Threat Profiling for Your Organisation Guide: Building an Actor and TTP Profile That Drives Defence

Most organisations cannot say which threat actors are most likely to target them, what those actors want or which techniques they use, so detection, testing and risk decisions are tuned to a generic attacker who does not exist. A threat profile fixes that. It is a short, maintained document that names the threat actor categories and specific groups relevant to you, links them to the assets they would target and turns their behaviour into a ranked list of ATT&CK techniques and scenarios that other teams can use. This guide sets out how to build one: inputs, actor selection criteria, TTP extraction, scenarios, outputs for each consumer and a refresh cycle. It is for threat intelligence analysts, security architects and risk leads. For turning the profile into prioritised defences and tests, see the Threat-Informed Defence Guide.

Key takeaways

• Start from what you would lose, not who is in the news. Crown jewels, business processes and dependencies decide which actors matter; headlines decide nothing.
• Profile categories first, groups second. Financially motivated extortion crews, state espionage actors, hacktivists, insiders and supply chain attackers behave differently; named groups are examples within a category.
• The output is techniques and scenarios. A list of actor names is trivia; a ranked set of ATT&CK techniques and three to six plausible scenarios is something detection, testing and risk teams can act on.
• Record assumptions and confidence. NCSC's Cyber Assessment Framework treats the lack of a defined set of threat assumptions as a failure, and an assumption you wrote down is one you can challenge.
• Refresh on a schedule and on triggers. Quarterly review, plus immediate updates when a relevant advisory, incident or business change lands.

What a threat profile is, and what it is not

A threat profile answers four questions for one organisation: who is likely to attack us, what would they want, how would they get it, and how confident are we? It is narrower than a threat landscape report and more concrete than a risk register entry.

See the ENISA Threat Landscape Guide and the Threat-Led Penetration Testing Guide.

Step 1: Establish the business context

Threat relevance follows from what you have and who you are. Capture it before reading any intelligence.

• Crown jewels: the data, systems and processes whose loss would hurt most, for example payment flows, customer personal data, intellectual property, production control systems, and the identity platform that controls access to all of them. Use the Business Impact Analysis Template if none exists.
• Sector and geography: regulated sectors, critical national infrastructure status, countries of operation and any geopolitical exposure such as operations in a conflict region.
• Technology footprint: internet-facing services and edge devices, cloud providers, SaaS platforms, identity providers, OT, and notable third-party software. Edge devices and remote access services drive a large share of initial access (T1190 Exploit Public-Facing Application, T1133 External Remote Services).
• Dependencies and position in others' supply chains: managed service providers, outsourced help desks and software suppliers, and whether you are yourself a route into your customers.
• Your own history: past incidents, red team findings and near misses. These outrank any external report.

Step 2: Select relevant threat actor categories

NIST SP 800-30 Rev. 1 describes threat sources as adversarial, accidental, structural or environmental, and characterises adversaries by capability, intent and targeting. That three-part lens works well for scoring categories:

Score each category for likelihood (intent and targeting fit) and potential impact on your crown jewels, then carry the top three to five forward.

Step 3: Choose representative named groups

Within each category, pick two or three groups that best represent it for you. Good selection criteria:

• Observed targeting: government advisories or ISAC reporting showing attacks on your sector or region in the last 24 months.
• Technology overlap: the group exploits platforms you run.
• Quality of public reporting: a group with a detailed ATT&CK Groups entry and recent joint advisories gives you usable technique data; an obscure group does not.
• Representativeness: its behaviour is typical of the category, so defending against it covers similar actors.

Examples of well-documented groups in ATT&CK v20 include Scattered Spider (G1015), APT29 (G0016), APT28 (G0007), Sandworm Team (G0034) and Volt Typhoon (G1017). Scattered Spider illustrates why category matters more than name: the FBI and CISA joint advisory AA23-320A (16 November 2023) describes help desk social engineering, MFA fatigue (T1621 Multi-Factor Authentication Request Generation), voice phishing (T1566.004) and abuse of contracted help desks (T1199). The MGM Resorts breach began with exactly that kind of help desk call, and any large organisation with an outsourced help desk shares the exposure regardless of sector. See the Threat Actor Groups Guide and the Ransomware Groups Guide.

Step 4: Extract and rank techniques

1. Build one ATT&CK Navigator layer per selected group from its ATT&CK Groups entry and recent advisories, scoring each technique 1.
2. Combine layers: Navigator can create a new layer from existing ones with a score expression such as a+b+c, so techniques used by several of your groups rise to the top.
3. Weight by your context: add your own incident and red team techniques with a higher weight, and drop techniques for platforms you do not run.
4. Apply prioritisation factors: CTID's Top ATT&CK Techniques methodology combines prevalence (from Sightings Ecosystem data, with older observations weighted down), choke points (techniques many attack paths pass through, with T1047 WMI given as an example) and actionability (how many public detections and mitigations exist). Its own limitations are worth quoting in your profile: the prevalence data covers April 2019 to July 2021 and only reflects what contributors reported.
5. Cap the list: 15 to 30 techniques is usable; 200 is not.

Identity techniques usually rank high in this exercise because they recur across categories: T1078 Valid Accounts and T1078.002 Domain Accounts appear for extortion crews, espionage actors and insiders alike.

Step 5: Write threat scenarios

CAF principle A2.b expects organisations at the "achieved" level to take a threat actor's perspective, develop plausible scenarios and map the steps a capable, well-resourced actor would need to reach probable targets, justifying measures at each step. Three to six scenarios is enough. Each should state:

• Actor category and representative group.
• Objective and target: for example "extortion through theft of customer data from the CRM and data warehouse".
• Likely path: initial access, privilege gain, movement, action on objective, each with ATT&CK IDs.
• Existing controls and known gaps at each step.
• Confidence: high, moderate or low, with the evidence behind it.

Scenarios are what risk owners, tabletop facilitators and red teams actually use. See the Cyber Risk Scenario Library Guide and the Tabletop Exercise Scenario Pack.

Recording assumptions and confidence

Every profile rests on judgements. Write them down as numbered threat assumptions so they can be tested and challenged, for example:

• Assumption 1: extortion actors are the most likely category to cause a material incident in the next 12 months (confidence: high; basis: sector advisories, two peer incidents, our own 2025 near miss).
• Assumption 2: state espionage actors have intent but limited targeting of us directly; the more likely route is through our managed service provider (confidence: moderate; basis: advisories describing supplier compromise in our sector).
• Assumption 3: insider data theft is possible but no evidence suggests elevated likelihood (confidence: low; basis: absence of reporting, which is weak evidence).

Use one consistent confidence scale, separate what sources reported from what you inferred, and date every source. When an assumption changes, record why: that history is what auditors and supervisors look for.

Outputs for each consumer

Rolling out and maintaining the profile

1. Scope a first version in four to six weeks: business context, three to five categories, six to ten groups, a ranked technique list and three scenarios.
2. Review with the business: confirm crown jewels and impact with process owners; adjust categories accordingly.
3. Publish to consumers in the formats above, with the analyst's confidence and dated sources.
4. Test the profile: run one scenario as a tabletop exercise and one as a purple team exercise; gaps in either show where the profile is wrong or controls are weak.
5. Refresh quarterly, and on triggers: a joint advisory naming your sector, an incident at a peer, a merger, a new country of operation, a major platform change.
6. Version it: keep previous versions so you can show how assumptions changed and why. If a change proves wrong, revert to the previous technique layer rather than rebuilding.

Small versus large organisations

• Small organisation without a CTI team: rely on your ISAC, national agency advisories and sector landscape reports; profile categories rather than many named groups; one page is enough. See the ISACs and Information Sharing Communities Guide.
• Large or regulated organisation: maintain group-level layers, link scenarios to the risk register and expect supervisors (for example under threat-led testing regimes) to ask for the evidence.

Where identity fits

Identity platforms are a crown jewel in their own right: whoever controls the identity provider controls access to everything else. Add identity assets explicitly to the business context (directory, SSO, privileged access tooling, secrets stores, CI/CD service connections and high-privilege non-human identities such as service principals and API keys). Several categories target them directly, and many scenarios run through valid credentials rather than malware. See the Threat Intelligence for Identity and NHI Guide.

Detection and measurement

• Coverage of ranked techniques: share of the top 15 to 30 techniques with a tested detection.
• Scenario test rate: share of scenarios exercised in tabletop or technical testing in the last 12 months.
• Freshness: days since last review, and time from a relevant advisory to profile update.
• Consumer uptake: number of detections, hunts, tests and risk entries that cite the profile.
• Forecast accuracy: share of real incidents and near misses whose techniques were already in the ranked list.

Framework mapping

Common failure patterns

• Headline-driven profiles: the actors in last month's news are listed regardless of fit, while the boring but likely category (commodity extortion through valid accounts) is underweighted.
• Actor names without techniques: the profile names groups but never produces a technique list, so detection and testing teams ignore it.
• No business input: crown jewels are guessed by the security team and the scenarios target the wrong assets.
• Static documents: a profile written for an audit and not reviewed for two years still lists retired platforms and misses new ones.
• Hidden assumptions and no confidence levels: readers cannot tell which statements rest on strong evidence and which on analyst judgement.
• Ignoring your own position in the supply chain: organisations that serve many customers, such as MSPs and software vendors, are targeted as a route to others and must profile that explicitly.

Practitioner checklist

• Document crown jewels, sector, geography, technology footprint and dependencies with business owners.
• Score actor categories on capability, intent, targeting and impact; keep the top three to five.
• Select two or three representative groups per category with dated sources.
• Build and combine Navigator layers; weight by your own incidents and testing.
• Cap the ranked technique list at 15 to 30 and record coverage for each.
• Write three to six scenarios with paths, controls, gaps and confidence.
• Publish tailored outputs to detection, hunting, testing, vulnerability, risk and third-party teams.
• Review quarterly and on defined triggers; keep versioned history.

Standards and references

• NCSC: Cyber Assessment Framework, Principle A2 Risk Management
• NIST: SP 800-30 Rev. 1 Guide for Conducting Risk Assessments
• MITRE Center for Threat-Informed Defense: Top ATT&CK Techniques
• MITRE: ATT&CK Navigator
• MITRE ATT&CK: Scattered Spider (G1015)
• CISA and FBI: Scattered Spider Joint Cybersecurity Advisory AA23-320A
• ENISA: Threat Landscape 2025
• European Central Bank: TIBER-EU Framework

Related NHI Mgmt Group resources: Threat Intelligence Guide · Threat-Informed Defence Guide · NIST SP 800-30 Risk Assessment Guide · Cyber Kill Chain and Diamond Model Guide