# Threat Network **Entity class:** Network analytic object A **threat network** is a heterogeneous system of actors, organizations, resources, communications, transactions, locations, events, technical components, and supporting relationships that together create or enable a threat. DTRA's public strategy uses the term for WMD and improvised-threat environments and treats anticipation, detection, identification, location, characterization, assessment, and forecasting as distinct analytic tasks. Threat-network analysis does not reduce the network to a list of suspects. Some nodes may be material, infrastructural, unwitting, coerced, incidental, or incorrectly resolved. The operational value comes from typed edges, provenance, uncertainty, time, and the ability to compare alternative network states. ## Relationships - **analyzed by:** [[wiki/Counter-Threat Network|Counter-Threat Network]] work and [[wiki/Counterterrorism Predictive Graph|Counterterrorism Predictive Graph]]. - **illuminated through:** [[wiki/Network Illumination|Network Illumination]]. - **may contain:** [[wiki/Support Network|Support Network]], [[wiki/Financial Network|Financial Network]], [[wiki/Communications Network|Communications Network]], and [[wiki/Logistics Network|Logistics Network]]. ## Sources - [2019 DTRA Strategic Plan for Research, Development, Test and Evaluation](https://www.dtra.mil/Portals/61/Documents/Missions/190424_2019_DTRA_Strategic_Plan_for_RDTE.pdf) **As of:** 2026-09-23 ## Civilian intelligence marketplace — operational bridge Distributed reporting, commercial records, and agent investigation help identify and correlate the people, infrastructure, and relationships relevant to a threat. [[wiki/Reporting-and-Fusion Architecture|Reporting-and-Fusion Architecture]], [[wiki/Agentic OSINT|Agentic OSINT]], and [[wiki/Cyber Surveillance Operations|Cyber Surveillance Operations]] supply different collection and analysis routes. [[wiki/Sovereign Target Designation|Sovereign Target Designation]] connects the cyber program’s work with its authorized threat class. **Source article:** [[articles/The Coming Market for Civilian Spycraft|The Coming Market for Civilian Spycraft]]. **Collection:** [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]]. ## Connected Austin capabilities [[wiki/Threat-Network Dismantlement|Threat-Network Dismantlement]]. These entries identify associated implementations, people, methods, and institutional contexts in [[articles/How Austin Became a Different Kind of Defense Tech Epicenter|How Austin Became a Different Kind of Defense Tech Epicenter]]. [[wiki/Austin Defense Technology|Austin Defense Technology]] supplies their regional arrangement; [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] supplies the wider supplier and participation economy.