Threat modeling and threat landscape analysis is a structured analytical process within ISACA CRISC's IT Risk Assessment domain that identifies, categorizes, and connects three elements: (1) threat actors — who could harm the organization; (2) threat events — how harm could materialize; and (3) the threat landscape — the current and emerging environment of adversarial capability and intent. Together, these inputs allow a risk practitioner to map which credible threats could exploit which vulnerabilities to trigger specific risk events that impair business objectives. Unlike vulnerability scanning — which asks 'what is weak?' — threat modeling asks 'who would attack us, how, and what would the business consequence be?' It is the upstream analytical step that feeds risk scenario development, business impact analysis, and control prioritization.
Where it stops · what it isn't
- —IS: A business-aligned process for identifying credible threats and the risk events they could trigger — scoped to organizational objectives and assets
- —IS: A structured methodology (STRIDE, PASTA, MITRE ATT&CK, Attack Trees) applied to specific asset and process contexts
- —IS: A living assessment that must be updated as the threat landscape evolves — not a one-time annual exercise
- —IS NOT: Vulnerability scanning or penetration testing — those identify technical weaknesses, not threat actors or business risk events
- —IS NOT: A generic list of all possible threats — it must be scoped to the assets, industry, and adversary profiles relevant to the organization
- —IS NOT: Identical to risk scenario development — threat modeling identifies what threats exist; risk scenario development builds the specific sequence of events, likelihood, and impact (a downstream step)
- —IS NOT: Purely a technical security exercise — CRISC threat modeling must be business-aligned, identifying threats to strategic and operational objectives, not just exploitable CVEs
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
ENABLESRisk Scenario DevelopmentBusiness Impact AnalysisRisk Analysis Methodologies
REQUIRESVulnerability and Control Deficiency AnalysisThreat Intelligence Feeds (CISA KEV, MITRE ATT&CK, commercial)
PART OFCRISC IT Risk Assessment Domain
RELATED TORisk Appetite and Tolerance Definition
CONSTRAINSSecurity Control Prioritization and Investment