Biosecurity & Pandemic: Mission Domain Intelligence Guide

The first signal is almost never a laboratory confirmation. It is a rural clinic ordering more oxygen than usual, a veterinary cull nobody explained, and a rumour post that a district hospital has stopped admitting.

What Biosecurity & Pandemic covers as a mission domain

Biosecurity and pandemic intelligence covers the detection, characterisation and attribution of biological threats to human, animal and plant health, whether natural, accidental or deliberate. Practitioners run event-based surveillance across official notifications and informal reporting, track pathogen genomics and variant emergence, monitor laboratory biosafety and dual-use research developments, and assess national preparedness and response capacity. The domain sits between public health and security: most events are natural spillover, but the same indicator set supports detection of laboratory accidents and of deliberate release, and the early analytic posture must not prejudge which it is.

Sub-areas include event-based surveillance and epidemic intelligence, genomic and phylogenetic monitoring, zoonotic spillover risk at the animal-human interface, laboratory biosafety and biosecurity oversight, and biological weapons non-proliferation. Actor considerations range from states with legacy programmes and opaque dual-use research, to non-state actors with declared intent but limited capability, to the far more common failure modes: under-resourced surveillance systems, delayed reporting incentives, and gaps in veterinary services where spillover actually begins.

Why it matters

Pandemic-scale events cause economic damage measured in trillions and mortality measured in millions, and the interval between detection and international spread is now days rather than weeks. Preparedness gaps are unevenly distributed, so the countries most likely to host emergence are frequently least able to detect it. For security teams the practical stakes are workforce continuity, travel and site risk, and supply chain interruption. For governments the stake is the difference between containment at source and a global response.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Clusters of severe respiratory or haemorrhagic illness in health workers, historically among the earliest reliable indicators of an efficiently transmitting pathogen.
Unexplained animal die-offs or unusual veterinary culling reported in the same district weeks before any human case notification.
Wastewater surveillance signal rising ahead of clinical case counts, often the earliest quantitative indicator available in a covered catchment.
Local pharmacy and hospital demand shifts, such as antipyretic shortages or oxygen procurement spikes, appearing before official reporting.
Genomic sequences deposited with substantial divergence from circulating lineages, particularly changes in receptor binding or antigenic sites.
A government restricting movement, closing markets or imposing quarantine before announcing the outbreak that justifies it.
Sudden data suppression: routine surveillance dashboards going offline or reporting frequency dropping without explanation.
New high-containment laboratory construction or biosafety incident reporting inconsistent with the declared research programme.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

WHO Disease Outbreak News and IHR notifications — Official verified event reporting, risk assessments and temporary recommendations under the International Health Regulations.
ProMED-mail — Moderated informal event-based surveillance, frequently the first open report of an unusual cluster.
GISAID and Nextstrain — Shared pathogen genome sequences and live phylogenetic analysis for variant emergence and spread tracking.
ECDC and US CDC — Rapid risk assessments, surveillance bulletins and technical guidance with methodological transparency.
WOAH WAHIS — Official animal disease notifications by country and species, essential for spillover and zoonotic risk work.
FAO EMPRES-i — Global animal disease event database covering transboundary and zoonotic disease occurrence.
WHO GISRS and FluNet — Global influenza surveillance virological data by country, subtype and week.
Global Health Security Index and WHO JEE reports — Country preparedness and response capacity assessments useful for triage and gap analysis.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Run continuous event scanning — Monitor official notifications, moderated informal reporting and local-language media for unusual clusters, logging every signal with time of first observation.
Triage and verify — Filter noise against base rates, seek a second independent source, and classify by syndrome, population affected and geographic spread.
Characterise the pathogen — Pull available genomic and clinical data to assess transmissibility, severity, and whether any divergence affects diagnostics or countermeasures.
Test the natural hypothesis first — Assess ecology, animal interface and seasonal precedent before entertaining accidental or deliberate origin, and document what would falsify each.
Assess response capacity — Evaluate national surveillance, laboratory and clinical capacity against the event, since capacity determines whether it stays local.
Model exposure for stakeholders — Translate the event into concrete implications for workforce, travel, sites and supply chain over defined time horizons.
Maintain a live assessment — Update as sequence and case data accumulate, versioning each judgment so consumers can see what changed and why.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

