers entity resolution and graph-based fusion on multi-INT data, deployable government-owned, on the software page, or request a technical walkthrough.

What to Require for Defense and Intelligence

An activity-based intelligence capability is only as trustworthy as the data and the traceability beneath it. Require:

1. Integrate before exploit. The capability brings multi-source, multi-domain activity into a common georeferenced, time-stamped representation before analysis, not one feed at a time.
2. Built on entity resolution. It resolves activity to single real-world entities and surfaces match confidence, so discoveries are entities and not artifacts.
3. Discovery-capable. It can surface previously unknown entities and relationships from activity, not only characterize entities already named.
4. Provenance-preserving. Every observation behind a discovery traces back to its source report and original classification.
5. Classification-aware. It respects classification, compartments, and releasability while correlating, not only afterward.
6. Human judgment preserved. Analysts adjudicate discoveries and anomalies; confidence is surfaced, not hidden.
7. Runs where the mission runs. Enterprise, on-premise, classified, and disconnected or degraded edge.
8. Government-owned option. The customer can keep control of the reasoning layer, the resolved entities, and the logic, rather than renting them inside a vendor platform. Ownership varies (GOTS or COTS) with how the capability is deployed and purchased.

Evaluating a capability? These requirements are the backbone of an activity-based intelligence evaluation you can score against. Bring them to a scoping call and we will walk each one against your environment: request a technical walkthrough.

Sources

• U.S. Marine Corps, MCWP 2-10, Intelligence Operations (6 October 2021; Distribution Statement A, approved for public release), marines.mil - defines activity-based intelligence as methods that integrate large volumes of multidiscipline, multi-domain data to establish a baseline revealing patterns and anomalous behavior, framed as a spiral process of intelligence fusion for big-data analytics.
• U.S. Government Accountability Office, Defense Command and Control: Further Progress Hinges on Establishing a Comprehensive Framework, GAO-25-106454 (2025), files.gao.gov - documents the fragmented, manual, swivel-chair data correlation across multiple systems that activity-based intelligence must replace with integrated, resolved, time-stamped data.

What is activity-based intelligence (ABI)?

It is an analytic methodology that integrates large volumes of multi-source, multi-domain observations of activity and transactions over time to establish a baseline, reveal relationships, and discover previously unknown entities by resolving them from the activity itself rather than starting from a known target.

Why does activity-based intelligence matter for defense?

Because many mission questions are about activity in an area and the actors behind it that nobody has named yet; a workflow that can only collect against known targets cannot answer them, whereas activity-based intelligence starts from the activity and discovers the actor from it.

How does activity-based intelligence work?

It integrates multi-source activity into a common georeferenced, time-stamped representation before exploiting it, establishes a baseline, clusters co-occurring identifiers and behaviors into candidate entities, maps the relationships around them, adjudicates discoveries with an analyst, and keeps every observation traced to its source.

What data does activity-based intelligence need?

Multi-source observations - geospatial and movement, signals and technical, human and open-source, and transactional records - each with a reliable timestamp and provenance back to its source, resolvable to single real-world entities.

What is the difference between activity-based intelligence and pattern-of-life analysis?

Activity-based intelligence is the broader methodology that studies activity in an area or domain and discovers actors from it; pattern-of-life analysis is one technique inside it that reconstructs the recurring routine of a single, already-identified entity. ABI finds the entity; pattern of life characterizes it.

What makes activity-based intelligence hard?

It rests entirely on the entity resolution and fusion beneath it, correlating enough activity can surface false patterns, adversaries deliberately hide in or inject noise, collection is uneven, classification constrains what can be correlated, and every discovery has to stay traceable enough to defend.