GRC
Threat sources: the four types every risk assessment should cover
Adversarial, accidental, structural and environmental: the four threat sources an ISO 27001 risk register should cover, with UK examples.
Key takeaways
Threat sources are the causes behind threat events. NIST SP 800-30 groups them into four types: adversarial, accidental, structural and environmental. Adversarial sources are assessed on capability, intent and targeting; the three non-adversarial types on their range of effects, using historical evidence. Walking all four against each critical service gives an ISO 27001 risk assessment a threat list that covers more than attackers.
- Threat source
- In NIST SP 800-30, the cause of a threat event: either intent and a method aimed at exploiting a vulnerability, or a situation and method that may exploit one by accident.
- Adversarial threat source
- Individuals, groups, organisations or states that seek to exploit an organisation's dependence on cyber resources. NIST SP 800-30 assesses them on capability, intent and targeting.
- Non-adversarial threat source
- A threat source with no intent behind it: human error (accidental), equipment or software failure (structural), or a natural or infrastructure event (environmental). NIST assesses these on their range of effects.
- Threat versus hazard
- The NCSC calls intentional sources threats, and events that cause harm without intent hazards. It considers threats through four components: capability, intent, motivation and opportunity.
Your first ISO 27001 risk register is open, and every row is about hackers. Then the auditor asks what happens if someone emails the customer list to the wrong person, or the office loses power. This list of threat sources gives you a way to answer before the question comes.
A threat source is the cause behind a threat event. It can be a person or group that means harm (adversarial), a human mistake (accidental), a failure of equipment or software (structural), or a natural or infrastructure event (environmental). NIST SP 800-30 uses these four types, and they push an ISO 27001 risk assessment past attackers alone.
We chose these four because they come from the US National Institute of Standards and Technology's Guide for Conducting Risk Assessments (SP 800-30 Rev. 1), and because between them they cover intentional harm, human error, internal failures and outside events. Lists of threat-intelligence feeds answer a different question and are left out.
What are the four types of threat sources?
The four types of threat sources are adversarial, accidental, structural and environmental. Adversarial sources intend harm. The other three do not, which is why risk practitioners group them as non-adversarial. Each type is assessed in a different way, so naming the type first tells you which questions to ask next.
The table is the list itself. The sections below give each type the same three parts: what it is, when it matters and what to do about it.
| Type | Typical examples | Typical controls | How to assess it |
|---|---|---|---|
| 1. Adversarial | Organised criminals, insiders, nation-states, hacktivists, competitors | Access control, monitoring, awareness training, incident response | Capability, intent and targeting |
| 2. Accidental | A misdirected email, a misconfigured cloud setting, a deleted record | Training, least privilege, change control, four-eyes checks | Range of effects, from records and near misses |
| 3. Structural | A failed disk, an expired certificate, a faulty update, a failed office UPS | Maintenance, monitoring, redundancy, tested backups | Range of effects, from failure history |
| 4. Environmental | Flood, fire, storm, a grid power cut, a telecoms outage | Site choice, continuity plans, supplier resilience, failover | Range of effects, from historical evidence |
What are adversarial threat sources?
Adversarial threat sources are individuals, groups, organisations or states that set out to exploit your reliance on information and technology. They choose their targets and adapt when you add a control. NIST SP 800-30 assesses them on three characteristics: capability, intent and targeting. That makes adversarial sources the only type with a will of their own.
1. Adversarial: people who mean to cause harm
What it is. Anyone who deliberately sets out to steal, change, expose or disrupt your information. NIST's examples include outsiders, insiders, trusted and privileged insiders, groups, competitors, suppliers, partners, customers and nation-states.
For a UK tech firm, these five actors make a sensible starting list:
- Organised criminals, who want money and use phishing, stolen credentials and ransomware.
- Insiders, staff or contractors who misuse the access you gave them.
- Nation-states, which want intelligence or advantage and are well resourced.
- Hacktivists, who want attention for a cause.
- Competitors, who want your customers, pricing or product plans.
When it matters. Always, but the mix changes with what you hold and who you serve. The UK government's Cyber Security Breaches Survey 2025/2026 found that 65% of medium businesses (50 to 249 employees) had a breach or attack in the previous 12 months. Phishing was the most common type by far.
What to do. For each actor, rate three things. Capability is the skill and resources the actor can bring. Intent is what the actor wants. Targeting is how likely the actor is to pick you rather than anyone. The NCSC's guidance on the fundamentals of cyber risk adds motivation and opportunity, and warns that intent and motivation are not the same thing.
You cannot defend against every actor. The NCSC's basic risk assessment method says it is not practical "to protect your systems and services from every potential threat actor". So write down which actors are in scope and why.
What does non adversarial mean in cyber security?
In cyber security and risk assessment, non adversarial means a threat with no intent behind it. Nobody chose your firm or planned the harm. Human error, equipment and software failures, and natural or infrastructure events are all non-adversarial threat sources. They are judged on how far the damage would spread, not on an attacker's skill or motive.
The NCSC draws the same line with different words. Its guidance calls intentional sources threats and calls events that cause harm without intent hazards. SP 800-30 keeps one word, threat, and splits the sources by type.
Non-adversarial sources are easy to miss because they are quiet. A mistake or a failed part rarely makes the news, so it rarely makes the register.
A risk register that lists only attackers covers one threat source out of four.
