The Development of the DISARM Red Framework in ADAC.io

The DISARM Red Framework is the adversarial counterpart to DISARM’s defensive architecture — a taxonomy of the techniques used to conduct influence operations, designed to map actor behaviour in the same structured, interoperable format that defenders use to classify responses. This report documents two years of framework development under the ADAC.io project (February 2024 – March 2026), covering the iterative refinement process, the integration of practitioner feedback, and the technical work required to maintain compatibility with AI-assisted analysis tools and emerging interoperability standards.

The significance of the Red Framework lies in what structured adversarial taxonomy makes possible: systematic comparison of TTPs across campaigns, automated pattern recognition at scale, and a shared reference that allows different organisations to describe the same technique in the same terms. The report also documents the work done to improve supporting tools and user resources — a recognition that taxonomic frameworks are only as useful as the analyst workflows they enable. For teams building or procuring counter-FIMI detection capabilities, this is a useful technical history of where the framework has come from and what its current architecture supports.