A single class for all principals is the only structure that survives real-world Actor behavior. Tiered models (state vs. organization vs. individual) break the moment an organization changes principal or operates independently.

Asset is the neutral term that lets LetsData treat every account, page, channel, and website in the Landscape consistently — without prejudging which ones are organic, which are coordinated, and which are hostile. Neutrality is operationally critical: if Assets carried implicit judgment, the moment one was recorded the analysis would already have committed to a conclusion. Holding Asset as the base layer and applying Known Asset, Owned Asset, and Entity as designations on top preserves analytical discipline and keeps the evidence trail auditable.

The concept has degraded in public usage to the point where some researchers in the field have stopped using it in serious work. Researchers like Stanford IO, for instance, often avoid "bot" in favor of more specific descriptions of observed behavior (e.g., "accounts exhibiting automated posting patterns"), others use "account demonstrates bot-like behavior". The word now carries so much accumulated imprecision that using it invites misreading even when defined carefully. In external communications, 'bot' is frequently used to describe any inauthentic or coordinated account; LetsData analysts distinguish automation and coordination as separate analytic axes.

Unlike bot, which names a property of an individual account, bot network names a phenomenon that exists only at the group level. That distinction matters because almost everything analytically interesting in IO happens at the network level, not the account level. A single automated account is a nuisance; a thousand automated accounts acting in concert can shape what trends, what gets seen, and what looks like consensus. The unit of analysis in serious IO work is the network, not the account. A bot network is a subset of coordinated inauthentic behavior (CIB) in which the coordinated accounts are wholly or substantially automated. Most operationally significant networks observed in the wild are mixed (automated, cyborg, and human-operated accounts); therefore, such networks should be characterized as CIB and use the term 'botnetwork' only when automation is the dominant mechanism.

The Breakout Scale is the field's clearest shared vocabulary for impact. Volume metrics (post counts, reach numbers, engagement totals) tell you how much an operation produced; the Breakout Scale tells you how far it traveled, which is the question clients and counterparties actually care about. The scale is also widely recognized —platform policy teams, journalists, and government analysts all read it cleanly without translation friction. Using it where applicable strengthens the legibility of LetsData's findings and signals participation in the IO analytical community.

The industry default — Meta's 2018 definition — anchors CIB to fake accounts on a single platform, which is too narrow for current adversary tradecraft. The opposite failure is treating any coordinated posting as CIB, which collapses the term into "coordination" and loses the inauthenticity signal that makes CIB an analytically distinct category. LetsData's definition holds both conditions: coordination plus inauthenticity, jointly. This keeps CIB operational against evolving tradecraft (hybrid authentic-inauthentic networks, cross-platform automation, sophisticated sockpuppet operations) without diluting the threshold.

Defining the landscape by target country rather than by origin is the operational discipline that matches reality: the most consequential Influence Operations against any country are typically run from outside it. A landscape defined by origin would systematically miss the engineered cases that matter most — exactly the failure mode Vantage is built to avoid. Holding "Country's Information Landscape" as a defined term, with explicit assignment criteria, makes the scoping reproducible and defensible. Users can verify why a given Asset is or is not part of their country's landscape, and analysts apply the same logic across engagements.

Deepfake is the term in common public, customer, and regulatory use for AI-generated synthetic media. LetsData uses it directly rather than coining an alternative.

DISARM is a young framework compared to MITRE ATT&CK, which has had two decades of adversary observation, community contribution, and operational refinement behind it. DISARM does not have that maturity yet. The technique definitions are sometimes loose, the coverage is uneven, and the framework is still actively evolving. We use it anyway, because it is the only framework that focuses entirely on Influence Operations — every other adjacent taxonomy (MITRE ATT&CK, the cyber kill chain, STIX/TAXII) was built for cyber tradecraft and treats IO as a marginal extension at best. DISARM is the best available reference for the work LetsData does, and being immature is not a reason to abandon a category-correct framework in favor of a more mature framework built for a different category. Adopting DISARM also signals participation in the IO community of practice — analysts, government bodies, and platforms that use the same taxonomy can read each other's findings without translation friction. The maturity gap is a reason to engage with the framework's evolution, not to use a worse-fitting alternative.

The disinformation label carries weight only when the discipline of evidence-for-intent is preserved. Casual or political use of "disinformation" to mean "content I disagree with" is the failure mode the term must guard against.

Known Asset status is not a yes/no judgment made at a single moment. It is the result of evidence accumulating over time, from multiple observations and indicators, with the strength of the underlying case changing as new evidence appears or old evidence weakens. Evidence Score makes that accumulation explicit and structured: a single tracked measure with named thresholds (Possible, Probable, Confirmed) rather than analyst-by-analyst judgment. This is what gives the Known Asset designation its weight — it is the threshold output of a logged process, not a one-time call.

