What is an example of an external threat?

The short answer: a domain one letter off from yours

A clear example of an external threat is a lookalike domain registered one letter off from yours. Here is a simulated example. A law firm owns summitridgelaw.com. Someone else registers sumitridgelaw.com, missing the "m". Nobody at the firm clicked anything. Nobody changed a firewall rule. Nothing on the firm's network looks any different today than it did yesterday.

That is exactly why it is the clearest example to explain. The business did nothing wrong, nothing on its network changed, and the domain sits entirely outside its control. Yet a lookalike domain can send or receive email and can host fake login pages. To a busy client or vendor reading an email on a phone, one missing letter is easy to miss. The first question to ask when you find one is simple: was this domain expected? Sometimes a marketing agency or a past employee registered it for a good reason. Often nobody inside the business has heard of it.

Why "external threat" is so confusing

An external threat is any risk to your business that originates outside your network and outside your direct control. It does not need to touch your servers, your laptops, or your email tenant to matter. It lives on the open internet, on a vendor's systems, on social platforms, or in criminal forums, and it still points at you.

The confusing part is the vocabulary around it. Threat intelligence can be a feed, a point solution, or a program. Searching for "threat intelligence" basically guarantees confusion, because external cyber threat intelligence is only one facet of it. Within that one facet there is a myriad of approaches and a myriad of sources. One product watches domains, another watches leak sites, another sells a raw stream of indicators, and they all use the same words on their websites.

Once a company understands how external threat intelligence fits next to everything else it runs, it can see the value in prevention, especially when the waves are calm. That is the point. The best time to notice an external threat is before it becomes an internal incident. If you want a deeper look at the difference between a stream of data and something you can act on, I wrote about findings versus feeds separately.

These are a few common examples, not a complete list. External threats take many forms, and new ones show up as attackers change tactics.

Brand and identity threats

These are external threats that borrow your domain, your brand, or your reputation. They work because people trust what looks familiar.

Domain spoofing

Domain spoofing covers lookalike domains like the simulated sumitridgelaw.com above: a missing letter, a doubled letter, a swapped letter, an extra hyphen, or a different ending. The risk is not the registration itself. The risk is what the domain can be used for: emails that appear to come from you, replies that quietly go to someone else, and pages built to look like yours.

Brand and social handle impersonation

The same idea shows up on social platforms and the open web. Someone creates a profile, a page, or a storefront that copies your brand or uses a handle close to yours. Your customers find it, trust it, and blame you when something goes wrong. You usually hear about it from a confused customer first, which is the least comfortable way to find out.

Third-party threats

The companies you rely on carry some of your risk. When something happens to one of them, it can become your problem, even though nothing on your own network may have changed.

A vendor breach or supply chain incident

A software provider, an IT provider, or a service you depend on is compromised, and the impact flows downstream to its customers. You did not choose to be part of the incident. You chose a vendor, and the vendor had a bad day.

A vendor named on a ransomware leak site

Ransomware groups run leak sites where they post the names of organizations they claim to have breached, as pressure to pay. If one of your critical vendors shows up on one of those sites, you need to know what data that vendor holds about you and what you would do if the claim turns out to be true.

I've seen a critical vendor named on a ransomware leak site before the vendor knew about it. I've seen a claim like that brushed off quickly, even when it looked credible from the outside. And I've seen one turn out to be about a different organization with a similar name. The value wasn't in guessing the outcome right. It was in having time to think: what does this vendor hold, what would we do if the claim is true, and who needs to know. That head start is easy to forget during the quiet months, and it's the part I'd least want to give up.

Underground threats

Dark web and threat actor mentions

Threat actors talk. Forums, marketplaces, and messaging channels are where targets get discussed, data gets advertised, and claims get made. A mention of your domain or your infrastructure in one of those places is an external threat even if nothing has happened yet. Sometimes it is noise. Sometimes it is the first sign of something real. Either way, it is something you cannot see from inside your own network.

Real examples from public records

A lookalike law firm domain and a $475,000 settlement

In Thomas v. Corbyn Restaurant Development Corp., an imposter used a lookalike of the plaintiff's law firm's domain, cnlegalrgroup.com instead of cnlegalgroup.com, to send fake wire instructions to defense counsel. Defense counsel wired the $475,000 settlement to the fraudster. The California Court of Appeal ruled that the defendants bore the loss. According to the opinion, defense counsel's own forensic review found no breach of its systems. The difference in the domain was a single extra letter.

Kaseya and the businesses behind the IT providers

In July 2021, attackers exploited a vulnerability in Kaseya's VSA on-premises software and pushed ransomware through managed service providers to their customers, according to CISA. In its press release, Kaseya said many of its customers manage IT for local and small businesses with less than 30 employees, such as dentists' offices, small accounting offices, and local restaurants, and that about 800 to 1,500 of those businesses were compromised. They were reached through their IT providers' software.

The bigger picture on business email compromise

The FBI's 2025 Internet Crime Report lists about $3.05 billion in reported business email compromise losses for 2025. Not every one of those cases involves a lookalike domain, and the report does not break the numbers out by business size, but it gives a sense of the scale of business email compromise overall.

What to do about external threats

Don't add more noise, don't try to boil the ocean, just take steps to add controls where it makes sense to offset risk. EDR is a mainstay of internal controls. Consider external cyber threat intelligence to be a mainstay of external controls.

No single example covers the whole picture, so the goal is reasonable coverage of the places where your business is most exposed. The examples above are common starting points, not the full list. That does not require watching everything. It requires knowing what is yours and noticing when it shows up somewhere it should not.

My view is that external threat intelligence is worth it only at the right price. Small teams do not need the largest datasets or research-grade tools. They need coverage that fits a smaller risk profile, at a price below the long-term exposure.

Where ThreatHarvest fits

ThreatHarvest is one way for a small team to add that external control. You register your domains, public IPs, brand keywords, and social handles, and it surfaces findings matched to your organization, not a raw feed. The simulated summitridgelaw.com example at the top of this post is the shape of a Domain Spoofing finding. If you're weighing costs, here's how external threat intelligence pricing works for small teams.