What is the Threat Landscape?
The threat landscape is the ever-changing ecosystem of cyber risks that organizations face. It includes all known and emerging threats, attack vectors, and adversaries targeting your industry or region.
Threat Landscape in One Sentence
The threat landscape is the full set of adversaries, tools, and techniques in play at a given moment, and it changes continuously as attackers, technology, and regulation evolve.
For example, cloud migration, IoT devices, and interconnected supply chains have expanded the attack surface, giving attackers more opportunities. The threat landscape is "the evolving environment of cyber threats, attack methods, and attack vectors targeting organizations, governments, and individuals."
Key Components of the Threat Landscape
Ransomware & Malware
New RaaS (Ransomware-as-a-Service) groups exploit zero-days and cloud misconfigurations, sometimes using double-extortion or AI-generated deepfakes.
Social Engineering
Phishing, vishing, and AI-driven spear-phishing are on the rise. Even intelligent assistants can be fooled by sophisticated lures.
Supply Chain & Software
Threats now hide in third-party software updates and components. A vulnerability in a widely-used library (e.g. Log4Shell) can create global risk.
Advanced Persistent Threats (APTs)
Well-resourced threat actors conduct stealthy intrusions for strategic advantage such as intellectual property theft or disruption of critical infrastructure.
Cloud and DevOps Attacks
Misconfigured containers, CI/CD pipelines, and APIs offer new entry points for attackers.
Key Drivers
Three forces shape the landscape right now: regulatory shifts, technology trends, and evolving attacker capabilities. For instance, new compliance requirements like NIS2 push organizations to better report breaches, while emerging technologies like AI create both defensive opportunities and new attack vectors.
Why It Matters Now
Understanding the threat landscape helps you prioritize defenses. If attacks in 2026 are focusing on critical infrastructure, a power utility will harden OT networks. If IoT botnets are surging, a bank will focus on DDoS resilience.
Actionable Insights
- Maintain awareness of industry-specific threats and the global environment
- Use threat intelligence dashboards to spot emerging patterns
- Regularly review threat reports (e.g. ENISA's) to understand rising TTPs
Common Pitfalls
- Treating the landscape as static or irrelevant to your organization
- Assuming "we're only a small retailer, ransomware actors won't target us" (supply chains can be compromised)
- Relying solely on legacy signatures and ignoring unknown threats
Practical Tips
- Map the threat landscape to your assets: list critical systems and ask "how could each be attacked?"
- Join industry ISACs or intelligence-sharing communities to get relevant warnings
- Automate threat feeds and threat hunting so you're alerted to trends
How Threat Landscape Tracks It
Threat Landscape is a managed threat intelligence source. It continuously monitors global OSINT and darknet signals, extracts the entities that make up the landscape, and structures them as native STIX 2.1 objects: threat actors, malware families, campaigns, CVEs, TTPs, and indicators, all connected by relationships and backed by full provenance.
That intelligence is delivered one source, two ways: a feed and API (REST and TAXII 2.1) that pipes it into your SIEM, EDR, or TIP, and a platform for analysts with graph visualization, dashboards, digests, darknet monitoring, and an AI Assistant. See how a threat intelligence feed differs from an indicator list.
Frequently Asked Questions
What is the threat landscape?
The threat landscape is the ever-changing ecosystem of cyber threats, attack vectors, and adversaries that organizations, governments, and individuals face. It includes known and emerging threats such as ransomware, phishing, supply chain compromise, and state-sponsored activity, and it shifts as attacker capability, technology, and regulation change.
What are the main components of the threat landscape?
Ransomware and malware, social engineering, supply chain and software compromise, advanced persistent threats (APTs), and cloud and DevOps attacks. Each evolves independently, which is why the landscape has to be monitored continuously rather than assessed once.
How do you track the threat landscape?
With structured, continuously updated intelligence rather than static reports: ingest many sources, normalize them into a standard such as STIX 2.1, correlate the relationships between actors, malware, campaigns, and vulnerabilities, and surface what is relevant to your organization. Threat Landscape is a managed source that does exactly this.
Who is Threat Landscape?
Threat Landscape is a managed threat intelligence source. It structures global OSINT and darknet signals into native STIX 2.1 intelligence with full provenance, delivered as a feed and API for your security stack and as a platform for analysts, including a built-in AI Assistant.
Next Steps
Learn how Threat Landscape Monitoring continuously updates this picture and how proactive intelligence empowers strategic decisions. Also explore Indicators of Compromise and TTPs.
See the landscape structured, with context attached to every actor, campaign, and indicator.