Many organizations’ security functions determine what threats they care about based on what threats are known to be affecting their sector, or comparably simple criteria. In reality, this approach is poorly suited to dealing with the significant security issues of today. Malicious actors scope their victims based on multiple factors, and understanding these factors is essential to managing risk.