What Is Link Analysis for Intelligence Analysis?

Last updated: October 19, 2026

Why it matters to your mission. An adversary network is rarely visible in any one report; it hides in the relationships scattered across hundreds of them, and an analyst drawing those links by hand on a whiteboard cannot keep pace with the reporting. Link analysis maps the entities and the relationships between them into a network you can examine for structure and key nodes. The outcome is a defensible picture of who is connected to whom, so a commander can act on the network rather than chase isolated leads.

Definition

Link analysis for intelligence is the method of mapping entities such as people, organizations, places, and events and the relationships between them into a network an analyst can examine to find structure, key nodes, and hidden connections across many sources. It is also called network analysis, association analysis, or nodal analysis. Its two classic doctrinal products are the association matrix, which records who is connected to whom, and the link diagram, which draws those connections as a graph.

Link analysis answers a different question than a single report does. A report tells you what one source observed; link analysis tells you how the observations fit together, which actor sits at the center of a network, and which connection, if removed, would break the network apart. It is the step where fragments become a structure a decision can rest on.

Key takeaways

• What it is: turning entities and the relationships between them into an examinable network, so an analyst can see structure rather than a pile of unrelated reports.
• The doctrinal products: the association matrix (who is connected to whom) and the link diagram (those connections drawn as a graph), both defined in joint intelligence doctrine.
• Why it depends on earlier steps: link analysis is only as trustworthy as the entity resolution and extraction that feed it; a wrong match or a missed one distorts the entire network.
• What to require: multi-source and unstructured coverage, provenance back to every source, confidence on every link, and human judgment preserved on ambiguous ones.
• The payoff: a briefable network picture that identifies key nodes and critical connections at machine speed, with every link traceable to the reporting it came from.

How Does Link Analysis Work?

Link analysis is a procedure, not a single drawing. Joint doctrine lays out the classic manual form, and the automated form follows the same logic at scale. The stages are:

• Identify the entities. Pull the people, organizations, locations, events, and objects out of the reporting. In a modern pipeline this draws on entity extraction from unstructured text and the resolved entities that feed it.
• Record the relationships. Build the association matrix: enter the entities along the rows and columns, and mark each cell where a confirmed or suspected relationship exists between the two. Doctrine distinguishes an association matrix, which captures relationships between individuals, from an activities matrix, which captures ties between individuals and organizations, events, places, or other things.
• Draw the network. Convert the matrix into a link diagram, where entities are nodes and relationships are the lines between them. The diagram makes structure visible that a table of records never could.
• Analyze the structure. Examine the network for the actor with the most connections, the broker who links otherwise separate groups, and the single connection whose removal would fragment the network. These are the questions link analysis exists to answer.
• Attach confidence and provenance. Mark which links are confirmed and which are suspected, and keep each one traceable back to the report that established it, so the network can be briefed, challenged, and corrected.

The manual version of this is slow and does not scale; an analyst can hold only so many entities and links in a hand-drawn chart. The automated version does the same work across far more reporting, which is where graph-based reasoning and government-owned reasoning infrastructure come in later on this page.

What Is the Difference Between an Association Matrix and a Link Diagram?

They are two views of the same relationships. The association matrix is the data structure, the input you build first; the link diagram is the visualization, the output an analyst reasons over. The matrix records every pairwise relationship in a grid so none is missed; the diagram turns that grid into a network where structure, clusters, and central nodes become visible at a glance.

Both are defined in joint intelligence doctrine as analytic techniques, and a sound link analysis capability produces both: the matrix so nothing is lost, the diagram so structure can be seen.

How Is Link Analysis Different From Entity Resolution?

The two are often conflated, but they are sequential steps and the order matters. Entity resolution decides when separate records refer to the same real-world entity and links them into one provenance-preserving object. Link analysis takes those resolved entities and maps the relationships between them into a network. Resolution answers "is this the same person?"; link analysis answers "who is this person connected to, and what does the network look like?"

The dependency runs one direction. Link analysis inherits every error from the resolution beneath it. If resolution wrongly fuses two different people into one entity, the link diagram collapses two networks into a false single structure. If resolution misses a match, the diagram shows two disconnected clusters that are really one network with a broker in the middle. This is why link analysis cannot be evaluated on its own: a network picture is only as trustworthy as the matching, extraction, and provenance that feed it. See the related explainer on entity resolution for intelligence analysis for how that matching step works.

How Does Link Analysis Relate to GraphRAG and Knowledge Graphs?

A link diagram is, in effect, a small knowledge graph: entities as nodes, relationships as edges. When the network is stored as a persistent graph rather than a one-off chart, an analyst can query it and a retrieval system can traverse it. That is the link between classic link analysis and graph-based retrieval-augmented generation, or GraphRAG, where a language model answers multi-step relationship questions by walking the graph instead of searching flat text.

The difference is scale and reuse. A hand-drawn link diagram answers one question at one moment. A link analysis capability that persists its network as a governed graph lets an analyst ask follow-on questions, pull the provenance behind any edge, and let downstream reasoning traverse relationships that span many reports. See the related explainer on GraphRAG for intelligence analysis for how graph structure improves relationship reasoning.

Why Does Link Analysis Matter for Defense and Intelligence?

