Threat

In security, a threat is any event, action, person or entity with the capability to compromise a system, a network, an application or data.

Threats vary in nature and in scale, from a specific attack technique to a general risk to information security.

Understanding them is what makes it possible to build a defence around what is likely rather than around what is imaginable.

External and internal

External threats come from outside the organisation: criminal groups, state-aligned actors, opportunists and automated tooling. They include malware, ransomware, phishing and denial of service, among many others.

Internal threats come from unauthorised action or from negligence inside the organisation, by employees, contractors or partners. They are harder to detect for a structural reason: the activity is being performed by an identity that is supposed to have access.

The distinction is useful for reasoning about detection, and it should not be read as a division of effort. Most serious external intrusions end up looking internal, because the attacker is using somebody’s credentials.

Threat, vulnerability and asset

Three terms that only mean something together, and that get used as if they were interchangeable.

The threat is the possible source of harm: who or what might act.

The vulnerability is the weakness that would let them succeed. A catalogued one has a CVE; most of the ones that matter in an application do not, because they are logic and authorisation flaws rather than known software defects.

The asset is what would be harmed, and it is the term most often skipped. An organisation that cannot list its assets cannot say what a threat is a threat to.

Risk is what you get when all three are present at once, and that is why a vulnerability with no plausible threat and no asset behind it is not an emergency, while an unremarkable weakness in front of the thing the business runs on is.

Two disciplines take this apart in opposite directions. Threat modelling starts from a design and asks how it could fail. Threat intelligence starts from what adversaries are actually doing and asks which of it applies here. The second one is what stops the first from becoming a list of everything that is theoretically possible.

A worked example

An organisation runs an email platform for internal and external communication.

An employee receives a message that appears legitimate, asking them to follow a link and update their sign-in credentials because of an alleged security incident.

The message is a phishing attack designed to capture those credentials.

If the employee complies, the attacker gains access to the mailbox and to whatever else that account can reach.

The threat here is the phishing campaign. The vulnerability is that a password alone is enough to sign in. The asset is the mailbox and everything reachable from it. Changing any one of the three changes the risk, and the cheapest of the three to change is usually the second.

Where to read more

MITRE ATT&CK: a knowledge base of the tactics and techniques adversaries actually use, and the most practical way to turn the abstract word threat into something you can test against.

CISA, cyber threats and advisories: alerts and guidance on current threats, including the catalogue of vulnerabilities known to be exploited.