1 Foundations of Threat Analysis

Purpose of threat analysis

Threat analysis is the structured examination of possible or ongoing malicious activity. It connects evidence about an adversary with the systems and weaknesses that the adversary may target, supporting informed decisions about detection, response, and risk reduction.

Threat information becomes useful intelligence when it is assessed and interpreted in context. Cyber threat information can help an organization identify, assess, monitor, and respond to threats; it may include indicators, adversary behavior, vulnerabilities, and suggested defensive actions.

The iterative analysis lifecycle

Organizations may arrange threat-analysis work differently, but a practical lifecycle is iterative rather than strictly linear. Feedback from actions and new findings can guide the next round of analysis.

1. Set the question and scope. Identify the decision the analysis should support, such as whether to patch a public-facing service, investigate suspicious logins, or strengthen defenses for a sensitive system.

2. Collect information. Gather relevant internal evidence, such as logs, alerts, asset inventories, and incident records, as well as external information, such as advisories and threat reports.

3. Process and validate. Organize and correlate the information, check its source and freshness, and distinguish confirmed observations from assumptions.

4. Analyze and assess. Determine what may be happening, which assets and weaknesses matter, how confident the assessment is, and what the potential impact could be.

5. Communicate and act. Present findings in a form useful to decision-makers and defenders. Possible actions include investigating an alert, prioritizing a patch, improving monitoring, or containing an incident.

6. Review and refine. Check whether the action worked, record new findings, and use feedback to guide the next analysis.

Actors, actions, weaknesses, and indicators

Several concepts describe different parts of a security event. Keeping them distinct helps analysts explain what is known and what remains uncertain.

A Threat actor is an individual or group that poses a threat. An actor may be external or an insider; identity or motive may be unknown.

A Tactic is the adversary’s high-level goal—the reason for an action. A Technique is a general method used to pursue that goal. A Procedure is the specific way an actor carries out a technique in a particular operation. For example, seeking initial access is a goal, sending a phishing message is a method, and a tailored email sent to a named employee with a particular link and timing is a specific procedure.

An Attack is an attempt to gain unauthorized access or compromise confidentiality, integrity, or availability. It is an event or operation, not an actor’s identity or a system weakness.

A Vulnerability is a weakness in a system, its implementation, or its security procedures that could be exploited or triggered by a threat source. An internet-facing application with an unpatched flaw that permits unauthorized access is one example.

An Indicator of compromise (IOC) is a technical artifact or observable suggesting that an attack is imminent, underway, or may have occurred. Examples include a known malicious file hash, a suspicious domain, or an unexpected process on a host.

Connecting concepts to an incident

MITRE ATT&CK is a widely used knowledge base that organizes observed adversary behavior by tactics and techniques. It can help defenders describe behavior consistently, but mapping activity to ATT&CK does not by itself prove that a particular actor carried out an incident.

Consider an employee entering credentials on a counterfeit sign-in page. The Threat actor may be unknown. Credential theft may be the actor’s objective, while phishing is the Technique; the crafted email and webpage are the specific Procedure. The attempt to steal credentials is an Attack. If the targeted service also has a known software weakness, that Vulnerability may provide another route into the organization, but it is distinct from the phishing attempt. The suspicious email URL or a related malicious file hash may serve as an Indicator of compromise (IOC).

Assess evidence and reduce risk

Treat IOCs as evidence to investigate, not as a complete account of an adversary. A single observable can have a benign explanation, and an actor can change infrastructure or tools. Assess evidence in context, document uncertainty, and look for related behavior in system and network records. IOC matches should be checked against other evidence to assess possible false positives.

Analysis supports action when it connects likely behavior to organizational exposure. Defenders can reduce risk by patching or otherwise mitigating relevant vulnerabilities, strengthening authentication, limiting privileges, monitoring for suspicious behavior, and preparing response procedures.

Prioritize actions according to the importance of affected assets, the plausibility of exploitation, and potential impact—not merely because a threat report or indicator exists. Threats and vulnerabilities should be considered alongside likelihood and impact when making risk-response decisions.