3.6 Threat Analytics

Threat Analytics

Threat Analytics is the intelligence layer of the Defender portal. It shows active threat campaigns affecting organisations globally, maps them to your environment, and tells you whether you are exposed.

Unlike the incident queue (which is reactive — something already happened), Threat Analytics is proactive. It answers: “Is this new ransomware campaign that is hitting other organisations going to hit us? Are we protected?”

What you see

Each threat report contains:

Overview — a summary of the campaign, the threat actor (if attributed), the attack techniques used, and the geographic distribution. Written by Microsoft’s threat intelligence team.

Analyst report — the full technical analysis with indicators of compromise (IOCs), MITRE ATT&CK mapping, and detailed attack chain.

Exposure and mitigations — the critical section. This tells you how many of your devices, users, and mailboxes are exposed to this specific threat, and which mitigations you have deployed vs which you are missing.

How to use Threat Analytics operationally

Weekly review: Check the latest threat reports. Filter by relevance to your industry and geography. For each active campaign, check your exposure score and action the missing mitigations.

During incidents: When you are investigating an attack, check Threat Analytics to see if it matches a known campaign. Matching a known campaign gives you the full playbook — IOCs, TTPs, and expected next steps — without starting from scratch.

Reporting to leadership: The exposure metrics from Threat Analytics translate directly into executive-level risk communication. “We are exposed to the current AiTM campaign affecting financial services — 247 users lack phishing-resistant MFA” is actionable. “We need better security” is not.