As a cyber security professional, your job may include analysing the current threat status and making 

recommendations for actions based on the intelligence information that you have gathered.

Threat status is the current level of malicious cyber activity and the potential for damage or disruption 

to a computer, network or system. Threat status can include information such as the likelihood of 

a malware or denial of service attack, whether software needs to be updated or patched, whether 

employees need additional training or whether the building premises are secure.

A higher threat status means there is more risk. Each organisation has its own way of labelling the threat 

status. Some use a simple traffic lights system of red (high threat), yellow (medium threat) and green 

(low threat). Others use more complex systems.

In order to determine the threat status, a process such as threat modelling is used. 

Threat modelling is a structured process that is used to identify potential security threats and 

vulnerabilities, determine the seriousness of each threat, and make recommendations on what areas to 

prioritise in order to reduce the threat of attack and protect an organisation’s resources. There are many 

different types of threat modelling processes and tools that are used to determine the threat status and 

make recommendations, and they usually involve the following:

After the risk has been assessed and a threat status is determined, the cyber professional will then make 

a recommendation for what actions to take. This could include suggesting new security procedures, 

acquiring new security tools, such as anti-malware tools, hiring more security professionals, conducting 

testing, such as a vulnerability assessment or vulnerability scan, or additional training for staff. The exact 

recommendations will depend on the type of threat and the level of threat