Epidemiological Intelligence — Disease Occurrence, Spread, and Public Health Threats
Medical Intelligence — Health Systems, Capability, and Medical Threats
CBRN Intelligence — Chemical, Biological, Radiological, and Nuclear Threats
Academic Intelligence — Research Output, Collaboration, and Expertise
Geospatial Intelligence — Intelligence Derived from Place
News Intelligence — Media Reporting as an Intelligence Source

Worked in these data points

Facility / Site — A physical installation — plant, base, port, data centre — with a fixed footprint and function.
Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
Person / Name — A named individual — the subject of identity resolution and profiling.
Company / Organization — A legal entity — corporation, LLC, NGO, or business.
Keyword / Narrative — A search term, topic, hashtag, or narrative tracked across media and platforms.

Adjacent mission domains

Inside the platform: where Biosecurity & Pandemic lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

domain.php?d=biosec — Biosecurity & Pandemic dashboard
theater.php?d=biosec — Threat theater view
search.php — Person / Name profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Correlate Infrastructure
Run Alert Rules
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Run continuous event scanning is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Characterise the pathogen turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Maintain a live assessment feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Biosecurity & Pandemic

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence analysts use biological threat intelligence for force health protection, deployment risk assessment, and medical logistics planning, as well as for assessing an adversary's declared and undeclared biological capability under the relevant treaty regime. Products support pre-deployment health briefs, vaccination and prophylaxis decisions, quarantine and isolation planning at deployed medical facilities, and continuity assessments where an outbreak degrades a partner nation or degrades your own force generation. Constraints are significant: medical information handling, the strict separation between health protection and any offensive consideration, and the requirement that suspicions of deliberate activity are routed into treaty and diplomatic channels rather than acted on analytically alone.

🕵 National intelligence

National intelligence requirements cover natural emergence with strategic consequence, laboratory biosafety failures, dual-use research of concern, state compliance with the Biological Weapons Convention, and the capability and intent of non-state actors. The analytic discipline is not prejudging origin: the same indicator set supports natural, accidental and deliberate hypotheses, and early commitment to one destroys credibility. Fusion pairs open epidemic intelligence, which is excellent, with liaison, procurement and financial reporting that is not. Maintain an unclassified layer so warnings can reach health authorities quickly, since public health response is the actual mitigation regardless of origin.

👮 Law enforcement

Law enforcement involvement arises in deliberate contamination, threats and hoaxes, illicit trade in pathogens or controlled equipment, and biosafety regulatory breaches. Investigation is joint by necessity, because public health holds the samples and the epidemiology while police hold the powers, and evidence must satisfy both scientific and legal standards. Sample chain of custody, laboratory accreditation and the ability to demonstrate that a sequence match means what is claimed all determine whether a case survives. Legal process covers seizure, laboratory access, communications and international assistance. Charging often rests on regulatory, fraud or terrorism offences rather than a specific biological statute.

🔍 Private investigation and corporate security

Corporate security and business continuity teams use this domain for workforce protection, travel risk, supply chain continuity where manufacturing sits in an affected region, and screening in life science partnerships and investment. Legitimate work includes country capacity assessment, facility exposure and continuity planning, and reputational and compliance screening of research partners. Private actors must not collect personal health information on employees beyond what employment law permits, must not attempt to obtain pathogen or laboratory information covertly, and should route any suspicion of illicit activity to national authorities immediately rather than investigating it privately.

📰 Journalism and OSINT media

Reporting outbreaks demands unusual discipline because early information is always wrong in specific ways: case counts lag, definitions change, and rumour outpaces confirmation. Verification means going to official notification systems and named laboratories rather than social claims, understanding what a preliminary sequence does and does not establish, and being explicit about the difference between a suspected, probable and confirmed case. Sources inside health systems face dismissal and sometimes prosecution in countries that suppress outbreak information, so protect them carefully. Avoid origin speculation without evidence, since it drives real-world harassment of scientists and communities.

🌍 NGO, humanitarian and human rights

Humanitarian and health organisations use epidemic intelligence to position response, protect staff and advocate for access. Practice is community centred, since outbreak response fails when communities distrust responders, and documentation of care-seeking barriers matters as much as case counts. Do-no-harm applies acutely: naming a village as an outbreak source has produced stigma, violence and displacement. Data protection for patient-level information must be absolute. Documentation of attacks on health workers and of deliberate obstruction of response should be preserved for accountability. Duty of care requires infection prevention training, vaccination where available, and evacuation planning for staff.

