Generic threat-intelligence feeds arrive daily in the inboxes of security operations centres across the Kingdom. They list indicators of compromise, MITRE ATT&CK tactics, and vulnerability identifiers. Analysts dutifully review them, update signatures, and file reports. Yet when the CISO walks into the boardroom with a request for additional controls or budget, the conversation stalls. Board members ask which business systems are at risk, which customer services might be interrupted, and which regulatory obligations are in jeopardy. The threat feed offers no answers to these questions.
This disconnect has led three financial institutions in Jeddah to abandon the practice of presenting threat intelligence through the lens of adversary tactics and instead adopt threat intelligence asset mapping Saudi institutions now use to translate indicators into business impact. The result is not a different feed, but a different method: mapping threat actors and their capabilities directly to the organisation's critical assets, then expressing risk in terms the board understands and can act upon.
The Problem with Tactic-Centric Reporting
Most commercial and open-source threat feeds structure their reporting around the MITRE ATT&CK framework. An alert might state that a particular threat group uses credential dumping (T1003), lateral movement via remote services (T1021), and data exfiltration over alternative protocols (T1048). For a threat-intelligence analyst, this taxonomy is useful. It describes what an adversary does and suggests which detection rules to enable.
For a board member or a chief risk officer, however, the same report is opaque. It does not answer the question: "If this threat actor succeeds, which of our systems will be compromised, and what will that cost us?" The gap between tactical intelligence and strategic risk communication is wide, and it is this gap that leads to under-investment in controls, delayed incident response, and misaligned priorities.
The three Jeddah institutions—two retail banks and one payment processor—encountered this problem repeatedly. Threat reports were thorough, but budget requests were denied or deferred because the business case was unclear. The turning point came when each organisation recognised that the intelligence itself was not the issue; the issue was the absence of a structured method to connect threat actors to the assets they would target and the business processes those assets supported.
The Three-Step Asset-Impact Mapping Method
The method these institutions adopted is straightforward in principle but requires discipline in execution. It consists of three steps: asset inventory and classification, threat-actor profiling against those assets, and impact quantification in business terms.
Step One: Asset Inventory and Classification
The first step is to produce a complete inventory of information systems, applications, data repositories, and network segments, then classify each asset according to its criticality to business operations and its attractiveness to threat actors.
Criticality is determined by asking which systems, if unavailable or compromised, would halt revenue-generating activities, breach regulatory obligations, or damage customer trust. In the case of the two retail banks, critical assets included core banking platforms, card management systems, SWIFT messaging infrastructure, and customer databases. For the payment processor, the list included transaction switching systems, merchant portals, and reconciliation databases.
Attractiveness to threat actors is a separate dimension. Some systems are critical to the business but hold little value to an adversary. Others—such as databases containing personally identifiable information, payment card data, or credentials—are high-value targets even if their temporary unavailability would not halt operations. The asset inventory must capture both dimensions.
Each institution created a matrix with assets on one axis and two scores on the other: business criticality and adversary attractiveness. This matrix became the foundation for all subsequent mapping.
Step Two: Threat-Actor Profiling Against Assets
The second step is to take the threat intelligence the organisation already receives and reframe it. Instead of cataloguing what tactics a threat actor uses, the analyst asks: "Which of our assets would this actor target, and by what path?"
This requires understanding the actor's objectives. A financially motivated group targeting Saudi banks is likely to focus on card management systems, SWIFT infrastructure, or any system that processes or stores payment credentials. A state-sponsored actor with espionage objectives might prioritise executive email, strategic planning documents, or systems that handle government contracts. A hacktivist group might target customer-facing portals to cause reputational damage.
For each threat actor or threat cluster identified in the intelligence feed, the analyst maps a probable attack path through the organisation's environment. This path starts at the initial access vector—often email, a public-facing web application, or a third-party connection—and proceeds through the network to the target asset. Each step in the path is a system or network segment from the asset inventory.
The three Jeddah institutions found that most threat actors relevant to their sector followed one of four common paths:
- External email to workstation, workstation to domain controller, domain controller to core banking platform.
- Public-facing web application to application server, application server to database containing card data.
- Third-party vendor connection to shared services network, shared services network to SWIFT infrastructure.
- Mobile banking application to API gateway, API gateway to customer database.
By mapping these paths explicitly, the institutions could see not only which assets were at risk, but also which intermediate systems an adversary would need to traverse. This revealed chokepoints—places in the network where a single control could disrupt multiple attack paths.
Step Three: Impact Quantification in Business Terms
The third step is to translate each mapped threat into a business impact statement. This is where the asset classification from step one becomes essential. For each target asset, the analyst prepares a concise summary:
- Asset: Core banking platform.
