A targeting trend is a repeatable pattern showing which industries, geographies, technologies, or organisations are being selected by attackers over time. These patterns help security teams judge whether they are in scope, which controls deserve attention, and how attacker focus may shift across campaigns.
How Targeting Trend Works
A targeting trend is not a one-off incident list. It is a pattern across time that shows where adversaries are concentrating effort, which can reveal whether a sector, geography, technology stack, or organisation type is becoming a more attractive target. The value comes from comparing campaigns, not from any single alert.
Security teams use this pattern to separate broad background noise from sustained attention. When the same cluster of victims, industries, or services keeps appearing, it can indicate a durable attacker preference, a profitable intrusion path, or a control gap that is repeatedly being exploited.
What Targeting Trends Tell Defenders
Targeting trends help answer practical questions about scope and priority. If hostile activity is increasing against a particular cloud service, region, or business vertical, defenders can decide whether their own environment sits inside the current blast radius and whether they need to raise monitoring, harden exposure, or brief stakeholders.
They also help distinguish novelty from repetition. A new campaign may be interesting, but a repeated pattern across multiple campaigns is usually more useful for planning because it points to persistent adversary intent rather than an isolated event.
How Analysts Read the Pattern
Analysts usually look for clustering by victim profile, tooling, initial access method, and timing. A useful targeting trend often combines several signals at once: the same industry, the same exposed technology, and the same style of intrusion. That combination is stronger than any single datapoint on its own.
Context matters. A rise in targeting may reflect a newly exposed product, a regional event, a profitable criminal workflow, or a threat actor shifting to easier victims. Good analysis asks what changed in the attacker’s environment and what changed in the victim landscape.
Why Targeting Trends Matter Operationally
Targeting trends are most useful when they influence defensive decisions. They can help set watchlists, inform threat modelling, sharpen detection content, and prioritise mitigation work around the asset groups most likely to be hit next. They are also a reminder that exposure is relative, not static.
Used well, they support a risk-based response: not every observed trend warrants immediate action, but repeated focus on your sector, geography, or stack is a reason to review control coverage and exposure assumptions before the trend becomes a local incident.
Risk and Threat Considerations
Targeting trends can create false confidence if they are read too narrowly. A defender may focus only on the currently popular victim group and miss that attackers often rotate between adjacent sectors, similar technologies, or lightly defended subsidiaries. That makes the pattern useful, but also easy to over-interpret.
Failure mechanism: Repeated targeting against a shared technology, exposed service, or business model can compress attacker effort and turn a broad campaign into a durable exploitation path.
Impact: Organisations that match the pattern may face earlier intrusion attempts, more noisy scanning, or a higher chance that their controls will be tested by the same methods that succeeded elsewhere.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerabilities Are Identified and Recorded | Targeting trends help identify which exposed assets and services are most at risk. |
| ID.RA-03 — Threats, Vulnerabilities, Likelihoods, and Impacts Are Used to Determine Risk | This term is about judging attacker focus over time to refine risk priority. | |
| Recommendation — Use threat context to prioritise assets and services that adversaries repeatedly target. Incorporate observed targeting patterns into risk assessments and control prioritisation. | ||
| MITRE ATT&CK | T1595 — Active Scanning | Targeting trends often emerge from repeated scanning and selection of exposed organisations. |
| Recommendation — Map recurring targeting patterns to scanning activity and tune detections for exposure. | ||
Practitioner Guidance
Why practitioners should care: Treat targeting trends as prioritisation input, not as proof of compromise or certainty of future attack. The practical question is whether the pattern changes what you monitor, harden, or brief this week.
What to watch for: The most useful trends are those that repeat across incidents and align with your own exposure profile, such as the same industry, geography, or externally reachable technology showing up again and again. When that happens, the pattern deserves operational attention even if no incident has occurred in your environment yet.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org