Threat landscape

A threat landscape is an aggregate, periodic picture rather than a feed. It is usually described at several levels: global and regional reports such as ENISA's annual Threat Landscape, national assessments, sector-specific assessments from sector CERTs or ISACs, and finally the organisation's own view, which filters the others through its sector, geography, technology stack and visibility. The organisation-level view is what ISO/IEC 27001:2022 clause 4.1 expects to be considered among external issues and what feeds likelihood estimates in the risk assessment; NIS2 Art. 21(2) adds that measures must follow an all-hazards approach, so the landscape should include accidental, technical and physical threats and not only hostile actors.

In Denmark the reference is the annual assessment Cybertruslen mod Danmark, published since 2016, first by the Centre for Cyber Security (CFCS) and, from the November 2025 edition, by Styrelsen for Samfundssikkerhed in close cooperation with, among others, the Danish Defence Intelligence Service. It uses a five-level scale, INGEN, LAV, MIDDEL, HØJ and MEGET HØJ, per purpose category. The 2025 edition kept cybercrime and cyber espionage at MEGET HØJ, cyber activism at HØJ, destructive cyber attacks at MIDDEL and cyber terrorism at INGEN, and for the first time organised the analysis around six attack types: ransomware, data theft, digital fraud, DDoS, manipulation of operational technology and wiper attacks. Such levels change between editions, so any register citing them should record the edition used.

A national threat level describes actors' intent and capability against the country as a whole; it is not a likelihood for a specific organisation. Translating it into risk requires asking which actors have a reason to target this organisation or will hit it opportunistically, which techniques they use, and which of the organisation's exposures match those techniques. Vendor reports such as Verizon's Data Breach Investigations Report or incident-response firms' annual reviews add useful statistics on initial access vectors and dwell times, but reflect the vendor's own customer and case sample, so they are indicative rather than representative.

The landscape differs from threat intelligence in time scale and purpose: the landscape is a strategic snapshot used for risk assessment, planning and board communication, typically refreshed annually; intelligence is the continuous, requirement-driven flow of analysed information that updates the snapshot and drives detection and response. An outdated landscape is a common reason why risk registers keep rating last decade's threats while missing current patterns such as edge-device exploitation, MFA fatigue or supply-chain compromise.