Threat Actor Mapping Methodology (TAMM) – DISRUPT Toolkit

Attribution in the influence operations space has historically been inconsistent: different organisations use different criteria, different terminologies, and different thresholds, making it difficult to compare findings or build cumulative knowledge across cases. The TAMM addresses this directly by providing a shared framework for conducting, classifying, and sharing threat actor attributions. The three taxonomies — covering actor relationships, influence operation characteristics, and naming conventions for Information Manipulation Sets — are designed to be interoperable rather than proprietary, which is the right design philosophy for a field that depends on cross-organisational collaboration.

The decision to publish this as a consultation document rather than a finished standard is analytically and strategically sensible. Attribution frameworks derive their value from adoption, and adoption requires that practitioners have genuine input into the criteria being applied. For organisations currently developing or refining their own threat actor tracking systems, the TAMM provides a reference point and an opportunity to shape a standard before it becomes entrenched. The DISRUPT Toolkit framing positions it within a broader operational architecture rather than as a standalone academic exercise.