Recent leaks from Russian military training programs confirm what many enterprise risk officers suspected: nation-state cyber capabilities now operate as formal institutional systems with structured recruitment, standardized training, and defined career pathways. This isn't just about elite hacking teams. It's a force-generation mechanism.
For your organization, this changes the threat intelligence equation. You're not just tracking individual threat actors or discrete groups. You're facing an adversarial system designed to produce trained operatives at scale, year after year.
This checklist helps you assess whether your current threat intelligence model accounts for institutionalized state-sponsored cyber capabilities. Each item represents a gap that most organizations haven't closed.
Prerequisites
Before using this checklist, ensure you have:
- Current threat intelligence program documentation showing how you categorize, prioritize, and respond to nation-state threats.
- Access to your organization's risk register with authority to propose changes to how state-sponsored threats are classified.
- Ability to review vendor threat intelligence feeds and assess whether they distinguish between opportunistic threat groups and institutional capabilities.
- Authority to convene stakeholders from security operations, legal, compliance, and business continuity.
If you lack any of these, this checklist will identify problems you can't yet solve. Secure the authority first.
Threat Model Assessment Checklist
1. Your threat intelligence program distinguishes between threat groups and institutional capabilities
□ Done: Threat profiles separate GRU, Main Operational Directorate, and 8th Directorate as distinct force-generation systems, not just as collections of named units like Sandworm or APT28.
What good looks like: Your intelligence briefs describe adversary capacity to sustain operations over time, not just recent attack patterns. You track personnel pipelines, not just malware families.
2. You've mapped the operational overlap between espionage, destructive activity, and influence campaigns
□ Done: Your risk scenarios account for coordinated operations where initial reconnaissance (espionage) enables later destructive attacks or disinformation campaigns targeting the same infrastructure.
What good looks like: Incident response playbooks include triggers for escalating seemingly isolated reconnaissance activity to your crisis management team when it coincides with geopolitical tension.
3. Your vendor threat intelligence feeds provide institutional context, not just tactical indicators
□ Done: You've evaluated whether your threat intelligence providers track adversary training programs, recruitment patterns, and organizational structure, or whether they only deliver IOCs and campaign reports.
What good looks like: Quarterly intelligence briefings to leadership include analysis of adversary capability development trends, not just "what happened last quarter."
4. You've assessed materiality of state-sponsored threats specific to your sector and geography
□ Done: Your Materiality Assessment explicitly addresses whether institutionalized cyber programs from Russia, China, North Korea, or Iran pose elevated risk to your operations, supply chain, or customer data.
What good looks like: Board-level risk reporting includes a named assessment of nation-state threat actors with documented rationale for why specific institutional capabilities do or don't meet your materiality threshold.
5. Your security architecture assumes persistent access, not just perimeter defense
□ Done: Network segmentation, privileged access management, and monitoring strategies assume sophisticated adversaries will achieve initial access and focus on limiting lateral movement and dwell time.
What good looks like: Mean Time to Detect for lateral movement is measured, reported, and improving. You've tested detection capabilities against techniques associated with GRU-affiliated units.
6. Incident classification accounts for attribution confidence levels
□ Done: Your Incident Response Plan includes procedures for handling incidents where attribution is uncertain but tradecraft suggests state-sponsored origin, avoiding the false choice between "confirmed state actor" and "treat as commodity threat."
What good looks like: Incident severity ratings include a dimension for "attribution confidence" that triggers specific legal, communications, and preservation actions even when you can't definitively name the adversary.
7. You've identified assets that would be attractive to military reconnaissance operations
□ Done: Asset inventory includes classification for systems that provide intelligence value to military planning (facility locations, personnel data, operational schedules, supply chain logistics) beyond traditional "crown jewels" focused on IP theft.
What good looks like: Monitoring for these assets includes behavioral analytics tuned to reconnaissance patterns, not just exfiltration signatures.
8. Your threat intelligence sharing posture accounts for institutional adversaries
□ Done: You participate in sector-specific ISACs or government-sponsored threat intelligence programs that provide context on state-sponsored campaigns, and you've established secure channels for sharing sensitive threat data.
What good looks like: You receive and act on classified or restricted threat briefings within 24 hours. You contribute anonymized indicators when you detect reconnaissance activity.
9. Third-party risk assessments address vendor exposure to state-sponsored threats
□ Done: Vendor security questionnaires and contract requirements explicitly address whether the vendor operates in or serves customers in regions subject to heightened state-sponsored cyber activity, and whether their security controls account for institutional threats.
What good looks like: Critical vendor contracts include notification requirements for state-sponsored incidents and specify acceptable response timelines that recognize these incidents require different handling than commodity breaches.
10. Your crisis management plan includes government coordination procedures
□ Done: Incident Response Plan defines when and how to engage FBI, CISA, or sector-specific agencies, with pre-established contacts and documented authority to share information during active incidents.
What good looks like: You've conducted a Tabletop Exercise that included government agency participation and tested your ability to coordinate response while maintaining attorney-client privilege and managing public disclosure obligations.
Common Mistakes
Treating all "APT" threats as equivalent. The difference between an institutionalized force-generation system and a sophisticated criminal group matters. The former has staying power, political objectives, and resources that change your risk calculus.
Waiting for perfect attribution before acting. You don't need to prove which specific GRU department conducted reconnaissance before you escalate monitoring or isolate affected systems. Tradecraft patterns are sufficient to trigger heightened response.
Assuming compliance frameworks address state-sponsored threats. NIST SP 800-53 and ISO/IEC 27001 provide controls, but they don't automatically account for adversaries with institutional training programs and multi-year operational timelines. You have to map those controls to specific threat scenarios.
Overlooking the espionage-to-destruction pipeline. What looks like routine cyber espionage today may be reconnaissance for destructive operations later. Track access patterns over time, not just in isolation.
Next Steps
If you checked fewer than seven items, your threat model likely underestimates institutionalized state-sponsored capabilities. Prioritize items 1, 2, 4, and 6 first; they require executive decision-making and can't be solved with technology alone.
If you checked seven or more, focus on operationalizing what you've documented. Run a Tabletop Exercise specifically testing your response to a scenario where reconnaissance activity from a known institutional threat actor coincides with geopolitical tension affecting your sector.
The exposure of Russian training programs confirms what sophisticated defenders already knew: you're not facing hackers. You're facing an adversarial system designed to produce trained operatives who understand military doctrine, technical operations, and ideological objectives. Your threat model needs to reflect that reality.
