A threat is anything that could cause harm. In security, threats come from many directions. Cybercriminals want money. Nation-states want intelligence. Hacktivists want attention. Insiders want revenge or profit. Natural disasters and accidents cause damage without any intent. A threat is not the same as a vulnerability. A vulnerability is a weakness. A threat is what exploits it. A hurricane is a threat. A data center built below sea level is a vulnerability. Together they create risk.

Threats change over time. Ransomware barely existed a decade ago. Now it is a multi-billion-dollar criminal industry. Supply chain attacks were rare. The SolarWinds breach in 2020 made them a boardroom concern. New technologies create new threats. IoT devices expanded the attack surface. Cloud misconfigurations opened new paths. Remote work dissolved the perimeter. Tracking threats is a full-time job. Threat intelligence feeds, vendor advisories, and industry groups all provide information. The goal is not to eliminate threats. That is impossible. The goal is to understand which ones matter most and prepare accordingly. A threat you have never considered is a threat you cannot defend against. The first step is naming it.

Threat categories

• Cybercriminal — financially motivated attacks
• Nation-state — espionage and sabotage
• Insider — employees or contractors with access
• Hacktivist — ideologically motivated
• Environmental — natural disasters and accidents

A threat is only a problem if it can reach a vulnerability. Remove the vulnerability and the threat loses its target.