Intelligence led risk: Leveraging threat operations to deliver effective risk management

Keith Nicholson
Additional contact information
Keith Nicholson: Office for National Statistics, UK

Cyber Security: A Peer-Reviewed Journal, 2025, vol. 8, issue 4, 306-320

Abstract: Cyberattacks pose a significant threat to organisations, presenting substantial business risks. Chief executive officers (CEOs) and boards must allocate investments to mitigate these risks effectively. Many leaders, however, struggle to incorporate cyber risk into their broader enterprise risk management strategies, often citing its technical complexity as a challenge. Yet, other risks — such as regulatory or financial — are also technical but do not face the same integration difficulties. This paper contends that cyber risk is challenging not due to its technical nature, but because it is non-deterministic. Unlike other risks, cyberattacks stem from human actions. Humans are unpredictable with diverse motivations, therefore estimating the likelihood of a cyber event is inherently more difficult than forecasting other more deterministic risks. Traditionally, threat operations teams focus on operational goals such as improving protective monitoring and strengthening security architecture. By assessing the intent, capability and opportunity of threats, however, these teams can also aid leadership in evaluating the probability of cyber incidents causing an impact, thereby enhancing overall risk management. This paper introduces a threat operations framework that integrates threat intelligence, hunting and emulation to provide a more precise likelihood assessment. By developing ‘cyber narratives’, these teams can translate technical risks into business risks, offering strategic insights for informed decision making.

Keywords: cyber risk management; threat intelligence; threat operations; cyber narratives; risk mitigation (search for similar items in EconPapers)
JEL-codes: M15 (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/9212/download/ (application/pdf)
https://hstalks.com/article/9212/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:csj000:y:2025:v:8:i:4:p:306-320

Access Statistics for this article

More articles in Cyber Security: A Peer-Reviewed Journal from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().