IEM Roadmap:
Building the Methodology in the Open
I’m developing the Intelligence Engineering Methodology (IEM) in public — publishing the thinking as it takes shape. This roadmap tracks the evolution from theory to field-ready engine.
Intelligence Engineering Methodology (IEM) is a research initiative that helps organizations identify, measure, and reduce decision-risk caused by incomplete, disconnected, or low-confidence data.
The Sprint
Define the Discipline
Name the problem and the point of view before any framework detail.
Project, Program, Portfolio & PMO Intelligence
Discipline
Project Gap Intelligence Engineering
Definition
The systematic practice of measuring delivery data gaps across project, program, portfolio, and PMO systems, tracing discrepancies to their root origins, and engineering corrections at the source.
Problem Statement
Organizations suffer from compromised strategic decision-making and hidden project failures due to delivery data that is missing, ignored, disconnected, untrusted, underutilized, misclassified, or divergent across PMO systems.
Manifesto
We relentlessly measure missing, ignored, disconnected, untrusted, underutilized, misclassified, and divergent data, and trace it to its root origin — what looks like a delivery problem is often an intelligence-integrity problem.
Physical + Cyber Security Intelligence
Discipline
Converged Security & Security Gap Intelligence Engineering
Definition
The systematic practice of measuring security and telemetry data gaps across physical and cyber systems, tracing discrepancies to their root origins, and engineering corrections at the source.
Problem Statement
Organizations suffer from compromised security decision-making and hidden threats due to security and telemetry data that is missing, ignored, disconnected, untrusted, underutilized, misclassified, or divergent across physical and cyber systems.
Manifesto
We relentlessly measure missing, ignored, disconnected, untrusted, underutilized, misclassified, and divergent security and telemetry data — because what looks like a security problem is often a visibility and integration problem.
IEM-PM Methodology Tracking
Formalize the Method
- Founding principles (×7)
- Defined the seven types of data gaps and the seven root causes they trace back to
- Created a 0–100 Reporting Integrity Score based purely on the gaps found — not a broader maturity rating
- IEM-PM Blueprint approved — the full 19-part plan and step-by-step audit process
Build the Intelligence Engine
- The complete instruction manual that runs every audit is finished, written and reviewed section by section
- All supporting reference material is done — the gap types, root causes, severity levels, and the detailed step-by-step audit process are all fully written
- Built the full working engine — from the data agreement, through findings, to a finished report — checked automatically for consistency
Proving the Engine on Real Data
- Ran a real audit against 29 real project-management standards — found 4 genuine gaps and scored just over 50 out of 100. Originally planned for later, pulled forward by three weeks
- Ran two more real audits using actual data from a live client engagement — one measured against the client’s own process, one against outside standards — both fully reviewed and approved before running
- Found and fixed several real issues in the scanning tool along the way, including one that had been silently skipping most of the source documents
- Worked out exactly how a standard gets turned into a usable checklist, and proved it on one real document
Checklists and Reports
- Turning every standard into a usable checklist — nine are fully done so far, through a mix of real reviews and two dedicated rounds of focused work; the rest will follow the same way
- The tool now automatically works out how the standards library is organized, so reorganizing those files doesn’t break anything
- The tool that turns findings into a finished report is built and working, plus a second version for cases where there isn’t enough evidence to run a full audit
- Added a new safeguard: if the evidence gathered is too thin to support a credible audit, the process now says so plainly instead of pushing ahead anyway
- Locked in one consistent way of describing findings in plain writing, so the wording matches the major project-management standards instead of drifting between audits
- Automated tests that check the whole system still works are in place and passing
Pilot & Package
- Published a plain-language user guide for project, program, and PMO leads, plus a companion guide for filling out the data agreement step — both now share one consistent, easy-to-navigate design
- Ran the first full real-world audit
- Three rounds of real-world testing have each found and fixed genuine issues — most recently, a live re-run against real standards caught two real data-parsing bugs and sharpened how the integrity score reflects severity
- A real audit of a live, fast-moving client project ran cleanly from start to finish, with results kept in their own private folder separate from other reviews — and correctly caught genuine mistakes in the evidence, including mismatched costs, conflicting dates, and a missing risk entry
- Added a safeguard so each review only looks at the evidence provided for that project, never mixing in details from earlier reviews
- Further pilot runs have continued throughout, each one a fresh, real test of the methodology against real project data
- That same real-world testing showed the fact-checking step was missing a few kinds of contradictions — now fixed, so it checks far more thoroughly across documents
- Finished the behind-the-scenes groundwork needed before others can use it — licensing, setup instructions, naming rules, and error handling
- Packaged as a ready-to-install tool, three weeks ahead of schedule
White Paper
- Foundational white paper published — "Why I Developed Intelligence Engineering Methodology," Revision 1.1.0
Publish v1.0
- Three articles — already underway, publishing on LinkedIn as part of the weekly series
- Updated website messaging
- IEM-PM v1.0 published — week of Aug 24
IEM-CS: Two Swords, One Discipline
The security half of IEM — introduced alongside IEM-PM in Week 1 above — now branches into two parallel, twelve-month tracks: attacking and defending AI systems, and using AI to run security operations.
