The Risk and Threat Landscape is a structured, evidence-based inventory of all plausible adversarial actors — their capabilities, motivations, and attack methods — together with the emerging technological and geopolitical forces that shape the probability and impact of harm to an organization's information assets. It is NOT a list of known vulnerabilities (that is vulnerability management), NOT a point-in-time snapshot (it continuously evolves), and NOT synonymous with a risk register (the threat landscape is an INPUT that feeds risk registers, not the output itself). A well-formed threat landscape assessment answers three questions: Who wants to harm us and why? How would they do it? What external forces are changing those answers?
Where it stops · what it isn't
- —IS: A forward-looking, intelligence-driven characterization of adversarial intent, capability, and opportunity scoped to a specific organization and its sector
- —IS NOT: A vulnerability scan or penetration test output — those assess exploitability, not attacker motivation or strategic intent
- —IS NOT: A completed risk assessment — threat landscape assessment is a prerequisite input to risk assessment, not the assessment itself
- —IS: Inclusive of both external threats (nation-states, organized crime, hacktivists, opportunistic attackers) and internal threats (negligent insiders, malicious employees, compromised accounts)
- —IS NOT: Generic or sector-agnostic — a valid threat landscape is always scoped to an organization's industry, geography, size, and data profile
- —IS: Continuously updated as the environment changes — a threat landscape brief older than 12 months without interim updates is operationally stale
- —IS NOT: Equivalent to threat intelligence — threat intelligence is raw data; the threat landscape is the synthesized, contextualized picture derived from that data
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
ENABLESRisk Assessment Evaluation and AnalysisVulnerability and Control Deficiency AnalysisInformation Risk ResponseRisk Monitoring Reporting and Communication
REQUIRESThreat Intelligence Sources and FeedsAsset Inventory and Classification
PART OFInformation Security Risk Management (CISM Domain 2)
RELATED TORisk Assessment Evaluation and Analysis
CONSTRAINSSecurity Control Selection and Prioritization