- Threat actor: Financially motivated group known to target Saudi financial institutions.
- Attack path: Phishing email, credential theft, lateral movement via remote desktop, access to core banking platform.
- Business impact if compromised: Inability to process customer transactions for an estimated recovery period; potential unauthorised fund transfers; mandatory reporting to the Saudi Central Bank under the Cyber Security Framework; reputational damage and customer attrition.
This summary is not a technical document. It is a risk statement that a board member or executive can evaluate against the cost of controls. If the organisation is considering investment in multi-factor authentication for remote desktop access, the business case is now clear: this control disrupts the attack path to the core banking platform and mitigates the risk of transaction processing outages and regulatory breach.
The payment processor used this method to justify investment in network segmentation. By showing that three separate threat actors—each with different objectives—could reach the transaction switching system through the same under-segmented network, the CISO demonstrated that a single architectural change would reduce risk from multiple threat sources. The board approved the project within two weeks.
Practical Observations from Implementation
The three institutions encountered common challenges during implementation, and their solutions are instructive.
Challenge one: Asset inventories were incomplete or out of date. In each case, the organisation believed it had a current inventory, but the mapping exercise revealed gaps—shadow IT systems, forgotten test environments still connected to production networks, and third-party connections not documented in any central register. The institutions addressed this by treating the mapping exercise itself as an asset discovery project, updating the inventory iteratively as new systems were identified.
Challenge two: Threat-intelligence feeds contained too much noise. Global feeds include threat actors and campaigns that are not relevant to Saudi financial institutions. The institutions began filtering feeds at the outset, retaining only intelligence about actors known to target the region or the sector. This reduced the volume of intelligence to review and allowed analysts to focus on mapping efforts that would inform real decisions.
Challenge three: Quantifying business impact required input from business units, not just the security team. The CISO cannot estimate the revenue impact of a transaction processing outage or the reputational cost of a data breach without data from finance, operations, and legal. The institutions established a standing working group with representatives from each function, meeting monthly to review new threat intelligence and update impact assessments. This cross-functional collaboration also had the secondary benefit of raising cybersecurity awareness among business leaders.
Challenge four: The method required ongoing maintenance. Threat actors change tactics, new vulnerabilities emerge, and the organisation's own asset landscape evolves. The institutions embedded asset-impact mapping into their regular threat-intelligence cycle, updating maps quarterly and conducting a full review whenever a significant threat actor or vulnerability was identified.
Regulatory Alignment
The Saudi Central Bank's Cyber Security Framework requires financial institutions to implement risk-based cybersecurity controls and to report incidents that affect critical systems. Asset-impact mapping supports both obligations. By identifying which assets are critical and which threats target them, the organisation can allocate controls proportionately and demonstrate to the regulator that its cybersecurity investments are aligned with risk. In the event of an incident, the organisation can immediately determine whether the affected system is critical and whether reporting is required, because that determination has already been made during the mapping process.
The National Cybersecurity Authority's Essential Cybersecurity Controls framework similarly emphasises risk-based prioritisation. Asset-impact mapping provides the analytical foundation for that prioritisation, ensuring that the organisation's control environment addresses the threats most likely to affect its operations.
From Intelligence to Decision
The shift from tactic-centric reporting to asset-impact mapping is not a rejection of frameworks like MITRE ATT&CK. Those frameworks remain valuable for detection engineering and incident response. The shift is a recognition that threat intelligence serves two audiences: the analyst who needs technical detail and the executive who needs business context. The same intelligence can inform both, but only if it is translated.
The three Jeddah institutions now produce two outputs from each threat-intelligence cycle. The first is a technical report for the security operations team, structured around tactics and indicators. The second is a risk briefing for senior management and the board, structured around assets and business impact. Both are derived from the same intelligence, but each is tailored to its audience.
This approach has changed the nature of budget conversations. Requests for controls are now accompanied by a clear statement of which business assets the control protects and which threat actors it mitigates. Approvals are faster, and the controls that are implemented are the ones that address the organisation's actual risk exposure, not the ones that happen to align with the latest vendor pitch.
Threat Intelligence That Informs Real Decisions
Actionable cyber threat intelligence focused on the threats targeting Saudi organisations—not generic global feeds, but intelligence that informs real decisions—requires a method to connect abstract indicators to concrete business assets. The three-step asset-impact mapping method provides that connection, turning threat intelligence from a compliance exercise into a strategic tool.
For CISOs and threat-intelligence analysts seeking to translate indicators into board-level risk decisions, the method is replicable and does not depend on expensive platforms or external services. It depends on disciplined asset classification, clear threat-actor profiling, and collaboration between security and business functions. The result is a threat-intelligence programme that answers the question every board member asks: "Which of our systems are at risk, and what should we do about it?"
