From Dots on a Map to Real Foresight
Charts are great. Heatmaps, incident maps, colourful graphs, they’re staples in any analyst’s toolkit. They help us convey complex messages quickly and spot where things are happening. But here’s the problem: they don’t tell us why those things are happening, and without the why, you’re not doing foresight. You’re just summarising the past.
In this article, I want to explore a few common pitfalls intelligence analysts fall into when trying to “predict,” and how we can develop better foresight by going beyond surface-level patterns and interrogating the deeper drivers behind the incidents.
What isn’t foresight
It’s tempting to draw a straight line from where bad things happened to where they’ll happen again. That shortcut feels data-driven, but it can mislead you and your stakeholders.
A heatmap tells you where things are happening. But to forecast effectively, you need to ask:
What’s causing those clusters?
Are those conditions still present?
Could they appear elsewhere?
Let’s say you’re supporting a decision about where to open a new office. You flag a violent crime hotspot in three streets on the south side of the city and recommend avoiding them. But had you asked why that hotspot exists, you’d have discovered it was driven almost entirely by a single bar known for underage drinking and drug issues. That bar’s now closed. The drivers have shifted. So has the threat.
Dot ≠ Driver. Incidents are symptoms. You need to diagnose the disease.
Drivers, Indicators and Catalysts: Your Toolkit for Tactical and Strategic Foresight
Good intelligence should support decisions at multiple levels, from what security staff do tomorrow to how leadership plans for the next year. To do that, analysts need to understand the difference between drivers, indicators, and catalysts, and how each supports both tactical and strategic foresight.
Drivers = deeper structural forces shaping the environment over time
Things like youth unemployment, political disenfranchisement, weak governance.
They help you forecast how the landscape is evolving and what new threats might emerge. Drivers aren’t necessarily visible in incident data, but they explain why some places are chronically volatile and others are not. They change slowly, but they shape the threat environment fundamentally.
Indicators = signals something is happening or about to happen
For example, increased social media chatter, scheduled elections, crowds forming in a city centre.
Indicators tell you that activity may be imminent, which is useful for coordinating a response. But indicators without context can be misleading, that’s where drivers help.
Catalysts = events that trigger a sharp escalation
Catalysts turn underlying tension into action. They can take a simmering situation and make it explosive, fast. Think: a police shooting, the arrest of an opposition leader, or reports of government corruption.
In summary:
Drivers = why threats exist in the first place
Indicators = signposts that something is likely to happen
Catalysts = what would trigger a sharp escalation
Example
You see an uptick in online chatter about protests in District A. That’s an indicator, it might mean something is brewing.
But when you look at the drivers, you learn:
A new tax law is hitting hard in that area
The main employer recently shut down, causing mass layoffs
Police presence is limited, and the area has long been neglected by law enforcement
By examining previous escalations in similar areas, you identify that flashpoints often occur after riot police mobilise, or when politicians make insensitive comments about economic conditions. So you flag the catalysts to watch for:
Riot police being deployed
Unpopular political statements about the economy
Now you have both:
Tactical foresight → There’s a credible risk of unrest in District A this weekend. Tensions will likely increase if the police respond aggressively. Increase monitoring and consider protective measures.
Strategic foresight → This is part of a growing mobilisation movement around economic issues. There’s potential for future actions in other districts with similar grievances.
Why this matters
Without drivers, you don’t understand why threats occur, and you miss the next emerging hotspot. Use drivers to think long-term and guide strategic planning.
Without indicators, you miss the build-up to an event that you could have warned about. Track indicators to monitor evolving risks and guide near-term decisions.
Without watching for catalysts, you miss the moment everything changes, and you’re stuck reacting, not anticipating. Identify catalysts so you know what to pay close attention to.
Final thought
Historical incident data is essential, but it’s only one part of the equation. Real foresight lives in the interplay between drivers, indicators, and catalysts.
Learn to balance them, and you stop being just a describer of patterns, you become a trusted advisor who anticipates what’s coming before it hits.