ENISA vs. TLCTC: A Systematic Gap Analysis & Integration Opportunity

Part I: ENISA's Current Approach to Cyber Threats and Risk

1.1 ENISA's Foundational Threat Definition

ENISA's foundational definition of cyber threat comes from their 2016 Threat Taxonomy: "Cyber Threats should be understood as threats applying to assets related to information and communication technology." The definition further specifies that such threats are materialized mostly in cyberspace, while some threats included are materialized in the physical world but affect information and cyber-assets.

This broad scoping creates immediate boundary challenges—physical sabotage of network infrastructure sits alongside software vulnerabilities in the same framework, without clear differentiation of the generic vulnerability being exploited.

1.2 The Nine-Category ENISA Threat Taxonomy

The ENISA Threat Taxonomy (Version 1.0, January 2016, updated 2022) organizes threats into nine high-level categories containing 177 detailed threats:

1.3 The ETL Prime Threats: Outcome-Oriented Classification

The annual ENISA Threat Landscape (ETL) reports use a simplified seven-threat framework for strategic communication. This structure reveals ENISA's predominantly outcome-based approach:

1.4 ENISA's Risk Framework Approach

ENISA's risk definition follows standard formulations: Risk = Likelihood × Impact, extended per ISO 27005 as Risk = Impact × Threat Likelihood × Vulnerability Level. However, a critical finding from their 2022 Compendium of Risk Management Frameworks is that ENISA does not incorporate Bow-Tie analysis or explicit cause-consequence separation in their core methodologies.

1.5 ENISA's Acknowledged 'Language Problem'

A 2015 ENISA publication titled 'Definition of Cybersecurity – Gaps and overlaps in standardisation' directly confronts terminological chaos:

"Finding a common understanding is a major challenge and it might not be possible to harmonize the definition and usage of the term."

ENISA documented how even the spelling (Cybersecurity vs. cyber security vs. Cyber Security) lacks consensus across international bodies. Furthermore, the ETL methodology contains extensive caveats acknowledging that 28.5% of incidents in ETL 2025 lacked sector classification.

Part II: Identified Gaps in ENISA's Current Framework

2.1 Structural Conflation Problems

The most significant gap is mixing conceptual levels without clear methodological justification. Their prime threat categories conflate:

• Root causes (vulnerability exploited) with attack mechanisms (technique used).
• Tools (malware) with specific malware types (ransomware listed separately).
• Techniques (social engineering) with outcomes (threats against data).
• Actor motivations with threat categories (ENISA's ETL 2018 acknowledged 'cyber espionage' is 'more a motive than a cyberthreat').

2.2 Absence of Cause-Based Classification

ENISA's taxonomy was developed as an "internal structuring aid for information collection" that "emerged organically over 2012-2015 rather than through systematic design." The framework currently lacks:

• Explicit generic vulnerability identification for each threat category.
• Non-overlapping classification criteria (mutual exclusivity).
• Attack path sequencing capability (attack steps as ordered sequences).
• Velocity analysis for control effectiveness assessment.
• Domain boundary crossing notation.

2.3 No Native Bow-Tie Integration

ENISA's ISO 27005-aligned approach treats cause-consequence distinction as implicit rather than explicit. This creates challenges for control mapping (preventive vs. mitigating), risk register development, and business impact analysis that doesn't conflate threat type with outcome type.

2.4 Incomplete Harmonization Despite Significant Investment

ENISA's harmonization efforts remain structurally incomplete. The Reference Incident Classification Taxonomy (RSIT) itself is described as "an adaptation of the CERT.PT taxonomy, which in turn is based on the eCSIRT.net mkVI taxonomy"—demonstrating ongoing fragmentation rather than convergence. Significantly, the 2025 CTL Methodology notes that the ENISA threat taxonomy is "currently under revision for the purpose of developing a more mature, actionable framework."

Part III: How TLCTC Addresses ENISA's Gaps

3.1 TLCTC's Cause-Oriented Architecture

The Top Level Cyber Threat Clusters framework provides exactly what ENISA's current approach lacks: a cause-oriented, actor-agnostic taxonomy that classifies threats by the generic vulnerability initially exploited.

3.2 Key Differentiators: TLCTC vs. ENISA

3.3 The Ransomware Example: Classification Comparison

Consider a typical ransomware incident: phishing email → credential theft → lateral movement → data encryption.

Part IV: How ENISA Would Benefit from TLCTC Integration

4.1 Solving the 'Language Problem'

TLCTC provides the semantic foundation ENISA needs by establishing 10 non-overlapping threat categories based on generic vulnerabilities. This eliminates the classification ambiguity of the current 177-threat taxonomy and separates causes from outcomes via Bow-Tie architecture.

4.2 Enhancing the ETL Methodology

ENISA's ETL reports could integrate TLCTC as a complementary classification layer:

4.3 Improving Risk Assessment Consistency

ENISA's ISO 27005-aligned risk formula (Risk = Impact × Threat Likelihood × Vulnerability Level) would gain precision through TLCTC integration:

• Threat Likelihood: Assessed per TLCTC cluster rather than per outcome category.
• Vulnerability Level: Mapped to generic vulnerabilities (#1-#10) rather than specific CVEs alone.
• Control Effectiveness: Evaluated using attack velocity classes (VC-1 to VC-4).

4.4 Supporting NIS2 and DORA Compliance

The EU's NIS2 Directive and DORA regulation require consistent threat and risk reporting. TLCTC enables standardized incident classification across EU member states, comparable risk registers using cause-based taxonomy, consistent control mapping via TLCTC-to-NIST-CSF integration, and attack path documentation for critical infrastructure sectors.

4.5 Addressing ENISA's 'Under Revision' Taxonomy

Given that ENISA's taxonomy is currently under revision, TLCTC offers a ready-made solution that has been systematically designed rather than organically evolved. It includes axiomatic foundations for consistent interpretation, provides a JSON schema for machine-readable incident documentation, integrates natively with MITRE ATT&CK at the operational layer, and is available under CC BY 4.0 license, aligning with ENISA's open collaboration model.

Conclusion: A Strategic Opportunity

ENISA's cybersecurity frameworks represent the most comprehensive European effort to standardize threat and risk terminology. However, fundamental tensions remain between operational utility and conceptual precision. TLCTC is not proposed as a replacement for ENISA's frameworks, but as a complementary layer that provides the cause-oriented precision currently missing. The integration would strengthen ENISA's position as the EU's cybersecurity authority while addressing the fundamental taxonomic gaps that limit cross-border incident comparability and risk assessment consistency.