🎓 University and research

Research spans genomic epidemiology, surveillance evaluation, biosafety policy and outbreak modelling, and the main methodological hazards are sequence sampling bias and modelling with unstated assumptions. Publish data provenance and acknowledge that available sequences reflect where sequencing capacity exists rather than where infection is. Ethics approval and biosafety review are mandatory for laboratory work, and dual-use research of concern frameworks apply to publication decisions where methods could enable harm. Share code and parameter assumptions, cite database accessions and versions, and observe data-sharing agreements attached to genomic and clinical datasets.

Playbook: working Biosecurity & Pandemic end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define surveillance scope and requirements

State what you are watching for and for whom: a specific pathogen family, a geography, a workforce, or a general early warning function. Define what constitutes a signal worth escalating and what the recipient will do with it, since an epidemic intelligence function that reports everything is ignored within weeks. A good output is a written surveillance scope with signal definitions and escalation criteria agreed with the customer. Stop when a new analyst could apply the escalation criteria consistently without asking.

Phase 2 — Establish the baseline picture

Build the normal state for your area: endemic disease seasonality, routine reporting cadence from national systems, laboratory and sequencing capacity, health system bed and oxygen capacity, and vaccination coverage. Signals only mean something against a baseline, and most false alarms come from mistaking normal seasonal activity for emergence. A good output is a baseline profile per country or region with expected reporting behaviour documented. Stop when you can say what a normal week of reporting looks like from each source.

Phase 3 — Run event-based surveillance

Monitor official notifications, informal reporting networks, clinician forums, local-language media and community reporting in parallel, because the earliest signals almost never come from official channels. Capture each signal with its source, date, language and what precisely is claimed. Volume is high and specificity is low at this stage, so the value comes from disciplined capture rather than judgment. A good output is a signal log with consistent metadata. Stop capturing detail that would identify individual patients.

Phase 4 — Triage and verify signals

Apply a structured triage: is the source credible, is the claim internally consistent, does it fit the baseline, is there corroboration from an independent source, and what would confirm or refute it. Seek verification through official channels, named laboratories and partner networks rather than amplification. Most signals resolve as noise, and the discipline is closing them explicitly rather than leaving them open. A good output is a triaged signal register with a documented disposition for each. Stop when the signal is verified, refuted or parked with a review date.

Phase 5 — Characterise the event

For verified events establish the essentials: pathogen and its known characteristics, case definition in use, geographic and demographic distribution, transmission mode evidence, severity indicators, and the health system context in which it is occurring. Note explicitly which parameters are estimated and which are measured. Early parameter estimates are unstable and get quoted for years, so caveat them heavily. A good output is a characterisation summary with evidence quality flagged per parameter. Stop when the parameter table is honest about what is unknown.

Phase 6 — Track genomics without over-reading it

Follow sequence submissions, lineage assignments and phylogenetic reconstructions, using them for what they support: relatedness, approximate timing and geographic spread of lineages. They do not directly establish transmissibility, severity or origin, and sequence availability reflects sequencing capacity rather than true distribution. A good output is a genomic picture with sampling bias stated alongside every inference. Stop before converting a mutation observation into a phenotype claim without experimental or epidemiological evidence.

Phase 7 — Hold the origin question open

Maintain natural spillover, laboratory accident and deliberate release as live hypotheses, and specify what evidence would discriminate between them: animal reservoir sampling, laboratory activity and biosafety records, procurement patterns, epidemiological linkage, and genomic features assessed by qualified specialists. Early public commitment to one hypothesis has repeatedly proved wrong and has caused serious harm. A good output is an explicit hypothesis table with discriminating evidence listed. Stop before publishing an origin judgment the evidence cannot carry.

Phase 8 — Assess national capacity and response

Evaluate the country's detection, reporting and response capability using published assessments and observed behaviour: time from onset to detection, detection to reporting, reporting to response, and whether the health system is absorbing or breaking. Capacity determines outcome more than pathogen characteristics in most events. A good output is a capacity assessment with the specific bottleneck named. Stop when you can identify which part of the response chain will fail first.

