Which statement best matches the working definition of a threat used by NIST?
Choose an answer, then check it.
Cybersecurity · Foundations
Threats
On this page 9 sections
In 30 seconds
A threat Any circumstance or event with the potential to harm a system, its data, or the people who rely on it, such as an attacker's plan, a human error, or an equipment failure. Full entry → is anything with the potential to harm a system or its data. NIST defines a threat as any circumstance or event that could adversely affect an organization, its assets, or individuals through an information system. Threats come from actors with different motives: criminals after money, nation-states after intelligence, hacktivists advancing a cause, insiders, and people who simply make mistakes. They take familiar shapes, including malware Software written to harm or infiltrate systems without authorization, a family that includes viruses, worms, trojans, and ransomware, each covered in its own topic. Full entry →, phishing A technique in which messages impersonate a trusted person or organization to trick people into revealing information or taking a harmful action. Full entry →, credential theft The act of obtaining usernames, passwords, or other authentication secrets, usually so they can be reused for unauthorized access. Full entry →, denial of service A condition in which legitimate users cannot reach a system or network resource because a malicious actor has flooded it or brought it down. Full entry →, and data breaches. Because new threats appear constantly, awareness must be continuous.
Why this matters
Threats are the reason cybersecurity exists. Every control, from passwords to firewalls to backups, answers a specific threat, so you cannot understand why security works without knowing what it defends against. Studying threats builds healthy skepticism: you learn to notice when something is asking for your credentials, your money, or your trust. The landscape shifts constantly, so the skill is not memorizing today's attack list but staying alert as a habit. For students, threats are the entry point to every later security topic; for everyone, knowing the adversary by name is the first step toward not becoming a victim.
The college version
What a threat is
The word "threat" gets used loosely, so it helps to start from the definition security professionals actually use. NIST, the U.S. agency that sets many security standards, defines a threat as any circumstance or event with the potential to adversely impact organizational operations and assets, individuals, other organizations, or the Nation through an information system, typically through unauthorized access, destruction, disclosure, or modification of information, or denial of service. The key word is "potential." A threat exists before anything happens: a criminal group that wants into a network is a threat even while it has not yet struck, and a misconfigured backup job that could destroy data is a threat even though nobody intended harm. NIST also separates the threat from the threat source The origin of a threat: either an adversary with intent and method, or a situation such as human error, structural failure, or disaster, as NIST classifies them. Full entry →. The source is what carries the potential: an adversary with intent and method, or a situation such as human error, structural failure, or disaster. Getting into the habit of naming what could hurt you before worrying about how likely it is becomes the foundation of the whole field.
Who the threat actors are
Most threats trace back to people, and the standard way to sort them is by who they are and what they want. Criminals attack for money: NIST describes criminal groups seeking monetary gain through fraud, identity theft, and extortion, and Microsoft names financially motivated actors as the groups behind ransomware, business email compromise, and phishing. Nation-states and their intelligence services use cyber tools for espionage and work to develop capabilities to disrupt, destroy, or threaten essential services, as CISA describes. Hacktivists act on political or social beliefs; ENISA's threat landscape reporting notes that public administrations are increasingly targeted by hacktivists, primarily through denial-of-service attacks. Insiders are people with authorized access, employees, contractors, and others, who use that access to harm the organization, whether deliberately or by accident, as CISA defines insider threat The potential for a person with authorized access to use that access to harm an organization, whether the act is deliberate or accidental. Full entry →. Careless users count as a threat source in their own right: NIST's risk-assessment guidance lists human errors of omission and commission among the types of threat sources, and NIST's introduction to information security notes that some attackers are simply thrill-seekers. CISA's reminder that protecting cyberspace is everyone's responsibility reflects how ordinary people fit into the picture.
What threats look like
Threats take recognizable shapes. Malware is software written to harm or infiltrate systems; it is a family name covering viruses, worms, trojans, and ransomware, each of which is its own topic. Phishing and the broader family of social engineering attack people rather than machines: NIST describes phishers as individuals or small groups that run schemes to steal identities or information for monetary gain, and CISA groups malware, phishing, and ransomware together among the headline threats it tracks. Credential theft is the business of obtaining usernames and passwords, often through phishing, so they can be reused for unauthorized access. Denial of service is the condition CISA defines as legitimate users being unable to reach systems or network resources because of a malicious actor's actions; a distributed denial-of-service attack uses many machines working together, often a botnet of hijacked devices. Data breaches are the outcome ENISA defines as an intentional attack by a cybercriminal to gain unauthorized access and release sensitive data. None of these need to be studied in technical depth here; the point is to recognize the shapes and know that each one has a dedicated defense topic of its own.
