Cyber Threat Intelligence and Digital Risk Protection
Sector Threat Analysis
We determine from documented sources how groups targeting your sector operate. We convert this into prioritized scenarios tailored to your environment.
What it is
Sector threat analysis examines the groups attacking your sector and their methods. Sources include incident reports, official advisories and technical analyses. Methods are mapped to MITRE ATT&CK techniques. This allows comparison of which techniques could be used in your environment and which you can detect.
Scope
- Identifying groups and campaigns targeting your sector and region
- Mapping initial access, lateral movement and data exfiltration methods to ATT&CK
- Comparing these methods with your technologies
- Defining priority intelligence requirements with management
- Scenario briefs for Red Team operations and exercises
The need
When organizations need it
- When planning next year's security investments and deciding which threats to prioritize.
- When an organization in your sector suffers a serious attack and management asks if the same could happen to you.
- When a Red Team operation or exercise requires a realistic scenario.
Method
How we work
-
Requirements
We document management's key questions as priority intelligence requirements.
-
Collection
We collect incident reports, official advisories and technical analyses, noting source and confidence level.
-
Analysis
We map methods to ATT&CK and identify those relevant to your environment.
-
Delivery
We present the results as a concise assessment for management and as scenarios for technical teams.
Outcome
What you have at the end
You receive a prioritized list of methods targeting your sector and their relevance to your environment. Investment, testing and detection decisions are based on this threat assessment.
Frequently asked questions
How is this different from off-the-shelf threat reports?
General reports are written for all readers. This analysis compares the methods with your systems. It shows which ones apply to you and which you can detect.
How often is the analysis updated?
It is planned as a periodic assessment. If a significant campaign occurs in your sector, an interim update is provided.
Does it relate to ISO/IEC 27001?
ISO/IEC 27001:2022 defines threat intelligence as a separate control in Annex A 5.7. The outputs of this analysis can serve as evidence that the control is implemented.
Cyber Threat Intelligence and Digital Risk Protection
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting