Threat Analysis
Threat modelling for cybersecurity
TL;DR
Threat analysis (threat modelling) is the structured identification of potential threats to IT assets. Methods: STRIDE, PASTA, MITRE ATT&CK, the BSI threat catalogue.
What is threat analysis?
Top threats in 2026 (ENISA Threat Landscape):
- Ransomware (still #1)
- Supply chain attacks
- Phishing and social engineering
- DDoS
- Insider threats
- State-sponsored APTs
- AI-supported attacks (deepfake phishing)
Practical example
An SME in mechanical engineering: the threat analysis identifies the top three — ransomware, industrial espionage (China), and insiders with design data. Protective measures are prioritised accordingly.
Legal framework: Germany and Austria
Under NIS2, threat and risk analysis is not an end in itself but the basis for the mandatory risk management measures. These follow an all-hazards approach and name risk analysis as the first minimum measure (EU: Art. 21(2)(a) NIS2 Directive (Directive (EU) 2022/2555)). The national transposition is largely identical in substance, but differs in the numbering of provisions and in the competent authority.
Germany
Particularly important entities and important entities must implement, as a minimum measure, policies on risk analysis and on information system security (§ 30(2) no. 1 of the German BSI Act (BSIG), BSIG 2025). Threat analysis supplies the input data for this. The competent authority is the Federal Office for Information Security (BSI); methodological references include the BSI threat catalogue (IT-Grundschutz).
Austria
In Austria, threat and risk analysis forms part of the risk management measures under § 32(4) of the Austrian Network and Information Systems Security Act 2026 (NISG 2026) (Netz- und Informationssystemsicherheitsgesetz, BGBl. I Nr. 94/2025). The measures follow an all-hazards approach and cover at least risk analysis (§ 32(4)(a)). The competent authority is the Cybersecurity Authority (Cybersicherheitsbehörde, Austria).