Why they do it
Motivations explain a lot about how threats behave. Money drives criminal groups: fraud, identity theft, and extortion are business models, and ransomware is extortion at scale. Ideology drives hacktivists, who want to publicize a cause or punish an opponent rather than get rich. Espionage drives nation-states, which steal information and develop capabilities to disrupt infrastructure when it suits them. And mischief is real: NIST notes that some attackers break into networks for the thrill, the challenge, or bragging rights in their community. The same threat type can serve different motives. A denial-of-service attack can be a criminal's extortion tactic, a hacktivist A threat actor whose actions are driven by political or social beliefs rather than by money or state direction. Full entry →'s protest, or a state's test of a target, which is why defenders ask "who and why" alongside "what."
A moving target: threats, vulnerabilities, and risk
The threat landscape is not a fixed list. CISA describes the dangers it tracks as serious and ever-evolving, and it publishes alerts, advisories, and a catalog of known exploited vulnerabilities to keep up; ENISA publishes an annual threat landscape, with its 2025 edition analyzing 4,875 incidents across a year. New threats appear constantly and familiar ones mutate, so awareness must be continuous rather than a one-time lesson. Finally, a threat is only one piece of the security picture. NIST defines risk as a function of the likelihood of a threat event and its potential adverse impact. A vulnerability is the weakness a threat could exploit. The three belong to separate topics: threats are the who and what that could hurt you, vulnerabilities are the openings, and risk weighs how likely and how damaging the combination is.
Eli explains
The same idea, in plain words
Explain it like I’m 10
Cybersecurity exists because of threats. A threat is anything that could hurt your computer, your accounts, or your data: a criminal who wants your money, a country that wants your secrets, a scam message in your inbox, or even your own careless click. Threats are possibilities, not events, so the danger is real before anything happens. Some threats come from people with a reason to attack, and others come from accidents and mistakes. The list of dangers never stops changing, so staying safe means staying alert, not memorizing a fixed set of threats and calling it done.
Picture it like this
Think of a threat like a weather warning. A thunderstorm watch means your picnic could be ruined even though the sky is still clear: the danger exists, you know roughly where it comes from and what it could do, and you plan around it. Security teams treat threat reports the same way, reading the forecast from agencies and adjusting their plans as conditions change.
Where the picture stops working
Weather is impersonal and mostly predictable, while most cyber threats come from intelligent adversaries who watch your defenses and adapt to them. A storm cannot decide to outsmart you; a threat actor can, which is why staying current matters more than a weather analogy suggests.
Worked example
The registrar at a community college lists what could harm the student records system. A criminal group sends fake invoices to the finance office, hoping someone pays them (money). A state-sponsored team probes the college's network, looking for weak points (espionage). A hacktivist defaces the public course catalog to protest a board decision (ideology). A student employee leaves a workstation unlocked overnight (careless user). And an aging server fails during a summer heat wave (non-adversarial). None of these has happened yet, but each is a real threat with a named source and a motive. The registrar's next step, weighing which dangers are most likely and most damaging, belongs to the topic of risk.
Key takeaway
A threat is any circumstance or event with the potential to harm a system or its data, and it can come from criminals, nation-states, hacktivists, insiders, or plain human error. Because the landscape changes constantly, awareness must be a continuous habit, and threats must be kept distinct from vulnerabilities and risk.
Quick check
3 questions here, of 5 in this lesson’s practice set. Answers stay hidden until you check.
A small group repeatedly brings down public service websites to protest a government policy, without seeking payment. How would security sources classify this group and its motive?
Choose an answer, then check it.
An analyst says: "The hospital's risk is high because an unpatched server could be hit by a ransomware crew." In this sentence, which element names the threat?
Choose an answer, then check it.
Study tools & related lessonsYou’ll learn to · Common mistakes · Easily confused · Key vocabulary · Related
You’ll learn to
- Define a threat, using the NIST working definition, as any circumstance or event with the potential to harm a system, its data, or the people who rely on it.
- Name the main classes of threat actors, with one factual line about each: criminals, hacktivists, nation-states, insiders, and careless users.
