<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-strategic-threat-briefings
description: >-
  Produce strategic threat briefings for executive and board audiences. Covers
  intelligence requirement translation, risk quantification, sector-specific threat
  landscapes, and presentation of technical findings in business context.
domain: cybersecurity
subdomain: threat-intelligence
tags:
  - strategic-intelligence
  - executive-briefing
  - risk-quantification
  - threat-landscape
  - intelligence-reporting
  - ciso-brief
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---
# Implementing Strategic Threat Briefings

## Overview

Strategic threat briefings translate technical threat intelligence into
business-relevant assessments for executive leadership and board audiences. This
skill covers defining strategic intelligence requirements, quantifying threat
risk in financial terms, structuring briefing content, and communicating
technical findings without jargon while preserving analytical rigor.

## Prerequisites

- Python 3.10+ with `requests`, `jinja2` libraries
- Access to threat intelligence platform (OpenCTI, MISP) for data
- Understanding of business risk frameworks (FAIR, NIST RMF)
- Knowledge of audience-appropriate communication (board vs. CISO vs. SOC)
- Template engine for briefing document generation

```bash
pip install requests jinja2
```

## Key Concepts

### Intelligence Audience Tiers

| Audience | Content Level | Update Frequency | Format |
|----------|--------------|-----------------|--------|
| Board/C-Suite | Strategic trends, risk exposure | Quarterly | Executive summary, 2-3 pages |
| CISO/VP Security | Sector threats, program gaps | Monthly | Detailed brief, 5-10 pages |
| Security Managers | Tactical threats, control status | Weekly | Operational brief |
| SOC Analysts | IOCs, detection rules, TTPs | Daily | Technical bulletin |

### Briefing Structure

```
1. Bottom Line Up Front (BLUF) — key judgment in 2-3 sentences
2. Threat Landscape Summary — top 3-5 threats to the organization
3. Sector-Specific Assessment — what is targeting our industry
4. Risk Quantification — potential financial/operational impact
5. Defensive Posture — current capability vs. threat coverage
6. Recommendations — prioritized actions with resource estimates
7. Confidence Assessment — analytical confidence for each judgment
```

### Risk Quantification (FAIR Model)

```
Loss Event Frequency × Loss Magnitude = Annualized Loss Expectancy
  ├── Threat Event Frequency           ├── Primary Loss
  │     ├── Contact Frequency           │     ├── Response cost
  │     └── Probability of Action       │     ├── Replacement cost
  └── Vulnerability (control gap)       │     └── Productivity loss
                                        └── Secondary Loss
                                              ├── Regulatory fines
                                              ├── Reputation damage
                                              └── Litigation cost
```

## Workflow

### Step 1: Gather Intelligence Data

```python
def gather_threat_landscape(sector: str, days: int = 30) -> dict:
    """Gather sector-specific threat landscape data."""
    import requests
    # Query CISA advisories
    cisa_resp = requests.get(
        "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
        timeout=15,
    )
    recent_kevs = [
        v for v in cisa_resp.json().get("vulnerabilities", [])
    ][:10]

    return {
        "sector": sector,
        "period_days": days,
        "recent_kevs": len(recent_kevs),
        "top_vulnerabilities": [
            {"cve": v["cveID"], "vendor": v["vendorProject"]}
            for v in recent_kevs[:5]
        ],
    }
```

### Step 2: Generate Briefing Document

```python
from jinja2 import Template

BRIEFING_TEMPLATE = """
# Strategic Threat Briefing — {{ period }}

## Bottom Line Up Front
{{ bluf }}

## Threat Landscape Summary
{% for threat in threats %}
### {{ threat.name }}
- **Risk Level**: {{ threat.risk }}
- **Targeting**: {{ threat.targeting }}
- **Trend**: {{ threat.trend }}
{% endfor %}

## Risk Quantification
| Threat | Estimated Annual Loss | Confidence |
|--------|----------------------|------------|
{% for risk in risks %}
| {{ risk.threat }} | {{ risk.ale }} | {{ risk.confidence }} |
{% endfor %}

## Recommendations
{% for rec in recommendations %}
{{ loop.index }}. **{{ rec.action }}** — {{ rec.impact }} ({{ rec.effort }})
{% endfor %}

---
*Confidence: {{ confidence }} | Classification: {{ tlp }}*
"""

def generate_briefing(data: dict) -> str:
    """Generate strategic briefing from template."""
    template = Template(BRIEFING_TEMPLATE)
    return template.render(**data)
```

### Step 3: Risk Scoring

```python
def calculate_fair_risk(
    threat_frequency: float, vulnerability: float,
    primary_loss: float, secondary_loss: float,
) -> dict:
    """Calculate risk using simplified FAIR model."""
    loss_event_freq = threat_frequency * vulnerability
    loss_magnitude = primary_loss + secondary_loss
    ale = loss_event_freq * loss_magnitude
    return {
        "loss_event_frequency": round(loss_event_freq, 3),
        "loss_magnitude": round(loss_magnitude, 2),
        "annualized_loss_expectancy": round(ale, 2),
        "risk_rating": (
            "CRITICAL" if ale > 10_000_000 else
            "HIGH" if ale > 1_000_000 else
            "MEDIUM" if ale > 100_000 else "LOW"
        ),
    }
```

## Verification

- [ ] Intelligence requirements mapped to executive audience needs
- [ ] Threat landscape data gathered from multiple intelligence sources
- [ ] Risk quantified using FAIR model with annualized loss estimates
- [ ] Briefing document generated with BLUF, recommendations, confidence
- [ ] Technical jargon translated to business-relevant language
- [ ] Briefing distributed with appropriate TLP marking

## References

- [FAIR Risk Model](https://www.fairinstitute.org/)
- [NIST Risk Management Framework](https://csrc.nist.gov/projects/risk-management/)
- [SANS CTI Summit Briefing Templates](https://www.sans.org/cyber-security-summit/)
- [Intelligence-Driven Incident Response (Reissued)](https://www.oreilly.com/library/view/intelligence-driven-incident-response/)
- [FIRST CVSS SIG](https://www.first.org/cvss/)