Phase 9 — Produce stakeholder-specific assessments

Translate the same evidence base into products for different consumers: workforce exposure and continuity for corporate customers, protection and access implications for humanitarian actors, health system pressure for government, and travel and force health protection for defence. Keep one evidence base with multiple renderings rather than parallel analyses that drift. A good output is a set of consistent products traceable to one versioned assessment. Stop when the versions cannot contradict each other.

Phase 10 — Maintain versioned live judgments

Outbreak assessments age in days, so publish with a version number, a date, an explicit list of what changed and a review cadence. Record superseded judgments rather than deleting them, since the audit trail is what allows lessons to be learned and protects you when early estimates prove wrong. A good output is a versioned live assessment with a visible change log. Stop when the change log shows what was known when, not only what is believed now.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
WHO Disease Outbreak News and emergency reporting	Open	Official notifications of events of international significance with case counts, response measures and risk assessment.	The authoritative confirmation layer against which informal signals are verified and closed.
ProMED-mail	Registration	Moderated global reporting network for outbreaks of human, animal and plant disease, with expert commentary on each post.	Frequently the earliest usable public signal, with moderator commentary that helps triage credibility.
European Centre for Disease Prevention and Control	Open	Threat assessments, weekly communicable disease threat reports, surveillance atlas and outbreak risk assessments for Europe.	Structured rapid risk assessments and European surveillance data to benchmark and cross-check events.
US Centers for Disease Control and Prevention	Open	Outbreak reporting, technical guidance, surveillance summaries and travel health notices with detailed methodological notes.	Technical reference for case definitions, clinical characterisation, control measure guidance and travel health assessments during an event.
Nextstrain	Open	Real-time phylogenetic visualisation of pathogen genomic data with lineage assignment and geographic reconstruction.	Tracks lineage spread and relatedness, with explicit acknowledgement of sampling bias in the displayed data.
GISAID	Registration	Pathogen sequence repository with associated metadata under a data-sharing agreement restricting redistribution.	Primary sequence source for many respiratory and zoonotic pathogens, subject to strict access and citation terms.
WOAH WAHIS	Registration	Official national notifications of animal disease events with outbreak location, species, and control measures applied.	Detects zoonotic events at the animal interface, which frequently precede human cases by weeks.
FAO animal health and emergency prevention reporting	Open	Global animal disease surveillance and early warning reporting including transboundary and zoonotic disease events.	Complements official animal disease notifications with field reporting from lower-capacity settings where formal systems report late.
WHO Global Influenza Surveillance and Response System	Open	Laboratory-confirmed influenza detections by type and subtype from national influenza centres, reported weekly.	Provides the seasonal baseline and detects unusual subtype activity including zoonotic influenza detections.
Global Health Security Index and WHO joint external evaluations	Open	Structured assessments of national capacity to prevent, detect and respond to biological events, with component scores.	Establishes expected detection and reporting performance so delays can be assessed against capability.
International Health Regulations documentation	Open	The legal framework and guidance governing state notification obligations for public health events of international concern.	Defines what a state was obliged to report and when, which frames any assessment of reporting delay.
Biological Weapons Convention implementation support materials	Open	Treaty text, confidence building measure submissions and meeting documentation on biological weapons non-proliferation.	The framework for state compliance assessment and the correct channel for deliberate-use concerns.
Peer-reviewed literature and preprint servers	Open	Rapidly published outbreak analyses, parameter estimates and genomic studies, of variable and unreviewed quality in preprint form.	Source of parameter estimates and methodological detail, requiring critical appraisal before any operational use.
Insecurity Insight and attacks on healthcare reporting	Open	Incident-level documentation of violence against health workers, facilities and transport in conflict settings.	Assesses whether outbreak response capacity is being degraded by violence and access denial.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Biosecurity & Pandemic. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

EpiCollect or similar structured signal capture — Standardises signal logging with consistent metadata across analysts. The discipline matters more than the tool, which cannot judge credibility.
Nextstrain and phylogenetic viewers — Visualises lineage relationships and spread over time. Interpretation requires understanding sampling bias, which the visualisation does not display.
R with epidemiological packages — Estimates transmission parameters, epidemic curves and delay distributions. Model assumptions drive results far more than the software does.
QGIS — Maps cases, health facilities, animal interfaces and access constraints. Useful for spatial context, but never publish maps that identify individual patients.
Media and multilingual monitoring platforms — Surfaces local-language reporting ahead of official notification. Translation quality and source credibility both need human assessment.
Python with pandas — Reconciles case series across sources with different definitions and reporting cadences. Definitional changes remain the analyst's problem to detect.
Versioned document systems — Maintains live assessments with visible change logs. Essential for outbreak work, where judgments change daily and audit trails protect the analyst.
Secure collaboration platforms — Allows sharing with health authorities under access control. Must never carry patient-identifiable information, regardless of convenience.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

The first signal is almost never a laboratory confirmation. It is a supply anomaly, a rumour, a clinician question in a professional forum, or an unexplained veterinary event, so build collection around those surfaces rather than around notification systems.
Do not prejudge origin. Natural spillover, laboratory accident and deliberate release share most early indicators, and public commitment to one hypothesis has repeatedly proved both wrong and harmful to real people.
Sequence availability reflects sequencing capacity, not infection distribution. A lineage appearing to originate in a well-sequenced country is one of the most common and most confidently stated errors in genomic epidemiology.
Early parameter estimates are unstable and get quoted for years. Attach explicit uncertainty and a review date to every reproduction number, case fatality ratio and incubation estimate you publish.
Capacity determines outcome more than pathogen characteristics. Measure onset-to-detection, detection-to-report and report-to-response intervals, because the bottleneck in that chain predicts the event trajectory better than virology does.
Naming a community as an outbreak source causes real harm, including stigma, violence and displacement, and it also suppresses future reporting. Use the smallest geographic granularity that serves the response.
Close signals explicitly. An epidemic intelligence function that leaves hundreds of signals open cannot distinguish an unresolved concern from an abandoned one, and it loses the confidence of the people it warns.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Biosecurity & Pandemic is producing anything, and they are worth baselining before you change process or tooling.

Median time from first open signal to verified event characterisation, tracked separately for official and informal source origins.
Proportion of escalated signals that proved to be genuine events, and the proportion of genuine events first detected by your own monitoring.
Lead time between your verified assessment and the corresponding official notification, measured in days and tracked per event.
Share of signals with a documented disposition rather than left open indefinitely in the register.
Proportion of published parameter estimates carrying explicit uncertainty and a review date on the face of the product.
Number of assessments where an origin judgment was correctly withheld pending discriminating evidence rather than asserted prematurely.
Time from a verified event to stakeholder-specific products reaching each customer group with consistent underlying judgments.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Reporting volume tracks surveillance capacity, so an apparent increase often reflects better detection rather than more disease.
Origin questions are politically charged and evidentially hard; early attribution claims damage credibility and impede sample sharing.
Case fatality ratios computed early are almost always overstated because mild and asymptomatic cases go undetected.
Genomic databases are geographically biased toward wealthy sequencing capacity, so absence of a variant is not absence of the variant.
Conflating biosafety failures with deliberate programmes collapses two very different problems requiring different evidence and response.
Governments have material incentives to delay notification because of trade and travel consequences, so silence carries information.

Legal and ethical considerations

This domain touches health data, which is protected in nearly every jurisdiction, and case-level detail can identify patients in small communities. Aggregate and delay location precision accordingly. Origin and biological weapons assessments carry treaty implications under the Biological Weapons Convention and should meet a high evidentiary standard before circulation. Avoid publishing dual-use methodological detail. Genomic data is often shared under access agreements requiring acknowledgement and restricting redistribution, and those terms are enforced.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Biosecurity & Pandemic, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 intelligence disciplines, 6 data points, 5 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Where does the earliest usable signal actually come from?

Rarely from official notification. In practice the earliest signals are operational and mundane: unusual procurement of oxygen or antibiotics at a district facility, a clinician asking colleagues about an unfamiliar presentation in a professional forum, an unexplained veterinary cull, a local-language news item about a hospital closing to admissions, or community rumour reported through a health worker network. These are low specificity and high volume, so the discipline is structured capture and triage rather than intuition. Build your collection around these surfaces and use official systems as the verification layer rather than the detection layer.

Can genomic data tell us where a pathogen came from?

