Threat Actor Insights

This guide explains how to use Threat Actor Insights to visualize, manage, and mitigate adversary-specific cybersecurity skills risk across your organization.

Traditional threat intelligence feeds excel at telling your security team who is targeting your industry, but they often leave senior leadership blind to whether internal defenders possess the precise technical skills required to mitigate those specific adversaries.

Threat Actor Insights bridges the gap between threat intelligence and operational readiness. By mapping live adversary profiles directly onto your team’s rolling platform performance data, this dashboard instantly highlights training coverage gaps relative to framework models and provides the relevant platform learning pathways to help address them.

With Threat Landscape, you can take this further than one adversary at a time. Select the threat actors that matter to your sector, supply chain, and risk profile, and see your readiness across that whole set, along with a ranking of the adversaries you're least prepared for.

How to Access the Dashboard

The dashboard is designed for high-level organizational threat reporting and is available to Organization Admins and Team Managers within the Immersive One Advanced tier. 

To access it, log in to the platform and navigate to Reports > Threat Actor Insights in the top navigation bar.

Both roles can create and edit their own threat landscape. Creating a program from Threat Actor Insights is currently only available to Organization Admins. You'll land on the My Landscape tab. Use Actor Details to look at a single threat actor, including one that isn't in your landscape.

Understanding the Core Metrics

Your platform training readiness against an adversary is not a guess, it is mathematically driven by an Overall Readiness % score. This top-line metric scales dynamically based on three distinct tracking pillars:

• Technique Coverage (Breadth): Measures what percentage of the threat actor's known MITRE ATT&CK techniques your team has interacted with via Immersive labs.
• Coverage Depth (Team Resilience): Tracks how widely knowledge is distributed across your pool. It calculates whether you are relying on a single "point-of-failure" individual or if defensive capabilities are spread across multiple team members.
• Proficiency (Skill Mastery): Evaluates how well your team actually performed. This is a weighted measure of lab accuracy (correct submissions vs. total submissions) combined with the lab's difficulty band.

These three pillars work the same way whether you're looking at one threat actor or your whole landscape. On the My Landscape tab, they're calculated across the combined set of techniques used by every actor you've selected, counted once each.

⚠️ Note on Proficiency: If your team has only completed beginner-level labs for a specific technique, the highest proficiency score achievable for that technique is capped at 66%. To maximize your score, teams must successfully tackle intermediate and advanced labs.

Who is counted in these metrics?

To maintain absolute reporting accuracy, the dashboard filters out general or inactive users. To be categorized as a Valid User and included in the data baseline, an individual must:

1. Be assigned an active "Offensive Cyber" or "Defensive Cyber" role within platform settings.
2. Have completed at least one platform lab mapped to a MITRE ATT&CK TTP.

How to Read the Visualizations

The dashboard translates raw, unstructured threat context into an executive-ready visual layout composed of four primary sections:

1. The Readiness KPI Strip

Located at the top of the dashboard, this banner showcases your aggregate percentages for Readiness, Technique Coverage, Coverage Depth, and Proficiency against the selected threat group, alongside red or green trend arrows showing performance over time.

2. Radar / Spider Chart (Coverage by Tactic)

This chart displays your training surface against the adversary’s complete attack lifecycle:

• The Red Dashed Line represents the total tactical footprint of the selected threat actor.
• The Blue Shaded Area represents your team’s real-time lab completion footprint against TTPs used by the selected threat actor.
• The Grey Hatched Area (No Content Mapped): Indicates areas where the adversary operates using techniques for which the platform does not currently host active lab content. This transparency marker shows exactly what cannot be resolved via existing catalog assignments.

3. Depth vs. Proficiency Scatterplot

Every dot on this quadrant graph represents a distinct MITRE technique utilized by the threat actor. Hovering over a dot displays a tooltip with its exact Technique Name, ID, depth, and proficiency scores.

The dots populate four distinct quadrants to flag precise risk profiles:

• Critical Gap (Bottom Left / Red): Little to no training activity and low scores. Identifies areas with limited platform engagement and lower proficiency scores, indicating priorities for targeted training campaigns.
• Skilled but Thin (Top Left / Orange): High proficiency scores, but low team depth (often just one person has taken the lab). This represents a "single-point-of-failure" knowledge risk.
• Covered but Weak (Bottom Right / Blue): High team participation (depth), but low passing scores. Your team has attempted the content but has not mastered the skill, signaling a need for refresher training.
• Strong & Deep (Top Right / Green): Your organizational "gold standard." Widespread team baseline participation backed by high proficiency scores.

4. Technique Readiness Detail Table

A granular, bottom-of-page tabular breakdown organizing all individual techniques, active readiness state badges (Unproven, Partially Proven, Proven, or No Content Mapped), and direct action links.

Note: The radar chart, scatterplot, and detail table all appear on the My Landscape tab as well. There they show your position across every actor in your landscape rather than a single group.

My Landscape

Threat Landscape lets you track more than one adversary at once. Instead of checking groups one at a time, you select the actors relevant to your organization and get a single readiness position across all of them, plus a ranking showing where you're least prepared.

Your landscape is personal to you. Each user creates their own, and changing yours doesn't affect anyone else's.

1. Go to Reports, then Threat Actor Insights. You'll land on the My Landscape tab.

2. If you haven't created a landscape yet, you'll see Select your threat actor landscape. Click Select threat actors.

3. Use the sector dropdown to narrow the list, or Search threat actors... to find a group by name. Each actor shows the sectors it's known to target.

4. Select the actors you want to track. The counter shows how many you've selected, and View selection lists your current picks.

5. Click Save.

You need to select at least two actors. Save stays inactive until you do, and the footer shows Select at least 2 threat actors. There's no upper limit.

Select all adds every actor in the current filter. This is a useful way to see where you're weakest across a sector, though it will produce a lower overall score than a focused landscape. You can remove actors before saving, or refine your selection later.

To change your landscape, click Edit Landscape on the Selected threat actors (MITRE ATT&CK) panel.

Your Overall Readiness score is calculated across the combined set of MITRE ATT&CK techniques used by all the actors in your landscape, counted once each. A technique used by several of your actors is counted a single time.

Beneath the score you may see a note such as "Max readiness capped at 90% due to 83 unmapped techniques". Some techniques used by the actors you track may not have Immersive lab content mapped to them yet. Rather than leaving them out, the dashboard counts them and reduces your maximum achievable score accordingly. This figure changes as your landscape changes and as and when new MITRE ATT&CK aligned labs are released.

Use Trend since at the top right to set the period the trend figures compare against.

The Readiness Ranking lists every actor in your landscape with its technique count, readiness percentage, trend, and the three pillar scores.

The list runs from lowest readiness to highest, so position 01 is the actor you're least prepared for. This puts your largest coverage gaps at the top.

Select any actor to open the full detail view for that group.

Your overall score and the individual scores in the ranking answer different questions, and they aren't meant to match. Your overall score can be lower than every actor listed.

This happens because the two are calculated across different sets of techniques. Your overall score counts each technique once across your whole landscape. Each ranking entry scores one actor across that actor's own techniques, so a technique shared by several actors is counted within each of their scores.

For example, if one actor uses two techniques and your team has covered one of them, that actor scores 50%. If a second actor uses that same covered technique plus one your team hasn't covered, that actor also scores 50%. Across both, there are three distinct techniques and your team has covered one, so your overall position is 33%.

Overall Readiness tells you about the techniques in play across your landscape. The Readiness Ranking tells you which individual actors you have the least coverage against.

Adding actors to your landscape adds their techniques to the combined set, so your overall score can go down. Adding actors who use similar techniques to ones you already track changes it very little, because those techniques are already counted.

A written summary naming the tactics where your coverage is weakest and the actors in your landscape that rely on them. Select Read more for the full text.

This summary is generated by AI and updated daily. Check the details before sharing it outside your team.

1. Scroll to Build a program from your threat landscape.

2. Click Create program.

3. AI Program Builder inspects your saved actors and asks what the program should target.

4. Choose whether to target the weakest techniques across your whole landscape, or to focus on a specific actor.

5. Review the generated program and deploy it.

Targeting techniques across the whole landscape is usually more efficient, because the same technique often appears in several actors' profiles and addressing it improves your position against all of them. Targeting a single actor is narrower, and useful when you want to show progress against one group.

Creating a program is currently available to Organization Admins only.

Proactive Risk Management for Admins

If the dashboard flags critical exposure gaps, you don't need to manually hunt for relevant labs.

1. Click the Create Program button located right inside the breakdown panel.

2. This shortcut instantly launches a new draft within the platform’s AI Program Builder, passing the selected threat actor's context natively, including your organization's precise unproven or partially proven gaps

   

3. AI Program Builder identifies the highest-impact labs from the Immersive catalog, stack-ranks them by the newest creation dates, and designs a targeted training regimen ready for review and deployment.

Frequently Asked Questions

Why is a technique marked as "Partially Proven" even though our team has a 90% Proficiency score?

To achieve the green Proven status, a technique must cross both the proficiency threshold and the team depth threshold simultaneously. If your score is 90% but only a single user has completed the lab, the dashboard flags it as Skilled but Thin (Partially Proven) because your organization lacks widespread bench depth and team resilience against that tactic.

If a user completes the same lab multiple times, does it skew our reporting?

No. For Depth, a unique user is only counted once per technique baseline to establish a true footprint. For Proficiency, the system evaluates stabilized performance scores across all attempts to prevent a single power-user from hyper-inflating the organization's average through repetitive attempts.

Why do some techniques show blank dashes ( — ) under Depth and Proficiency?

A technique marked as Unproven means your organization has zero recorded training activity on the platform for that specific skill. Because no technical users have launched or completed a corresponding lab, there are no metrics to track, and blank placeholders are displayed.

Can we filter this dashboard view by individual sub-teams or separate departments?

Not in the current version. Threat Actor Insights is explicitly designed to provide senior leadership, CISOs, and board members with a high-level, aggregate organizational view of total threat readiness.

Why is our overall readiness lower than every actor in the ranking?

The two figures are calculated across different sets of techniques. See "Why your overall score can differ from the ranking" above.

Why can't we reach 100% readiness?

Check the note beneath your Overall Readiness score. Techniques used by your actors that have no mapped lab content reduce your maximum achievable score. The dashboard shows this rather than excluding those techniques.

A colleague sees a different overall score. Which is right?

Both. Landscapes are personal to each user, so your colleague's score reflects their selection of actors. Compare the two using Edit Landscape.

Why did our score drop after we added more actors?

Adding actors adds their techniques to the combined set your score is calculated across. If your team hasn't covered those techniques yet, your overall position falls.