Threat Management: A Plain-English Overview
TL;DR · the short version
Threat management is the loop of identifying the threats that could hit your organisation, assessing and prioritising them, hunting for and detecting attacker activity, responding when you find it, and learning from each round. It is not the same as vulnerability management, which deals with your weaknesses rather than your attackers, though the two meet when deciding what to fix first. Threat intelligence tells you who is likely to attack and how; threat hunting checks whether they are already inside; the SOC watches for them every day. Leaders track dwell time, mean time to detect (MTTD) and mean time to respond (MTTR), defined consistently and measured from their own incidents. MITRE ATT&CK gives everyone a shared vocabulary for attacker behaviour, and NIST CSF 2.0 frames the Detect and Respond outcomes.
Threat management is how an organisation keeps track of who could attack it, decides which of those threats matter, checks whether attackers are already inside, and responds when they are. It is a loop, not a product: identify, assess, prioritise, hunt and detect, respond, learn, then go round again.
What threat management is, in one paragraph
Vulnerability management asks "where are we weak?". Threat management asks "who is coming, how do they work, and are they here already?". It pulls together four activities that are often run by different people: threat intelligence (learning about attackers), threat hunting (searching for attackers your alerts missed), detection (the alerts and the SOC that watches them) and incident response (containing and recovering). Done well, each one feeds the next.
The threat management lifecycle
- Identify. Work out which threats are relevant to you: the groups that target your sector, the techniques they use, and the systems they would want. Sources include vendor advisories, government alerts, paid and free intelligence feeds, information-sharing groups and your own past incidents.
- Assess. Judge each piece of information. How reliable is the source? How credible is the claim? Many teams use the Admiralty code: a letter from A (completely reliable) to F (cannot be judged) for the source, and a number from 1 (confirmed by other sources) to 6 (cannot be judged) for the information.
- Prioritise. Rank threats by likelihood and impact for your organisation. An actively exploited flaw in a product you run beats a sophisticated group that has never targeted your sector.
- Hunt and detect. Turn the top threats into hunts (time-boxed searches for a specific behaviour) and into detections (rules that alert every time it happens). A hunt that finds nothing is still useful if it leaves a new detection behind.
- Respond. When you find activity, contain it, remove it, recover, and communicate. This is incident response, and it should follow a playbook you have practised.
- Learn. Feed what you found back in: new detections, closed gaps, better intelligence requirements, and updated priorities. Then start again.
Want to practise the hunt step? The Threat Hunt Plan Review gives you six draft plans to critique, and Hunt Desk: Every Hour Costs makes you choose which leads to hunt when analyst time costs money.
Threat intelligence vs threat hunting vs vulnerability management
| Threat intelligence | Threat hunting | Vulnerability management | |
|---|---|---|---|
| Question it answers | Who might attack us, how, and why? | Is an attacker already inside that our alerts missed? | Where are we weak, and what do we fix first? |
| Looks at | Outside information: advisories, reports, feeds, sharing groups | Your own logs, endpoints and network data | Your own systems, software versions and configuration |
| Output | Assessed briefs, indicators, priorities | Findings, or a clean result plus a new detection | A ranked list of fixes |
| Typical owner | CTI analyst | Threat hunter | Vulnerability or infrastructure team |
They overlap in useful ways. Intelligence that a flaw is being exploited should move it up the vulnerability team's list, and should also trigger a hunt, because patching closes the door but does not remove someone already inside.
Who does what
- CISO or CTO: owns threat management, sets the intelligence requirements ("what do we need to know?"), decides what to act on, funds the work and briefs the board. In smaller companies this is often the CTO.
- Cyber threat intelligence (CTI) analyst: collects and assesses information about attackers, separates fact from judgement, and turns it into briefs and indicators people can use.
- Threat hunter: writes testable hypotheses, searches the data, and turns what they learn into detections.
- SOC analysts: monitor alerts every day, triage them, and start the response. Practise that triage in the SOC Log Triage Trainer and the wider log triage labs.
- Incident responders: contain, remove and recover. The IR Playbook Lab walks through a response step by step.
Leaders who receive intelligence rather than produce it can practise the hardest part, deciding what to believe and what to do, in the CTO Threat Brief Review.
Metrics leaders use
Three time-based measures come up in almost every board conversation. We deliberately give no benchmark numbers here: published averages use different definitions and samples, so the useful comparison is your own trend.
- Dwell time: how long an attacker was inside before you detected them. It is the clearest measure of whether your hunting and detection work.
- MTTD (mean time to detect): the average time from the start of malicious activity to detection.