It can establish relatedness between sampled sequences and approximate the timing of divergence, and it can show which lineages are circulating where samples were taken. It cannot on its own establish geographic origin, because sequence availability tracks sequencing capacity rather than infection distribution, and a country that sequences heavily will appear to originate lineages it merely detected first. It also cannot establish transmissibility or severity without epidemiological or experimental evidence. Report genomic findings with sampling bias stated explicitly, and treat origin as a multi-evidence question rather than a phylogenetic one.

How should an analyst treat the deliberate release possibility?

As one live hypothesis among several, held open until discriminating evidence appears, and never as the working assumption. The overwhelming majority of events are natural. The correct approach is to specify what would discriminate: epidemiological patterns inconsistent with natural spillover, absence of an animal reservoir link after proper investigation, laboratory activity and biosafety records, procurement or personnel indicators, and genomic features assessed by qualified specialists. Concerns should be routed into the appropriate treaty, national security and public health channels rather than published. Meanwhile the public health response is identical regardless of origin, and that response is the actual mitigation.

Why do case counts change so much in the first weeks?

Because case definitions change, testing capacity changes, reporting systems catch up, and retrospective cases are added. A rising count in week two frequently reflects testing expansion rather than transmission growth, and a falling count often reflects a weekend, a holiday or a reporting system failure. Always establish the case definition in use and the date it changed, distinguish reporting date from onset date, and present curves by onset where possible. Never publish a growth rate calculated across a definitional change without flagging it, because that error propagates into every downstream model.

What does national capacity assessment actually add?

It predicts the trajectory better than pathogen characteristics do. Two countries facing the same pathogen produce entirely different outcomes depending on time from onset to detection, laboratory turnaround, contact tracing workforce, oxygen and critical care capacity, and public trust in the response. Published capacity assessments give a baseline expectation, and observed reporting behaviour during the event tests it. The practical product is naming which link in the detection-to-response chain will fail first, which tells responders and donors exactly where support changes the outcome rather than describing the country as weak.

How do you protect sources inside health systems?

Assume real jeopardy. Clinicians and public health staff who report outbreak information ahead of their government have been dismissed, detained and prosecuted. Use secure channels, avoid identifying details including facility names and unusual clinical specifics that would narrow the source, and never confirm to a third party that a source exists. Where a signal must be published to protect the public, seek independent corroboration first so the reporting does not point back to one person. Agree with the source in advance what may be used and honour it even when the story would be stronger otherwise.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

International Health Regulations, which govern state obligations to detect, assess, notify and report public health events of international concern.
Biological Weapons Convention and its confidence building measures, which frame state compliance assessment and the correct channel for deliberate-use concerns.
WHO laboratory biosafety manual and biorisk management guidance, which define containment levels and biorisk assessment practice.
WOAH Terrestrial Animal Health Code, which sets animal disease notification obligations underpinning zoonotic early warning.
One Health tripartite and quadripartite frameworks, which structure cooperation between human, animal and environmental health authorities.
Dual-use research of concern oversight frameworks, which govern review and publication decisions for research with misuse potential.
Global Health Security Agenda and joint external evaluation methodology, which provide the capacity assessment structure used in benchmarking.
ICD 203 analytic standards, which govern uncertainty expression and source characterisation in intelligence products built from this material.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Disease Outbreak News and emergency reporting — World Health Organization. Official notifications and risk assessments for events of international concern
ProMED-mail reporting network — International Society for Infectious Diseases. Moderated global outbreak reporting with expert commentary
Communicable disease threat reports and rapid risk assessments — European Centre for Disease Prevention and Control. Structured European threat assessment and surveillance reporting
World Animal Health Information System — World Organisation for Animal Health. Official national notifications of animal disease outbreaks
Nextstrain real-time pathogen evolution — Nextstrain project. Open phylogenetic analysis and visualisation of pathogen genomic data
Global Health Security Index — NTI and Johns Hopkins Center for Health Security. Comparative assessment of national health security capacity
Biological Weapons Convention documentation — UN Office for Disarmament Affairs. Treaty framework and meeting documentation on biological weapons non-proliferation
Outbreak reporting and technical guidance — US Centers for Disease Control and Prevention. Case definitions, clinical guidance and surveillance summaries
Attacks on health care data — Insecurity Insight. Incident documentation of violence against health workers and facilities

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: continuous event-based surveillance, verified signal triage and stakeholder-specific exposure assessment with versioned live judgments. Explore the platform, or browse the rest of the library by following any tag above.