🌐 Introducing Threat Surface

[behemothsecurity]

A unified vocabulary to describe where threats land — replacing three legacy fields with a single, hierarchical, 900-entry taxonomy that connects Threat Vectors to organisational visibility.

The Problem

Threat Vector Models previously used three overlapping fields — platforms, targets, and domains — each with a flat vocabulary list and no structural relationship between them. This made it difficult to:

• Precisely scope where a threat applies across OS, cloud, identity, protocol, and IoT boundaries
• Automatically link threats to the assets an organisation actually operates
• Identify detection blind spots when a threat targets infrastructure with no log source coverage

The Surface

The new surface field replaces all three with a single hierarchical taxonomy using :: scoped notation:

surface:
  - OS::Windows::Server 2022
  - Cloud::AWS::Compute::EC2
  - Authentication::Entra ID
  - Protocol::Application Layer::SMB

8 stages structure the entire attack surface:

Stage	Entries	Covers
Cloud	211	AWS, Azure, GCP, OCI, Alibaba Cloud, IBM Cloud, DigitalOcean
Application	155	Enterprise apps, browsers, CMS, file transfer, runtime environments, dev tools
Infrastructure	129	Firewalls, VPN, VMware, NAC, SD-WAN, remote access, monitoring, CDN, ICS/SCADA
Security	97	EDR/XDR, SIEM, NDR, ZTNA, SWG, SOAR, CASB, forensics
Protocol	95	Application, transport, routing, data link, wireless, industrial, auth, cellular
OS	87	Windows, macOS, Linux (20+ distros), BSD, container runtimes, RTOS
Authentication	63	Entra ID, Okta, CyberArk, SailPoint, Keycloak, FreeIPA, Duo
IoT	63	NAS, VoIP, UPS, smart home/building/grid, wearables, medical, automotive
Total	900

How it connects

flowchart LR
    TVM["🔴 Threat Vector<br/><i>threat.surface[]</i>"]:::tvm
    SRF[("🟠 Threat Surface<br/><i>vocabulary</i>")]:::surface
    AST["🔵 Asset<br/><i>asset.surface[]</i>"]:::asset
    LS["🟢 Log Source"]:::logsource

    TVM -. references .-> SRF
    AST -. references .-> SRF
    TVM =="surface overlap<br/>→ targeted asset"==> AST
    LS -- monitors --> AST

    classDef tvm fill:#d32f2f,color:#fff,stroke:#b71c1c,stroke-width:2px,rx:8
    classDef surface fill:#ff9800,color:#fff,stroke:#e65100,stroke-width:2px,rx:8
    classDef asset fill:#1976d2,color:#fff,stroke:#0d47a1,stroke-width:2px,rx:8
    classDef logsource fill:#388e3c,color:#fff,stroke:#1b5e20,stroke-width:2px,rx:8

Loading

A TVM targets surface entries; an Asset exposes surface entries. When they overlap (hierarchical prefix match), the asset is a targeted asset — tracing its log sources reveals detection visibility and blind spots.

Vocabulary Extensions

Instance-specific surface entries can be injected via schema.toml without modifying the core vocabulary:

[[vocabulary.surface]]
id = "03773d86-..."
name = "EU Login"
description = "European Commission SSO"
"tide.vocab.stages" = "Authentication"

These appear in JSON Schema enums and IDE autocomplete alongside the 900 core entries.

Documentation

TVM documentation now includes a dedicated Threat Surface section:

1. Surface entries — enriched display with vocabulary descriptions
2. 🎯 Targeted Assets — intersects TVM surface with Asset surface using hierarchical prefix matching
3. 👁️ Detection Visibility — traces matched assets → log sources and detectors; reports blind spots

Engine Improvements

EnumResolver refactor

The JSON Schema generation pipeline was restructured into a unified EnumResolver class with nested Fetch and Resolve inner classes, replacing the previous scattered FetchEnums and gen_lib_schema functions. This also enables tide.vocab resolution in configuration meta schemas — powering the visibility asset surface field auto-enum.

Config Schema Automation

Configuration meta schemas (visibility, deployment, etc.) now support automated JSON Schema generation with vocabulary resolution:

[config_metaschemas]
visibility = "Configurations/visibility.meta.yaml"

[config_json_schemas]
visibility = "Configurations/visibility.schema.json"

Deprecation

The targets, platforms, and domains fields are deprecated and hidden from templates (tide.template.hide: true). They remain in the schema for backward compatibility with existing TVM files pending the surface remapping migration.

What's Next

With the vocabulary and schema in place, the next step is the surface remapping — migrating all existing TVMs from the legacy fields to the new surface array. A pre-computed mapping file with enriched proposals for all 485 TVMs is ready for execution.

---

This discussion was created from the release 🌐 Introducing Threat Surface.