◆ Mapping · Splunk/Cisco → TLCTC v2.3

# Top 50 Cybersecurity Threats
Through the TLCTC Lens

Splunk/Cisco's report catalogs threats by what happens. TLCTC classifies by why compromise is possible — the generic vulnerability exploited. This comparison reveals the causal structure behind each threat.

Splunk asks
“What is the threat?”
⟶
TLCTC reveals
“Why does it work?”
TLCTC Cluster Distribution across Splunk's Threats

## Taxonomy Critique: Six Problems in One List

The Splunk/Cisco report markets itself as a “Top 50” threat list, but it actually contains 53 entries that conflate at least six fundamentally different classification axes into one flat ranking. When causes, outcomes, actor labels, control failures, evasion techniques, and specificity levels are treated as interchangeable, the resulting list cannot answer the question it implies: “What should we defend against?”

6 not threats (outcomes, actors, control failures)
5 near-duplicate entries across chapters
7 entries for a single TLCTC cluster (#9)
6 different grouping axes across 8 chapters

### ■ Outcomes disguised as threats

Data exfiltration and ransomware encryption are consequences of compromise, not causes. Listing them as threats is like listing “bleeding” as a disease. TLCTC Axiom III: threats exist on the cause side; outcomes are Data Risk Events.

#2 Data Exfiltration #13 Data Exfil (Cloud) #39 Ransomware (partly)

### ■ Actor labels disguised as threats

“APT” describes who is attacking and how patient they are. “Insider Threat” describes where the attacker sits. Neither tells you which generic vulnerability is exploited. TLCTC Axiom IV: actor identity must never determine classification.

#1 APT #22 Insider Threat

### ■ Control failures disguised as threats

A misconfigured S3 bucket is not an attack — it is a door left open. The attack is what walks through the door. TLCTC Axiom V: control failures create exposure; exploitation is the threat.

#12 Cloud Misconfig #16 Exposed Databases #19 Shadow IT

### ◆ Operational traits disguised as distinct threats

A “zero-day” is a patch-availability status, not a vulnerability class. “Polymorphic” describes an evasion wrapper. “Living off the land” describes tool selection. None of these change the generic vulnerability exploited — they are operational modifiers on real threats.

#5 Zero-Day Exploit #38 Polymorphic Malware #36 Living off the Land #37 Malware C2

### ◆ Near-duplicate entries across chapters

The same concept appears multiple times under different surface labels, inflating the count and fragmenting detection logic. A “top 50” that double-counts is not a top 50.

#2 ≈ #13 Data Exfiltration #11 ≈ #15 Resource/Cryptojacking #14 ≈ #48 Insecure APIs / API Exploit #22 ≈ #23 Insider Threat / Misuse #34 overlaps #33 BYOVD

### ◇ Granularity chaos: one cluster, seven entries

Social Engineering, Phishing, Spear Phishing, Smishing, BEC, Vishing/Deepfake, and SIM Hijacking all exploit the same generic vulnerability: human psychological susceptibility. The report gives 7 entries to #9 while #5 MitM, #6 Flooding, and #8 Physical get one each. Specificity is applied selectively — there is no consistent zoom level.

#41 BEC #42 Deepfake/Vishing #43 Phishing #44 SIM Hijacking #45 Smishing #46 Social Engineering #47 Spear Phishing

### Inconsistent chapter grouping axes

The 8 chapters use at least 6 different organizing principles simultaneously. No two chapters apply the same classification axis, making cross-chapter comparison meaningless.

Chapter | Stated scope | Actual grouping axis
--- | --- | ---
Ch 1 | Advanced & Emerging | Novelty / severity
Ch 2 | AI Threats | Technology domain
Ch 3 | Cloud & SaaS | Deployment model
Ch 4 | Identity & Credential | Target asset
Ch 5 | Network & Infrastructure | OSI layer
Ch 6 | Malware & Exploits | Technique category
Ch 7 | Phishing & Social Engineering | Technique category
Ch 8 | Web & Application | Attack surface

### Why this matters

A taxonomy that mixes classification axes cannot produce non-overlapping categories. Entries inevitably appear in multiple chapters (an API exploit is also a web attack, a cloud threat, and potentially an AI threat), duplicates inflate the count, and defenders cannot derive a finite set of controls from the list. TLCTC solves this with a single classification axis: the generic vulnerability exploited. Ten clusters. Non-overlapping. Every attack step maps to exactly one.

# | Threat | Chapter | TLCTC Clusters | Type | Rules
--- | --- | --- | --- | --- | ---

## Methodology & Key Principles

Each of Splunk/Cisco's threats was analyzed against the TLCTC v2.3 framework axioms and classification rules. The mapping follows these principles:

- Axiom III — Threats are causes, not outcomes. "Data exfiltration" and "ransomware" are outcomes (DREs), not threat clusters.
- Axiom IV — Actor identity never determines classification. "Insider threat" and "APT" describe actors/campaigns, not generic vulnerabilities.
- Axiom V — Control failures are not threats. "Cloud misconfiguration" and "Shadow IT" are governance failures; the exploitation is the threat.
- R-ROLE — Classify by component role relative to attacker: server-role = #2, client-role = #3.
- R-CRED — Credential acquisition maps to the enabling cluster; credential use is always #4 Identity Theft.
- R-EXEC — If foreign executable content executes, a #7 Malware step must be recorded.
- R-SUPPLY — #10 is placed at the Trust Acceptance Event (TAE).
- R-FLOOD — Volume/intensity exhaustion = #6; implementation defect causing crash = #2/#3.
- R-HUMAN — If the mechanism is psychological manipulation of a human, classify as #9; subsequent technical steps are separate.
- R-PHYSICAL — If the mechanism is unauthorized physical access/interference, classify as #8; subsequent steps are separate.
- R-ABUSE — If no implementation flaw is required and the attacker abuses designed functionality, classify as #1. "Perfect Implementation Test": would this work against a perfect implementation? Yes = #1, No = #2/#3.
- Axiom VI — One step = one cluster. Multi-cluster threats must be decomposed into separate attack-path steps.

Source: "Top 50 Cybersecurity Threats", Splunk (a Cisco company), 2025. The report describes 53 individual threat entries across 8 chapters.