Where cyber threats come from: natural, accidental and deliberate

What counts as a threat

In security, a threat is anything that could cause harm to your data, devices, accounts or business. It is not the same as an attack, which is a threat being carried out, or a vulnerability, which is a weakness a threat can use. A flood is a threat. A server room in a basement is a vulnerability. A flooded server room is the damage.

Risk planning frameworks, including the US government’s NIST guidance, group threat sources into four broad kinds: deliberate (adversarial) attacks, accidental human errors, structural failures of equipment and systems, and environmental events such as floods and power cuts. Thinking in these four groups stops you from putting all your effort into the most exciting one.

1. Natural and environmental threats

These are events outside anyone’s control: fire, flood, storm, earthquake, heat, and power or internet outages. A flooded office or a long power cut can take systems out as completely as any attack.

• Examples: a storm knocks out your internet for days; a burst pipe floods the room where your computer and backup drive sit; an earthquake damages an office.
• Defences: keep a backup off-site (the “1” in the 3-2-1 rule), protect equipment from water and power surges, and have a plan for working without your normal systems.
• Insurance: check that your equipment and, for a business, the cost of downtime are covered, and understand what your policy actually pays for.

2. Structural threats: things that break

Equipment wears out. Hard drives fail, batteries die, servers crash, cloud services have outages, and old software stops receiving updates. These are not attacks, but they cause the same outcome: you cannot get at your data.

• Examples: an external drive stops working; a laptop dies the week before a deadline; a service you rely on goes offline.
• Defences: keep more than one copy of anything important, replace ageing equipment before it fails, install updates, and test that you can recover from a backup.

3. Accidental threats: honest mistakes

This is the source that people underestimate. People are busy, and ordinary mistakes cause a large share of real incidents. These include:

• Sending an email to the wrong person, or attaching the wrong file.
• Clicking a fake link or opening an attachment without thinking.
• Deleting or overwriting files by accident.
• Losing a laptop, phone or USB drive.
• Leaving a cloud folder, database or storage space publicly accessible because of a wrong setting.
• Using the same weak password everywhere.

The cause is usually not carelessness but a lack of simple safeguards. Defences: short and regular training, checks before sending sensitive data, two-factor sign-in so one password slip is not fatal, device encryption and the ability to wipe a lost device, and a culture where people feel safe reporting a mistake straight away. Our phishing email checker is a good way to practise spotting the warning signs.

4. Deliberate threats: someone is trying to cause harm

These are the attacks that make the news, and they come from two directions:

• External. Criminals, activists, competitors and state-backed groups. See our guide to the types of hackers for who they are and what they want.
• Internal. Current or former staff, contractors and partners who misuse the access they already have, whether for revenge, money or because someone pressured them.

Defences: strong, unique passwords and two-factor sign-in, prompt updates, email filtering and awareness training, giving each person only the access they need, removing access when someone leaves, and keeping backups that an attacker cannot reach.

Misconfiguration: the quiet cause behind many incidents

Between “accident” and “attack” sits a very common problem: systems that are set up badly. In October 2023 the US National Security Agency and CISA published a joint advisory listing the ten most common misconfigurations they found in real networks. Among them were:

• Default settings and passwords left unchanged.
• Ordinary accounts with administrator powers.
• Networks not divided up, so one infected device can reach everything.
• Poor patching, so known security holes stay open.
• Weak or missing multi-factor authentication.
• Weak credential habits, such as reused or easily guessed passwords.
• Shared folders and services that let too many people in.

These are mostly everyday issues, not clever attacks. Our guides to securing your router and the small business basics tackle several of them.

What the data says about how breaches start

The 2025 Verizon Data Breach Investigations Report, which analysed more than 22,000 security incidents including over 12,000 confirmed breaches, gives a feel for the real-world picture:

• Stolen credentials were the initial way in for about 22% of breaches.
• Exploiting software vulnerabilities was the initial route in about 20%, up by about a third on the year before.
• The share of breaches that involved a third party, such as a supplier, doubled to about 30%. Our article on third-party breaches shows how this works.
• Ransomware featured in about 44% of breaches.

Notice how much of this is about passwords, updates and suppliers rather than movie-style hacking. That is good news, because those are things you can improve.

Questions to ask yourself

Use these prompts at home or in a small business. If you cannot answer one, that is where to start.

• Disaster: if my home or office were flooded or burnt tomorrow, where would my files be? Is any copy somewhere else?
• Breakage: how old are my computer, drives and router? Do they still get updates? Have I ever restored from a backup?
• Mistakes: who could send sensitive information to the wrong person? What stops that? What would a person do if they realised they had clicked something bad?
• Attack: which accounts would hurt most to lose? Do they have unique passwords and two-factor sign-in?
• Access: who has access to what? Has anyone left and still kept their login?
• Suppliers: which outside services hold my data, and would I know if one of them was breached?

Why you need layers

No single defence covers all four sources. A firewall does not stop a flood, and a generator does not stop a phishing email. That is why security people talk about “layers”: several different protections, so a gap in one is covered by another.

• Prevent what you can: updates, strong passwords, two-factor sign-in, careful clicking.
• Detect what you cannot prevent: alerts, reviewing sign-in activity, checking statements.
• Recover from what gets through: tested backups, a plan for who does what, and the right contacts written down.

Most people over-invest in the first layer and neglect the last. Recovery is cheap to prepare and enormously valuable on a bad day.

Putting it together: a simple plan

1. List what matters: the data, devices and accounts you could not do without.
2. Ask what could hurt it, using the four groups above: disaster, breakage, mistake, attack.
3. Match a defence to each: off-site backup for disasters, replacement and testing for breakage, safeguards and training for mistakes, security basics for attacks.
4. Test it. Restore a file from backup. Run a practice drill for what you would do on a bad day.
5. Review it every few months, and after any incident.

Sources

• Verizon 2025 Data Breach Investigations Report (press release summary)Accessed October 13, 2026
• BleepingComputer: NSA and CISA reveal top 10 cybersecurity misconfigurationsAccessed October 13, 2026
• Security Scientist: Identifying threat sources and threat events (NIST SP 800-30)Accessed October 13, 2026

Published October 13, 2026. We check every claim against the sources above and say clearly when something is advice rather than fact. This guide is general information, not legal or financial advice. Dollar amounts are in US dollars, as reported.