- Distinguish the major threat types, malware, phishing and social engineering, credential theft, denial of service, and data breaches, at a conceptual level.
- Explain the motivations behind threats: money, ideology, espionage, and mischief.
- Explain why the threat landscape changes and why awareness must therefore be continuous.
- Distinguish a threat from a vulnerability and from risk, and place threats within the risk picture.
Common mistakes
Using "threat" and "attack" as if they mean the same thing.
A threat is the potential for harm, the actor or situation that could cause it; an attack is the attempt actually happening. The threat exists whether or not anyone has struck.
Assuming threats always come from outside the organization.
Insiders with authorized access, and plain human error, are named threat sources in NIST's and CISA's taxonomies. Some of the most damaging threats start with a trusted person or a simple mistake.
Treating the threat list as fixed once you have heard of the famous ones.
CISA and ENISA describe the landscape as ever-evolving, and both publish continuous updates. New threats appear constantly, so awareness has to be a habit, not a one-time lesson.
Confusing a threat with a vulnerability or with risk.
A vulnerability is the weakness that could be exploited, a threat is who or what could exploit it, and risk weighs how likely that is and how much damage it would do. They are three different pieces of the picture.
Believing only big organizations get targeted.
Phishing and credential theft target individuals directly, and CISA's guidance speaks to individuals and families as well as businesses. Being small does not make a person or a school invisible to threats.
Easily confused
Threat vs. Vulnerability
A threat is who or what could harm a system, such as a criminal group or a misconfigured job; a vulnerability is the weakness that could be exploited. One is the danger, the other is the opening.
Threat vs. Risk
A threat is the potential for harm, while risk weighs the likelihood of a threat event and the size of its impact. Threats are part of the risk calculation, not the same thing as it.
Adversarial threat vs. Non-adversarial threat
An adversarial threat comes from an actor with intent, such as a criminal or a nation-state; a non-adversarial threat is a situation such as human error, equipment failure, or a natural disaster. Both can damage systems, but only the first adapts and chooses its target.
Key vocabulary
- threat
- Any circumstance or event with the potential to harm a system, its data, or the people who rely on it, such as an attacker's plan, a human error, or an equipment failure.
- threat actor
- A person, group, or state that carries out or could carry out harmful actions against systems, such as criminals, hacktivists, nation-states, or insiders.
- threat source
- The origin of a threat: either an adversary with intent and method, or a situation such as human error, structural failure, or disaster, as NIST classifies them.
- malware
- Software written to harm or infiltrate systems without authorization, a family that includes viruses, worms, trojans, and ransomware, each covered in its own topic.
- phishing
- A technique in which messages impersonate a trusted person or organization to trick people into revealing information or taking a harmful action.
- credential theft
- The act of obtaining usernames, passwords, or other authentication secrets, usually so they can be reused for unauthorized access.
- denial of service
- A condition in which legitimate users cannot reach a system or network resource because a malicious actor has flooded it or brought it down.
- data breach
- An incident in which information is accessed or disclosed without authorization, typically an intentional attack aimed at stealing sensitive data.
- hacktivist
- A threat actor whose actions are driven by political or social beliefs rather than by money or state direction.
- insider threat
- The potential for a person with authorized access to use that access to harm an organization, whether the act is deliberate or accidental.
Sources & references
- NIST Computer Security Resource Center Glossary — threat — National Institute of Standards and Technology (NIST)
- NIST Special Publication 800-30 Rev. 1: Guide for Conducting Risk Assessments — National Institute of Standards and Technology (NIST)
- NIST Special Publication 800-12 Rev. 1: An Introduction to Information Security — National Institute of Standards and Technology (NIST)
- CISA: Cyber Threats and Advisories — Cybersecurity and Infrastructure Security Agency (CISA)
- CISA: Understanding Denial-of-Service Attacks — Cybersecurity and Infrastructure Security Agency (CISA)
- CISA: Insider Threat Mitigation — Cybersecurity and Infrastructure Security Agency (CISA)
- Microsoft Security Intelligence: Microsoft threat actor naming — Microsoft Learn (Microsoft Security)
- ENISA: Threat Landscape — European Union Agency for Cybersecurity (ENISA)
EliExplains lessons are original prose written from the open, credible references above. See Copyright & Licensing.
Researched 2026-08-21
Educational content only. It is not medical, legal or professional advice. Found an error? Tell us.