Threat

In formal risk methodology a threat is decomposed into a threat source and a threat event. NIST SP 800-30 Rev. 1 classifies sources into four types: adversarial (individuals, groups, organisations or states acting with intent), accidental (erroneous action by a user or administrator), structural (failure of equipment, software or environmental controls, such as a disk or an aircon unit), and environmental (natural or human-made disasters - fire, flood, power loss). This taxonomy matters because it keeps risk assessment honest: an organisation that models only hackers systematically underweights the accidental deletion, the failed backup and the flooded basement that cause a large share of real losses. A threat becomes consequential only in combination with a vulnerability it can act on and an asset of value; a threat with no corresponding weakness produces no risk.

For adversarial threats specifically, the discipline of threat modelling makes the analysis systematic. STRIDE enumerates categories of what can go wrong (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege); attack trees decompose a goal into steps; and the MITRE ATT&CK knowledge base catalogues the real-world tactics and techniques adversaries use, giving defenders a shared vocabulary for describing behaviour. NIST SP 800-30 assesses adversarial threat events along dimensions of capability, intent and targeting, so that a capable but uninterested actor and an eager but unskilled one are scored differently rather than lumped as "hackers".

Threat intelligence operationalises this at national and organisational level. In Denmark the Danish Resilience Agency (Styrelsen for Samfundssikkerhed, SAMSIK), which absorbed the Centre for Cyber Security (CFCS) in 2025, publishes recurring threat assessments (the national cyber threat picture), rating the threat from, for example, cyber crime and cyber espionage on a qualitative scale; these feed the threat identification step of a risk assessment. Distinguishing a threat from adjacent terms is essential to using any of this correctly: a threat is a potential cause of harm, a vulnerability is the weakness it would exploit, a threat actor is the specific adversary behind an adversarial threat, and risk is the combination of a threat's likelihood with its impact.

A recurring misconception is to conflate threat with risk and act on the scariest-sounding threat rather than the most probable and impactful one; the point of naming threats is to feed a structured assessment, not to drive spending by fear. Another is treating the threat catalogue as static - the threat landscape shifts as new actors, tools and dependencies appear, so threat identification is a repeated activity, not a one-off list. Finally, focusing only on external adversaries ignores the insider, the third-party supplier and the non-malicious failure, all of which the four-type taxonomy is designed to keep in scope.