The Threat Landscape

Identify the full range of adversaries, attack vectors, and motivations facing a real network so you can prioritize defenses where they will actually matter.

The Attack That Started with a Thermostat

In 2017, an unnamed North American casino lost 10 gigabytes of high-roller data to attackers who got in through a fish tank thermometer. The smart device was connected to the casino's main network for remote monitoring — and it had default credentials, an unpatched firmware, and no network isolation. From the thermometer, attackers pivoted to the database server holding the high-value customer list and exfiltrated it before anyone noticed unusual traffic.

That story gets told a lot because it is funny and absurd. But it illustrates something serious: the threat landscape is not just hackers at keyboards typing furiously. It is every device, every credential, every misconfigured service, and every person with network access — any of which can become the entry point for something much worse.

Understanding the threat landscape means mapping the full picture of what could go wrong, who could cause it, and how — before the incident, not after. The organizations that do this well are not necessarily the ones with the biggest security budgets. They are the ones that have spent time thinking carefully about which threats actually apply to them.

Who Is Actually Out There

Security training has a habit of making every attacker sound like a sophisticated nation-state operative. The reality is messier and, in some ways, more unsettling — because the most common threats require almost no sophistication at all.

TechPulse's security lead Meera spent her first month building a realistic threat profile for the company. The honest answer was: 80% of their risk came from opportunistic attackers and phishing campaigns, 15% from financially motivated groups that target mid-size SaaS companies for customer data, and perhaps 5% from insider risk given their growth stage and high employee turnover in the Support team. Nation-state actors were not on the priority list — not because the threat is impossible, but because no finite security budget should be distributed equally across unequal risks.

Attack Vectors: The Routes In

An attack vector is the specific path an attacker uses to gain access — the door, window, or ventilation shaft in the physical security analogy. Networks have many vectors, and the most dangerous ones are often the most mundane.

Malware Families: What Gets Deployed Once Inside

Getting past the perimeter is the beginning, not the end. Once an attacker has access, they typically deploy software to maintain that access, move further into the network, and eventually accomplish whatever goal brought them there. These tools have distinct signatures that security teams learn to recognize.

The network behavior column in that table matters enormously. Every piece of malware eventually has to communicate — with a command-and-control server to receive instructions, with the attacker to exfiltrate data, or with other infected hosts to spread. That communication is the telltale pattern that well-configured network monitoring catches. This is why traffic analysis is not optional; it is often the only way to find sophisticated malware that successfully hides from endpoint tools.

Threat Intelligence: Knowing Before You Are Hit

Threat intelligence is the practice of collecting, analyzing, and acting on information about the threat actors, techniques, and indicators relevant to a specific organization. Done well, it lets a security team shift from purely reactive — finding out about attacks when they land — to at least partially predictive.

Intelligence comes in different forms. Indicators of Compromise (IoCs) are specific, technical artifacts: a malicious IP address, a domain name used for command-and-control, a file hash matching a known malware sample. These are easy to share and consume, but also the fastest to change — an attacker can rotate infrastructure in hours. Tactics, Techniques, and Procedures (TTPs) describe how attackers operate at a behavioral level: what tools they prefer, how they move laterally, how they exfiltrate data. TTPs are slower to change and therefore more durable intelligence.

The most widely used framework for organizing threat intelligence is MITRE ATT&CK — a publicly available knowledge base that catalogs the tactics and techniques observed from real-world adversaries. Security teams use it to map their detection coverage: which attacker behaviors can they actually see in their logs, and which would pass through completely undetected?

Risk: Probability Meets Impact

Not every threat in the landscape demands the same response. The concept that connects threat knowledge to resource allocation is risk — a function of how likely a threat is to materialize and how damaging the result would be. High likelihood with low impact is a nuisance. Low likelihood with catastrophic impact still demands preparation. High likelihood with high impact is an emergency.

Meera's threat model for TechPulse used a hybrid approach. She built a simple risk matrix mapping their identified threats against asset value — the production database containing customer PII sat in the top-right quadrant of high likelihood and high impact, which made it the first priority for additional controls. The legacy reporting server in the co-location facility had moderate exploit likelihood but minimal business impact if compromised on its own, so it went on the deferred list while higher-value targets got attention first.

Building a Threat Model for TechPulse

A threat model is a structured document — or diagram, or spreadsheet — that answers four questions about a specific system or organization: what are we building or protecting, what could go wrong, what are we going to do about it, and did we do a good enough job? The last question is what keeps it alive rather than becoming a document that gets filed and forgotten.

The most widely taught threat modeling methodology is STRIDE, which Microsoft developed in the late 1990s. It categorizes threats into six types: Spoofing (pretending to be someone else), Tampering (modifying data), Repudiation (denying an action took place), Information Disclosure (data ending up where it should not), Denial of Service (making a service unavailable), and Elevation of Privilege (gaining more access than authorized). For each system component, a team works through the STRIDE categories and asks whether each type of threat applies and whether there are controls in place to address it.

Threat modeling is not a one-time activity. Every time TechPulse ships a new feature, migrates a service, or onboards a third-party integration, the threat model needs to be revisited. The organizations that treat it as a living document — updated with every significant infrastructure change — tend to catch problems in design rather than in production.

What the Landscape Means for How You Defend

Every lesson from here forward builds a specific control or detection capability. The threat landscape gives you the context for why each one exists. Firewalls exist because uncontrolled network access is how opportunistic attackers find their footing. Intrusion detection exists because prevention is imperfect and some threats will always get through. Network segmentation exists because lateral movement after initial access is how small breaches become catastrophic ones.

The controls are not ends in themselves — they are answers to specific questions in the threat model. When you understand that, the difference between a security team that follows a checklist and one that actually protects their organization becomes clear. Checklist security adds controls in the order they appear on the list. Threat-informed security adds controls in the order the landscape demands.

Quiz