The mission questions that turn on link analysis are the hardest and highest-stakes: who leads a network, how it is organized, and which connection, if disrupted, changes the adversary's behavior. Joint doctrine treats these as core analytic work. Joint Publication 2-01.3, Joint Intelligence Preparation of the Operational Environment, defines the association matrix and the link diagram as standard techniques for understanding threat organizations and relationships (see JP 2-01.3, 2014, Appendix E). These are not optional embellishments; they are how the intelligence community has long reasoned about networks.

The difficulty today is not the technique but the volume and fragmentation of the data it runs on. The Department of Defense has made integrating data across its many systems a program-level priority through its command-and-control modernization, and independent oversight has documented how hard that integration is in practice. The U.S. Government Accountability Office found that analysts still rely on inefficient "swivel chair" processes, manually moving data between disconnected systems, which prevents effective use of analytics and artificial intelligence on large data volumes (see GAO-25-106454, Defense Command and Control, 2025). Swivel-chair fragmentation is what makes link analysis slow: the relationships that define a network are scattered across systems no one has stitched together.

A modern link analysis capability closes that gap. It does the connective work across fragmented, multi-source reporting at machine speed, so the analyst spends time interpreting the network rather than assembling it by hand.

How Torch.AI Approaches Link Analysis

Torch.AI builds government-owned reasoning infrastructure that the customer can own and govern, offered as a government-owned (GOTS) deployment when a mission requires it. The approach treats link analysis as the product of a pipeline, not a standalone drawing tool. ORCUS connects to mission data where it lives and brings fragmented, multi-source reporting into a common form; NEXUS makes that data meaningful through extraction and semantic representation so entities can be recognized in unstructured text; and HALO fuses the resolved entities into a graph, making the relationships between them explicit and examinable. The result is a link analysis network built across many sources with every edge traceable back to its reporting. You can see how this is packaged as a capability on the Torch.AI software page.

Because the network is stored as a governed graph rather than a disposable chart, an analyst can query it, inspect the provenance behind any connection, and let downstream reasoning traverse relationships that span the whole corpus. The reasoning layer complements existing systems of record rather than replacing them, so the authoritative sources stay intact and interoperable rather than locked inside a proprietary model. This is the systems of record versus system of reason distinction at the center of Torch.AI's approach: the graph is a layer of understanding on top of the data the customer already owns.

The approach is built for the conditions this page describes: all-source, multi-source reporting; structured and unstructured data; confidence and provenance on every link; and analyst judgment preserved on the connections that are suspected rather than confirmed.

What to Require in a Link Analysis Capability

The questions above explain why link analysis is hard in a mission setting; the checklist below is what to actually require when evaluating a capability.

1. Multi-source and unstructured. Builds the network across signals, human, open-source, and geospatial reporting and free text, not only clean structured records.
2. Built on sound entity resolution. The network is only as good as the matching beneath it; resolution and link analysis have to work together, not in separate tools.
3. Provenance-preserving. Every node and every link traces back to the reporting that established it, so the network can be inspected and defended.
4. Confidence-aware. Confirmed and suspected relationships are distinguished, not flattened into a single line.
5. Human judgment preserved. Analysts adjudicate suspected links; the capability proposes, it does not assert.
6. Persisted as a governed graph. The network is queryable and reusable, feeding downstream graph-based reasoning, not a one-off chart.
7. Government-owned when the mission needs it. The customer keeps control of the network, the relationships, and the logic, and can run them independently of any single vendor.

Evaluating a capability? The seven requirements above are the backbone of a link analysis evaluation you can score against. Bring them to a scoping call and we will walk each one against your environment: request a technical walkthrough.

Sources

• U.S. Joint Chiefs of Staff, Joint Publication 2-01.3, Joint Intelligence Preparation of the Operational Environment (2014), irp.fas.org - Appendix E defines the association matrix and link diagram as standard analytic techniques for understanding threat organizations and relationships.
• U.S. Government Accountability Office, Defense Command and Control: Further Progress Hinges on Establishing a Comprehensive Framework, GAO-25-106454 (2025), files.gao.gov - documents the "swivel chair" data fragmentation that makes network analysis across many systems slow.

How does link analysis work?

It identifies the entities in the reporting, records the relationships between them in an association matrix, draws those relationships as a link diagram, and then examines the resulting network for its most connected actors, its brokers, and the connections whose removal would fragment it, with confidence and provenance attached to each link.

What is the difference between an association matrix and a link diagram?

The association matrix is a grid that records every pairwise relationship so none is missed; the link diagram is the network drawn from that matrix, where entities are nodes and relationships are lines, so structure and central nodes become visible. One is the input data structure, the other is the visualization reasoned over.

How is link analysis different from entity resolution?

Entity resolution decides when separate records refer to the same real-world entity and links them into one object; link analysis then maps the relationships between those resolved entities into a network. Resolution is the prerequisite; link analysis inherits any error in it.

How does link analysis relate to GraphRAG and knowledge graphs?

A link diagram is a small knowledge graph, and when the network is persisted as a governed graph it can be queried and traversed by a retrieval system. That is the basis of GraphRAG, where a language model answers multi-step relationship questions by walking the graph rather than searching flat text.

Why does link analysis matter for defense and intelligence?

It is how analysts identify the leadership, structure, and critical connections of adversary networks. Joint doctrine defines the association matrix and link diagram as standard analytic techniques, and the challenge today is doing that work across fragmented, multi-source data at mission speed rather than by hand.

Can link analysis run on unstructured, multi-source data?

Yes, if it is built for it. A mission-grade capability has to extract entities and relationships from free text and heterogeneous reporting, not only from clean structured records, and preserve provenance back to each source.