Threat Action

Definition

Threat Action in the context of IT Security Risk is the specific set of activities used by a Threat Actor to create a Cyber Incident

Threat actions describe what the threat actor(s) did to cause or contribute to the incident. Every incident has at least one, but most will comprise multiple actions (and often across multiple categories).

VERIS Taxonomy of Threat Actions

The VERIS taxonomy recognizes 7 distinct actions:

• Malware
• Hacking
• Social Engineering
• Misuse
• Physical Action
• Technical Error
• Environmental Hazards