Abstract: Techniques described herein pertain to prioritizing threats based on their potential effect on the specific enterprise network sought to be protected. In one example, this disclosure describes a method that includes collecting, by a computing system and from a plurality of external data sources, threat information; storing, by the computing system and in a threat registry, the threat information that includes information about a plurality of threats; collecting, by the computing system, information about an attack surface for an enterprise network; mapping, by the computing system, the threat information to the attack surface; analyzing, by the computing system and based on the mapping of the threat information to the attack surface, a threat included in the plurality of threats to identify a risk score associated with the threat, wherein the risk score represents an assessment of the vulnerability of the enterprise network to the threat.