What it means
It connects threat behavior to architecture, prevention, telemetry, detection, response, and validation rather than relying on a generic control checklist.
Why it matters
Cloud attackers frequently use valid credentials and provider-native capabilities. Defenders need to understand likely attack paths and whether controls meaningfully disrupt them.
Practical focus
- Identify relevant cloud adversary behaviors and objectives
- Map attack paths through identity, control plane, network, and data
- Test whether controls change attacker options
- Use incidents and exercises to improve priorities
Common mistakes
- Copying threat lists without environment context
- Measuring control presence instead of attack disruption
- Focusing only on malware in cloud workloads
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: