Comparing your organizational security posture against industry benchmarks requires a clear understanding of your own unique threat landscape. You cannot accurately measure your standing against industry peers without first mapping your internal assets, analyzing your business processes, and modeling the specific threats your organization faces.

This guide walks you through the foundational steps to build a threat model and use it to benchmark your security posture against comparable organizations in your industry.

flowchart TD
    A[Inventory Assets] --> B[Map Business Processes]
    B --> C[Identify Threat Communities]
    C --> D[Analyze Capabilities and Motivations]
    D --> E[Benchmark Against Industry Peers]

Benchmarking Workflow

Follow these steps to establish your internal baseline and compare it against industry standards.

1. 1

   Inventory business and human assets

   Before you can protect your organization or compare it to others, you must identify what needs protecting. Assets generally fall into two categories:
   Business Data Assets

   • Personally Identifiable Information (PII) and Protected Health Information (PHI)

   • National Identification Numbers (SSNs, etc.)

   • Financial Accounts (bank, credit, equity)

   • Supplier Data (critical component manufacturers, trade secrets, cost analyses)

   • Partner Data and Cloud Service Account Information
     Human Assets
     Identify personnel who could be leveraged to divulge information, manipulated into making adverse decisions, or used to enable further compromise.

   Human assets are not always at the top of the corporate hierarchy. Often, administrative assistants, technicians, human resources staff, or even third-party contractors hold the keys to physical or logical access that facilitates a breach.

2. 2

   Map business processes

   A business generates revenue by running raw goods or knowledge through processes to create added value. By mapping these value chains, you can understand how specific threat communities might disrupt them.
   Separate your processes into critical and non-critical categories. For each process, map the supporting elements:

   • Technical infrastructure: Networks, servers, and workstations.

   • Information assets: Knowledge bases, legal references, and marketing support materials.

   • Human assets: Personnel involved in approvals, verification, or consultation.

   • 3rd-party integrations: External vendors, such as SaaS providers, that interact with the process.

   Do not ignore non-critical processes. An aggregation of several non-critical business processes can sometimes be combined by an attacker to form a critical flaw.

3. 3

   Identify threat communities

   Define the specific threat agents that target your industry. Identify them by location (internal vs. external) and their specific community.

   Internal Threats	External Threats
   Employees (full-time or part-time)	Business Partners & Suppliers
   Management (executive, middle)	Competitors
   Administrators (network, system, server)	Nation States
   Developers & Engineers	Organized Crime
   Technicians & Remote Support	Hacktivists
   Contractors	Script Kiddies (recreational hacking)

4. 4

   Analyze threat capabilities and motivations

   Once you know who might attack, you need to understand how and why. Build an accurate threat model by analyzing the capabilities and motivations of your identified threat communities.

   Tools and Exploits

   Evaluate the tools available to the threat community. Consider the skill level required to use freely available tools, as well as the community's ability to obtain or develop custom exploits (including access through underground communities or third parties).

   Communication Mechanisms

   Analyze how attackers communicate and exfiltrate data. This ranges from simple encryption to specialist services like bulletproof hosting, drop-sites, and botnets.

   Test your exfiltration detection: Penetration testers should create malware specimens with increasing levels of obfuscation to test the organization's capability to detect modern Command and Control (C2) channels.

   Accessibility

   Determine the threat actor's physical or logical accessibility to your organization and specific assets. This helps create realistic attack scenarios relevant to your actual risk.

   Motivations

   Attacker motivations constantly evolve. Common motivations include direct or indirect profit, hacktivism, personal grudges, reputation building, or using your network as a stepping stone to access a connected partner system.

5. 5

   Benchmark against industry peers

   With your internal threat model complete, you can now validate it against the broader industry.
   Look for relevant news, public breach reports, and incident analyses of comparable organizations within your specific industry vertical. Compare the challenges they faced against your mapped processes and threat capabilities.
   This comparison serves two purposes:

   1. Validation: It confirms whether your threat model accurately reflects real-world attacks happening in your sector.

   2. Baselining: It offers a concrete baseline for your organization to compare its defensive posture against peers.
      Keep in mind that publicly available breach information only represents a fraction of the actual threats your industry faces, so use it as a starting point rather than an exhaustive list.

Next Steps

Once you have benchmarked your organization against industry standards, you can begin prioritizing remediation efforts based on the gaps identified between your current posture and industry expectations.