2. Accidental: mistakes made while doing the job
What it is. Errors made by people doing their normal work. NIST separates ordinary users from privileged users and administrators, whose mistakes can reach further. Examples include sending a spreadsheet of customer data to the wrong address, leaving a cloud storage bucket open to the internet, or running a command against production instead of test.
When it matters. Whenever people handle personal data or hold admin rights to live systems.
What to do. Reduce the chance and limit the blast radius. Build security awareness into onboarding, give admin rights only to those who need them, and put a second pair of eyes on high-risk changes. Make reporting a mistake quick and blame-free, so near misses reach the register.
3. Structural: equipment and software that fail
What it is. Failures of the hardware, software and environmental controls you own or run. NIST describes them as failures caused by ageing, resource depletion or conditions beyond normal operating limits. Examples include a failed disk, a full log partition, an expired TLS certificate, a faulty software update, or the air conditioning in your comms cupboard giving out.
When it matters. When a single component sits behind a service your customers rely on, and nobody watches its age or capacity. Cloud hosting hands the hardware to the provider, but your own configuration, certificates and code stay yours.
What to do. List the components behind each critical service and ask what happens when each one fails. Monitor capacity and expiry dates, test restores from backup, and keep spares or redundancy where a failure would stop the service.
4. Environmental: events outside your control
What it is. Natural disasters and failures of infrastructure you depend on but do not control. NIST's examples include fire, flood, storms, and power and telecoms outages. For a UK firm, that means flooding, a grid power cut, a fibre break in the street, or a regional outage at your cloud provider.
When it matters. When your office, staff or hosting all rely on one place or one supplier. The National Energy System Operator's review of the North Hyde substation outage shows how far one failure spreads. Late on 20 March 2025 a transformer fire at the substation cut supplies to Heathrow, and the airport closed for most of the next day. Three data centres also lost power and kept running on backup generators.
What to do. Check where your people, premises and hosting depend on a single site, then plan how you would keep working without it. Our page on Annex A 7.5, protecting against physical and environmental threats covers the control that sits behind this item.
Nobody intends a flood. It still takes the service down.
How is a threat source different from a threat event, a vulnerability and a risk?
A threat source is the cause, and a threat event is what that cause does. A vulnerability is the weakness the event exploits, and a risk is the likely harm, combining how likely the event is with its impact. Keeping the four apart stops a risk register from mixing causes, incidents and weaknesses in one column.
| Term | What it means | Example |
|---|---|---|
| Threat source | The cause: a person, a mistake, a failure or an event | An organised crime group |
| Threat event | What the source does or what happens | A phishing email that harvests a password |
| Vulnerability | The weakness the event exploits | No multi-factor sign-in on email |
| Risk | The likelihood of the event and the harm it would cause | Customer data exposed and a contract lost |
One event can have several sources. SP 800-30 gives the example of a server taken offline by an attack, a malicious administrator, an admin error, a hardware fault or a power failure. That is all four types, and one event.
How do you use threat sources in an ISO 27001 risk assessment?
Use the four types as a prompt when you identify risks under ISO 27001 clause 6.1.2. Work through each type against your assets and services, write down the sources in scope, then link each source to threat events and vulnerabilities. Re-run the list at every planned assessment and after any significant change.
- Start from the method you already have. Your Clause 6.1 process sets how you identify, analyse and evaluate risks. This list feeds its first step. It does not replace it.
- Walk each type against each critical service. Ask who would attack it, who could break it by mistake, what could fail inside it, and what outside event could stop it.
- Record the sources in scope, and the ones you rule out. A short reason for leaving out nation-states, for example, shows the auditor a decision rather than a gap.
- Assess each type the right way. Rate adversarial sources on capability, intent and targeting. For the other three, use incident records, near misses and supplier history, because NIST bases their likelihood on historical evidence.
- Feed in threat intelligence. The information you gather under Annex A 5.7, threat intelligence should change your adversarial ratings when an actor's capability or targeting shifts.
- Refresh on a cadence and on change. Clause 8.2 asks you to repeat the assessment at planned intervals and when significant changes happen. A new product, a new market or a new hosting provider brings new sources.
We recommend writing the four types into your risk management policy, so every assessment uses the same starting list. Our risk management policy template has a place for it.
Threat intelligence that never changes a rating in the register is reading, not risk management.
Frequently asked questions
The four types are adversarial, accidental, structural and environmental. Adversarial sources intend harm. Accidental sources are human mistakes, structural sources are failures of your own equipment and software, and environmental sources are natural or infrastructure events outside your control. The grouping comes from NIST SP 800-30, which presents them as general types rather than a closed set, so a cause that fits none of them still belongs in the register.
An adversarial threat has intent behind it: someone chose to cause harm and can adapt to your defences. A non adversarial threat has no intent. It comes from a mistake, a failure or an outside event. Adversarial threats are judged on capability, intent and targeting; non adversarial threats on the range of their effects, with likelihood estimated from past events over a stated period, such as the next year.
Not quite. A threat actor is a person or group, so every threat actor is an adversarial threat source. Threat sources also include mistakes, equipment failures and natural events, which have no actor behind them. In a risk register, threat source is the wider and safer term.
Yes, in more than one way. NIST lists suppliers among adversarial organisations, for the case of deliberate harm. A supplier's staff can also make mistakes that reach your data, and an outage at a provider you depend on but do not control fits NIST's environmental type. Record the supplier under the type that matches the cause.