One term, applied consistently, lets LetsData describe organized information manipulation across every context in which it occurs — geopolitical, commercial, financial, electoral. The term commits to action as the end goal, which separates LetsData's analysis from the communications-and-perception frame and aligns with the security buyers we serve. Doctrinal alternatives each carry assumptions tied to a specific institution or actor type and restrict where the term reads cleanly. Influence Operation travels.

Landscape is the analytical word that fits what narrative intelligence does — Vantage maps and surveys a defined terrain, the way cartography maps physical territory. Defining the landscape by who is targeted, rather than by geography of origin, is the operational discipline that matches reality: most influence activity reaching a population originates outside that population's geography. A landscape defined by origin would miss the engineered cases that matter most. Doctrinal alternatives carry institutional baggage — Information Environment reads military, Information Space reads policy, Information Ecosystem reads platform-regulation. Landscape is operationally neutral and aligns with the activity itself. It also makes scoping explicit, which is the discipline customers need: every engagement begins with a landscape definition.

Information Warfare names the strategic condition that gave rise to LetsData and that defines the operational reality many clients face. The term is reserved for that strategic-frame use. Day-to-day, LetsData uses more precise terms — Influence Operation for the engineered activity, Narrative for the structural pattern, Known Asset for the producer with track record. Holding Information Warfare at the strategic-frame level prevents it from collapsing into a synonym for any single one of those activities, and preserves its weight when invoked in defense, government, and founder-narrative contexts where the term carries meaningful institutional recognition.

The Intelligence Brief is what gives leadership a defensible operating picture without making them users of the platform. It encodes the rhythm of the engagement and prevents the failure mode where an executive only sees what reaches a Point Alert threshold — missing the slow-moving structural shifts that matter most over weeks and months. The plain-language, forward-ready format is what makes the Brief load-bearing: it must function as a document that travels through an organization, not as an in-product view that requires interpretation.

An Analyst Investigative Report is the deliverable for situations the automated layer cannot resolve. It is human-written, not generated — produced by trained analysts using Vantage data alongside open-source investigation, infrastructure analysis, and tradecraft expertise. Each Report contains a full attribution analysis (who is behind the activity and what their likely intent is), network and coordination mapping (how Assets, platforms, and Narratives connect), authenticity assessment (distinguishing organic activity from manufactured campaigns), and actionable recommendations (specific steps for response, escalation, or monitoring).

The Known Asset designation lets LetsData mark Assets that warrant elevated scrutiny without making claims the evidence does not yet support. It separates three questions that the field routinely conflates: does this Asset show patterns consistent with Influence Operation behavior (Known Asset), who is behind it (Entity), and what is it doing right now (Operation activity, Incidents). Holding those three questions apart is what makes Vantage's findings defensible to clients, regulators, and counterparties. The Evidence Score (Possible / Probable / Confirmed) makes the strength of the designation visible, so the customer can act with calibrated confidence rather than treating every flagged Asset identically.

Without the term, hack-and-leak operations and selective releases get mis-labeled as disinformation, weakening the analysis when the targeted party can verify the content is real. Malinformation names the category accurately and preserves analytical credibility.

Media Outlet names a venue type that is structurally different from a Platform or a generic Website. Editorial identity carries weight — both genuine and fabricated. When Vantage detects a Narrative crossing into a Media Outlet, the analytical implication is different from the same Narrative gaining traction on a Platform. The term also lets analysts distinguish the outlet itself (the editorial entity) from the specific Assets it operates (its X account, its YouTube channel, its website domain).

Distinguishing misinformation from disinformation forces analytical precision. Treating sincere downstream sharers as deliberate disinformation actors is both factually wrong and corrosive to the credibility of the analysis. The discipline of separating the two is core to LetsData's defensibility.

MITRE ATT&CK is the frame security operations teams already think in. When LetsData findings need to land with a SOC, a CISO, or a cyber threat intelligence team, mapping observable behaviors to ATT&CK technique IDs makes the work immediately legible — no translation friction, no need to argue methodology before delivering findings. ATT&CK also carries two decades of community refinement that DISARM does not yet have, which means ATT&CK technique definitions are sharp and uncontested in their domain. Where Influence Operation behavior overlaps with cyber tradecraft (malware, phishing, C2 infrastructure, account compromise), ATT&CK is the right reference. Where it does not, DISARM is. The two frameworks are complementary, and using both at the appropriate layers is what lets Vantage's findings travel into both security-operations and IO-analyst contexts without losing fidelity.