- MTTR (mean time to respond or recover): the average time from detection to containment, or to full recovery. Say which one you mean.
Useful supporting measures include the share of hunts that end with a new or improved detection, how many ATT&CK techniques relevant to you have a tested detection, and how often intelligence led to a concrete action. Write each definition down, including where the clock starts and stops, before you report a trend.
Common frameworks
- MITRE ATT&CK: a public knowledge base of attacker tactics (the goal, such as Initial Access or Lateral Movement) and techniques (how, each with an ID such as T1059 for Command and Scripting Interpreter). Mapping hunts, detections and intelligence to the same technique IDs lets you see coverage and gaps.
- NIST Cybersecurity Framework (CSF) 2.0: six functions: Govern, Identify, Protect, Detect, Respond and Recover. Threat management sits mostly in Detect (Continuous Monitoring, DE.CM, and Adverse Event Analysis, DE.AE) and Respond (Incident Management, RS.MA; Incident Analysis, RS.AN; Incident Response Reporting and Communication, RS.CO; Incident Mitigation, RS.MI), with threat intelligence feeding Risk Assessment (ID.RA) under Identify.
- The intelligence cycle: direction (what do leaders need to know?), collection, processing, analysis, dissemination and feedback. It keeps intelligence tied to decisions rather than to volume.
- NIST SP 800-61 Rev. 3: NIST's incident response recommendations, organised around CSF 2.0.
Where to start this quarter
- Write down three intelligence requirements: the questions leadership actually needs answered.
- Pick one threat that matters to you and run one time-boxed hunt with a written plan and an owner.
- Turn its result into a detection, and map it to ATT&CK.
- Agree written definitions of dwell time, MTTD and MTTR, and measure them from your next incident.
- Rehearse the response. The Cyber War Room lets you lead a full incident as the CISO; a free account includes 3 runs.
Frequently asked questions
What is threat management?
Threat management is the ongoing work of finding out who and what could attack your organisation, judging which threats matter most, looking for signs they are already inside, detecting and responding when they act, and feeding what you learn back into your defences. It joins threat intelligence, threat hunting, detection and incident response into one loop.
What is the difference between threat management and vulnerability management?
Vulnerability management is about your weaknesses: finding, ranking and fixing flaws and misconfigurations in what you run. Threat management is about the attackers: who is likely to come, how they operate, and whether they are already active. The two meet in prioritisation, because a flaw that attackers are actively exploiting should be fixed before one they are not.
What is the difference between threat intelligence and threat hunting?
Threat intelligence is collected and analysed information about attackers, their methods and their targets, used to make decisions. Threat hunting is a proactive search through your own systems and logs for attacker activity that your alerts did not catch. Intelligence often supplies the hypothesis that a hunt then tests.
What is a threat hunt plan?
A short plan written before a hunt starts. It states a testable hypothesis about attacker behaviour, maps it to a MITRE ATT&CK technique, lists the data sources that can show that behaviour, sets the scope and a timebox, defines when the hunt is finished, and names an owner.
What is dwell time in cybersecurity?
Dwell time is how long an attacker is inside an environment before they are detected. Shorter is better, because attackers use the time to steal credentials, move between systems and take data. Measure it from your own incidents rather than borrowing someone else’s average.
What are MTTD and MTTR?
MTTD, mean time to detect, is the average time from when malicious activity starts to when you detect it. MTTR is usually mean time to respond (or to recover): the average time from detection to containment or recovery. Teams define the start and end points differently, so write your definitions down before you compare numbers over time.
Who is responsible for threat management?
The CISO, or the CTO in smaller companies, owns it and decides what to act on. Threat intelligence analysts collect and assess information about attackers. Threat hunters search for activity the alerts missed. The security operations centre (SOC) monitors, triages alerts and starts the response.
Which frameworks are used for threat management?
MITRE ATT&CK describes attacker tactics and techniques, so hunts, detections and intelligence can share one vocabulary. NIST Cybersecurity Framework 2.0 sets out the outcomes, including the Detect and Respond functions. The intelligence cycle (direction, collection, processing, analysis, dissemination and feedback) describes how intelligence is produced.
Sources
- MITRE ATT&CK: attack.mitre.org (tactics, techniques and IDs).
- NIST, The NIST Cybersecurity Framework (CSF) 2.0 (CSWP 29, February 2024): nvlpubs.nist.gov, overview at nist.gov/cyberframework.
- NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: csrc.nist.gov.
Ready to practise the decisions these articles describe?
Run your first Cyber War Room free →One run free with a free account · more runs with Pro