Back 
Co-authored by James Robinson and Nathan Smolenski
2020 was a tough year. As security leaders, we faced new challenges in protecting applications and users who were shifting rapidly off-premises and into the cloud, and our security teams’ workloads grew at an unprecedented rate. In 2021 and 2022, CISOs need to prioritize ensuring that we’re focused on the right things. With Blackhat and DefCon shaping up to be the first large, in-person cybersecurity event, it’s a great time to ask what threats are we facing now, and what do we expect to be coming at us in the next 18 to 24 months?
Currently, most CISOs are firmly focused on the threats right in front of our faces, not on leveraging known intelligence to understand what may be just past the horizon. The majority of security professionals are just now beginning to realize that most threats entering companies these days are coming through cloud infrastructure—already a reactive approach to security in this time of transition will not reflect well on us over the next few years. Many of the models we use such as MITRE ATT&CK are robust, but too often can quickly fall behind the times, while not focused on the future. Meanwhile, our teams, the news, and the intel community see newer methods that are on the edge of becoming new attack vectors.
To support better communication with our teams and leadership, security leaders need to develop a systematic process for understanding the threats we faced yesterday and will face today, tomorrow, and beyond. There are a variety of approaches to threat modeling. At Netskope, we have a regimented process. At least once a year, our security team systematically measures our threat exposures. We make sure we thoroughly understand each one, rating its relevance, velocity, and potential impact on infrastructure and business operations. Then, we generate a graphical depiction of the threat landscape specific to our company—a visual tool that can be understood by staff and management at every level, regardless of technical expertise.
This doesn’t guarantee that we won’t be blindsided—no model does—but the three-step exercise outlined below helps us understand, communicate, and prepare for the threats we will likely face in the near future. These threats help us to focus our efforts, communicate clearly, understand