Risk register: "hackers" is not a risk source

Your Sunday briefing · Risk series

Since the start of the series, your register has taken shape. You named the scenarios that would stop the business, gave each one its four owners, and last Sunday looked at what attackers see of you first. One column is still filled badly in almost every register: the source. The one that says who would cause the scenario, and therefore how likely it is.

Our position: "hackers" is not a risk source. It is scenery. A useful source says who, why and how, and it changes when the threat changes.

What "hackers" stops you from doing

Go back to the four-part sentence from the first episode: a source, an event, what is hit, the business consequence. When the source reads "hackers" or "a cyberattack", three things become impossible.

• Prioritizing. Every scenario has the same source, so the same apparent likelihood. You rank them by gut feeling.
• Choosing controls. A ransomware group that gets in with stolen credentials is not fought like a fraudster impersonating a supplier, or like an intelligence service after your designs.
• Revising. When a new campaign hits your sector, nothing in the register says which line it touches.

What it changes: the "source" column is not a descriptive field. It is what connects the register to the outside world.

Three questions that replace "hackers"

For every scenario, the source is one line that answers three questions.

1. Who? A precise category, and a name when there is one: a ransomware group active in Canada, a fraudster impersonating suppliers, a state actor, a hacktivist, an insider, a failing service provider.
2. Why? Money, espionage, disruption, attention. Motivation tells you what the attacker will look for: your cash, your data, your designs, your downtime.
3. How? The usual method, especially initial access: stolen credentials, an unpatched edge device, phishing, a service provider, a flaw in an exposed application. This is the direct link to last Sunday's episode: a method that matches what you expose makes the scenario more likely.

An example, on the scenario where ransomware encrypts the ERP. Before: "Source: cyberattack." After: "Source: financially motivated, opportunistic ransomware groups that most often get in through remote access or exposed, unpatched edge devices, and regularly claim Canadian victims of every size." The second version can be checked, challenged and updated.

What the Canadian Centre for Cyber Security says

The Canadian Centre for Cyber Security's National Cyber Threat Assessment 2025-2026, based on information available as of September 20, 2024, sets the baseline for any Canadian organization. Three of its judgements matter directly for a register. Status: official Government of Canada assessment.

• Ransomware is the top cybercrime threat facing Canada's critical infrastructure.
• Ransomware actors are almost certainly opportunistic and do not target specific industries; a wide range of Canadian businesses have been hit.
• China presents the most sophisticated and active state cyber threat to Canada, and the assessment notes that AI technologies are almost certainly lowering the barriers to entry and improving the quality, scale and precision of malicious activity.

What it changes: for ransomware, the question is less "is my sector targeted?" than "does my front door look like the ones they use?". For espionage it is the reverse: sector, customers and relationships matter more. A defence supplier, a research lab or a critical infrastructure provider does not have the same risk source as a retailer.

How the threat moves likelihood

A scenario's likelihood is not set once and for all. Three signals push it up or down, and each one must be citable.

• Activity. Are actors of this kind active right now against organizations in your country or your sector? Recent claims, an advisory from an authority, a documented campaign.
• Match. Does their usual method match what you expose? A group that gets in through VPN gateways weighs differently on an organization exposing two unpatched ones and on one that has none.
• Resemblance. Do their recent victims look like you: size, sector, region, technology?

For now a qualitative scale is enough: low, medium, high, with one sentence saying why and a dated source. Ranges come later in the series. What matters today is that every likelihood has a written reason and a review date.

Free sources, and what each one brings

You do not need a subscription to start. Four public sources cover the essentials.

1. The Canadian Centre for Cyber Security: the national assessment for the baseline, its alerts and advisories for current campaigns that target Canada.
2. CISA's #StopRansomware advisories: one page per group, with its techniques, its usual initial access and indicators of compromise. American, but the groups are often the same.
3. MITRE ATT&CK: the documented groups, the techniques each one uses and, often, the sectors and countries they have hit. This is where "how" gets precise.
4. ransomware.live: claims published on leak sites, filterable by country and sector. Status: claimed. A claim is not proof, but a run of claims against organizations like yours is an activity signal.

This is what threat intelligence means here: not one more feed, but a reading that tells you which lines of the register move.

The four traps

The threat of the day. Every alarming article pushes a likelihood up, and nobody brings it back down. Review on a fixed date, every quarter, and in between only on a signal that directly touches a scenario.

The exotic threat. The sophisticated state actor takes over the conversation, while payment fraud and opportunistic ransomware do most of the damage in organizations like yours. Keep both, but don't let the spectacular crowd out the likely.

The claim taken as proof. A name on a leak site says a group claims something. It says neither what was taken nor how. It is an activity signal, not a fact about the victim.

The threat with no scenario. Monitoring that does not attach to any line of the register is reading, not risk management. Every signal you keep must say which scenario it touches.

This week's test: thirty minutes, one column

Take your ten scenarios and the person who follows security in your organization.

1. For each scenario, rewrite the source in one line: who, why, how.
2. Next to it, note one public source less than twelve months old that supports that line.
3. On ransomware.live, filter Canada and your sector, and count the claims of the last ninety days. Then, in MITRE ATT&CK, look up the usual initial access of one of the groups that shows up.

Three results should worry you. A source still written "hackers" or "cyberattack": that scenario cannot be prioritized. No dated source: the likelihood is an opinion. A likelihood unchanged since the register was created: nobody reviews it.

What you should have next Sunday

The same page, with a "source" column that finally works: who, why, how, a dated source, a qualitative likelihood and its review date. Your register no longer talks about an abstract threat, but about the one that actually targets organizations like yours.

Where FortaRisks fits

Keeping this column by hand takes monitoring few teams have time for. Forta Radar aggregates 100+ threat intelligence sources, filters them on your country, your sector and your technology stack, and profiles actors with their MITRE ATT&CK techniques and recent victims. Those signals then feed Forta Cockpit, the decision-makers' view, where they inform the "targeting" component of every risk in the register.

Next Sunday: third parties belong in the register. A critical supplier is not a line in another spreadsheet: it is a risk source in its own right, with its own scenarios.

Sources: Canadian Centre for Cyber Security, National Cyber Threat Assessment 2025-2026 · CISA, #StopRansomware advisories · MITRE ATT&CK, groups · ransomware.live