Scaffolding the Lab
- Local Python environment set up (Poetry, pinned to Python 3.11 for compatibility with the ML tooling)
- Three AI models pulled for local testing (Llama 3.1, Mistral, Gemma 2) — all inference stays on this machine, nothing sent externally
- Vulnerability-scanning and attack-testing tools installed (Garak, PyRIT, promptfoo)
- Lab charter written — scope, risk controls (synthetic data only, 90-day responsible disclosure), and success targets locked in
- First article outlined, built around a real early finding: a poisoned test document successfully redirected a local AI model away from its real instructions
Scaffolding the Lab
- A full open-source security-monitoring stack (Wazuh) stood up locally via Docker — log collection, search, and dashboard all running
- Shares the same local AI models as the other lab, ready to reuse from Month 2 for building an AI-assisted triage assistant
- Lab charter written — scope, risk controls (lab-owned systems only, never production or third-party targets), and success targets locked in
- First article outlined, centered on the real setup snag hit and fixed (a Docker/WSL2 configuration quirk) and what a brand-new security dashboard looks like before anything is connected to it
IEM Series
Read in order
Public working notes while the white paper takes shape.
Each piece is written to accumulate into the IEM-PM working paper — not as disposable tips.
Core names used throughout: Seven Intelligence Gaps · Seven Root Origins · Five Contracts · Audit Manifest · Reporting Integrity Score · No baseline, no audit
- Published2026-08-04
- Published2026-08-05
- ConceptSeven Intelligence GapsPublished2026-08-06
- Published2026-08-07
- Working PaperWhy I Developed Intelligence Engineering MethodologyPublished2026-08-11
- VideoIEM-PM in Motion: IEM-PM ArchitectureUpcoming
- ConceptSeven Root OriginsUpcoming
- Soft LaunchMy first pilot testUpcoming
LinkedIn series tag: #IEMPM. Methodology is published in the open; the implementation repo stays private until packaging is complete.
Read in order
- Published2026-08-10
LinkedIn series tag: #AISecurity. Progress posts every alternate week; both lab repos stay private until content is mature enough to publish deliberately.
IEM in Production
IEM-CS's core question — how do you build AI into a system without letting it become the risk — isn't only a lab exercise. The same discipline is already running in a live, professional context: a multi-tenant security intelligence platform combining unified security/operations/BI reporting with a topology-graph-based system that proves installed security products actually coordinate when real events happen. Its AI layer is strictly human-in-loop — narratives, natural-language queries, and remediation guidance only, with no autonomous actions and no write access to production systems. Real data is flowing today through a live Postgres and Vercel-deployed stack. It's currently in internal validation ahead of an executive review and a client rollout, so specifics stay private until then — but the "AI as capability, not autonomy" discipline is exactly what IEM-CS is building toward in the open.
The Longer Arc
Publish the Body of Work
Regular articles, foundational white papers across both practices, and the shared methodology applied in two domains.
Underway: a practitioner article on PMO data integrity, in draft for ProjectManagement.com.
Validate in the Field
Conference talks, case studies from field observations, and published patterns and research findings.
Update: not selected for PMI Global Summit 2026 — the proposal will be shared internally at PMI for potential webinars, blog contributions, and other learning initiatives.
Codify the Discipline
A long-form reference, and adoption of the shared methodology beyond the founding two domains.
Building in the open
I publish the methodology as it takes shape. Follow along on LinkedIn for new principles, papers, and field notes the moment they’re released.
Follow on LinkedIn