Step 3 evaluates the enemy as a fighting force: capabilities, doctrine, strengths and weaknesses, organization, and the likely employment of all this in the environment analyzed in Step 2. Where Step 2 asked "how does the environment affect operations?", Step 3 asks: "how will the enemy exploit that environment?"
A threat is any actor capable of affecting friendly operations through intent, capability or opportunity: conventional forces, SOF, insurgents, terrorist organizations, proxies, criminal organizations, cyber actors, EW units and unmanned systems. Always assess both capability and intent.
| Characteristic | Key question |
|---|---|
| Identity / Composition | Who is the enemy and which units does he have? |
| Disposition / Strength | Where is he located and with how many? |
| Capability / Doctrine | What can he do and how does he fight? |
| Logistics / Leadership | Can he sustain and who commands? |
| Morale / Readiness | Is he willing to fight and how fast can he react? |
Order of Battle (ORBAT)
The ORBAT describes the organization, structure and disposition of enemy forces. A complete ORBAT contains six components:
- Identification — unit designation, higher headquarters, type, national affiliation;
- Organization — brigade → battalion → company → platoon, with command relationships;
- Equipment — tanks, IFVs, APCs, artillery, air defense, UAVs, engineering, logistics;
- Strength — personnel, vehicles, weapon systems; distinguish authorized, actual and operational strength;
- Disposition — current locations, positions, assembly areas, logistics nodes, command posts;
- Activity — what the unit is doing now: digging in, reconnoitering, repositioning artillery, laying obstacles, resupplying.
Enemy 12th Mechanized Brigade (commander: Col. Ivanov): 1× tank battalion, 2× mechanized battalion, artillery battalion, air defense battery, engineer company, reconnaissance company, logistics battalion.
An ORBAT is never built from a single report. HUMINT provides identification, SIGINT command relationships, IMINT equipment counts, GEOINT locations, OSINT public reporting, TECHINT capabilities, patrol reports tactical observations. Fusion of sources increases confidence.
Doctrine analysis
Doctrine analysis examines how the enemy normally fights: how attacks are conducted, how defenses are organized, when reserves are committed, how artillery, engineers and reconnaissance are used. Doctrine is the baseline against which current behavior is compared.
Whoever knows the doctrine can distinguish between expected behavior, unusual behavior, and indicators of changing intent. Deviation from doctrine often signals a different COA.
Doctrine: artillery fires begin 30 minutes before an attack; engineers breach obstacles immediately before the assault; air defense advances with lead battalions.
Observed: engineers move forward without artillery preparation.
Assessment: possibly a deception operation, or rapid exploitation outside the doctrinal pattern.
Capability assessment and combat effectiveness
The capability assessment determines what the enemy can do — regardless of intent. Always assess capabilities in context of terrain, weather, logistics, readiness and morale, across six categories:
| Category | Key questions |
|---|---|
| Maneuver | Can he attack, defend, delay, withdraw, infiltrate? |
| Fire support | Artillery range, rocket systems, mortars, precision fires, air support |
| Mobility | Bridging, engineer support, cross-country mobility, breaching |
| Air defense | Range, coverage, radar capability, mobility, integration |
| Reconnaissance | UAVs, patrols, SIGINT, ground surveillance radar |
| Sustainment | Fuel, ammunition, maintenance, medical, transportation |
Poor logistics is often the decisive limiting factor. Record the outcome in a capability matrix — a rating (high/medium/low) per capability, with confidence.
Combat effectiveness is more than equipment: leadership, experience, morale, training, readiness, logistics, casualties and communications all matter. A well-led battalion at reduced strength may outperform a poorly led battalion at full strength.
Threat evaluation inevitably reveals intelligence gaps — reserve location, ammunition status, AD disposition, engineer capabilities. Every gap should generate a new PIR or collection task.
Air force example: air ORBAT and IADS doctrine
The ORBAT components stay the same, but the content shifts to the air domain: instead of battalions and companies you count squadrons, GCI stations (Ground-Controlled Intercept) and SAM belts.
| ORBAT component | Air force content |
|---|---|
| Identification & organization | Fighter regiment, squadron, GCI sector, SAM brigade |
| Equipment | Aircraft types, SAM systems, radar types, EW assets |
| Strength | Number of mission-ready aircraft, squadron manning |
| Disposition | Airfield occupancy, SAM positions, radar and GCI locations |
| Activity | Flying hours, exercise patterns, alert status (quick reaction alert) |
IADS doctrine describes how air and ground-based air defense cooperate: how GCI vectors fighters onto targets, how SAM belts overlap (layered defense), and when air defense may engage autonomously versus requiring centralized clearance. Sources shift accordingly: ELINT identifies radar types and thus SAM variants, IMINT counts aircraft on ramps, and deviations in flight patterns (e.g. unusual QRA scrambles) are the air force equivalent of SALUTE indicators.
Deep dive: from kill chain to kill web
To evaluate an adversary, you must understand how he brings weapons and sensors to effect. Classically this runs through a kill chain: a linear sequence, often summarized as F2T2EA — Find, Fix, Track, Target, Engage, Assess. Each link follows the previous one, and that is precisely its vulnerability: break one link (blind the sensor, disrupt the datalink, take out the C2 node) and the whole chain stalls. Traditional SEAD/DEAD and counter-C2 are built on this — find the weakest link.
The kill web replaces that single chain with a mesh of many-to-many paths between sensors, C2 nodes and shooters. Any sensor can feed any suitable shooter; if one path drops out, another takes over. Roles are reassigned dynamically and sometimes AI-assisted; the network is redundant and self-healing rather than linear.
| Kill chain | Kill web | |
|---|---|---|
| Structure | Linear, single path (F2T2EA) | Network, many-to-many paths |
| Vulnerability | Each link = single point of failure | Redundant — one node down ≠ system down |
| Countermeasure | Break the weakest link | Degrade multiple nodes at once |
| Control | Fixed, hierarchical | Dynamic, partly automated |
China develops this explicitly under the labels systems destruction warfare and Multi-Domain Precision Warfare (the PLA answer to the US JADC2/CJADC2). The idea: don't fight platform-versus-platform, but paralyze the adversary's kill chains (sensors, datalinks, C2). AWACS nodes such as the KJ-500 and KJ-2000 orchestrate a network of space, air and ground sensors.
Against a kill web, HVT analysis shifts from platforms to network nodes and datalinks: the critical sensor-fusion node, communications relay or C2 "brain" matters more than a single shooter. Taking out one target rarely degrades the web — targeting must hit multiple nodes at once or the links between them. Tie this to HVT/HPT and fusion analysis: the question is not "which platform?", but "which node, if it drops out, collapses the net?".