Narrative is the central data object of Vantage and the term to which every other concept in the LetsData universe traces back to. Sub-Narratives specify a Narrative; Publications advance a Narrative; Assets produce content that flows into Narratives; Operations target Narratives; Incidents are episodes within the life of a Narrative; Alerts fire on changes to Narratives. Defining Narrative as a structural pattern of meaning that shapes action — not as a story, a topic, or a frame — separates narrative intelligence as a discipline from media analysis or content monitoring. The over-determination of Narratives by Sub-Narratives is the load-bearing intelligence claim: it is why fact-checking alone cannot defeat narrative attacks, and why customers need the structural visibility Vantage provides.

Narrative Intelligence is the category label LetsData defines and uses consistently. Holding the category fixed is what lets LetsData define the space rather than be slotted into adjacent ones. The category commits to three positional claims that distinguish LetsData from every adjacent category: that the unit of analysis is behavior, not content; that the question is who and how, not what; and that the operational value is converting ambient chatter into actionable signal about adversary activity targeting the client. None of the adjacent categories make these commitments.

The term is borrowed from epidemiology and carries an intuitive analytical frame: tracing spread back to a single originating point. LetsData uses it across customer-facing surfaces — Point Alerts, Intelligence Briefs, Analyst Investigative Reports — because it communicates the analytical work (we traced this back to its origin) more directly than alternatives like "first observed instance" or "originating post." Anchoring it to Publication rather than Asset keeps the term precise: Patient Zero is the artifact, not the identity behind it.

Platform is the precise term for the kind of venue where most contemporary Influence Operations are conducted. It distinguishes the algorithmically-mediated, identity-managed, advertising-supported environments (Telegram, X, Facebook, TikTok, Instagram, YouTube) from open-web Websites and traditional Media Outlets, which operate under different rules and produce different behavioral signals. Holding Platform as a category-distinct term lets analysts and the methodology document the differences cleanly.

A deepfake breaking, a coordinated network activating, or an impersonation attempt going viral all collapse into very short response windows. The Point Alert is the deliverable designed for those windows. The "Point" qualifier separates it from system notifications, generic threshold alerts, and the looser industry use of "alert" — Vantage Point Alerts are interpreted intelligence with an action recommendation, not raw signal.

Publication is the term for the atomic content unit, used consistently across the LetsData universe. It distinguishes the content (the Publication) from the producer (the Asset), the meaning being advanced (the Narrative or Sub-Narrative), and the wider engineered activity (the Influence Operation). Without a precise term for the unit, those four layers collapse into "content," which is exactly the conflation that makes content-frame analysis fail.

It is also to unify various namings that come with platform-specific names, for example, Telegram post vs Reels.

The category exists because measurement requires a fixed point. A client cannot tell whether they are being heard, whether they are being drowned out, or whether their narrative is being hijacked unless the Asset they want to measure is held aside as the anchor. Holding Referenced Assets outside the classification pipeline serves that purpose and preserves analytical hygiene — an Asset cannot simultaneously be the subject of analysis and the yardstick analysis is measured against. The term covers both the client's own Assets and trusted external reference points under one operational concept, because the underlying logic — known identity, held aside, used as a measurement anchor — is the same in both cases.

Unlike bot, which names a property of an individual account, bot network names a phenomenon that exists only at the group level. That distinction matters because almost everything analytically interesting in IO happens at the network level, not the account level. A single automated account is a nuisance; a thousand automated accounts acting in concert can shape what trends, what gets seen, and what looks like consensus. The unit of analysis in serious IO work is the network, not the account. A bot network is a subset of coordinated inauthentic behavior (CIB) in which the coordinated accounts are wholly or substantially automated. Most operationally significant networks observed in the wild are mixed (automated, cyborg, and human-operated accounts); therefore, such networks should be characterized as CIB and use the term 'botnetwork' only when automation is the dominant mechanism.

Vantage is the product name encompassing key product capabilities of LetsData. The April 2026 consolidation under one brand replaced earlier internal product distinctions and aligned platform language, customer interface, and external communications under one term. Holding the brand singular avoids the drift that comes from multiple product names being used by different teams for overlapping capabilities.

A Watcher is the specific designation for an individual monitoring an Information Landscape within Vantage, replacing the generic term User with a role-based title that reflects active analytical engagement. This terminology aligns with the platform's foundational metaphors of surveillance and cartography—such as the Information Landscape and Watchtower—characterizing the person as a professional sentinel rather than a passive software consumer. By using Watcher, LetsData emphasizes the specialized nature of narrative intelligence work and maintains consistency with a methodology designed for security and intelligence operations where active monitoring is the primary function.

Website names the open-web venue category cleanly and distinguishes it from the algorithmically-mediated Platform category. The distinction matters operationally: detection signals on Websites differ (domain registration, hosting infrastructure, content linkage patterns), and enforcement options differ (domain-level takedowns, registrar action, hosting provider engagement). Holding the term distinct lets the methodology and the product address both venue types appropriately.