Initial Access Threat Assessment Methodology for Internet-Exposed Assets

Background: Internet-facing enterprise assets represent a critical part of the external attack surface because they can be discovered, fingerprinted, and targeted by attackers before initial access is established. Although MITRE ATT&CK provides a structured taxonomy of adversarial behavior, organizations still need a repeatable way to transform relevant techniques into prioritized and executable security assessments.Objective: The objective was to develop and demonstrate a structured MITRE ATT&CK based threat assessment methodology that supports the identification, clustering, prioritization, assessment, and improvement planning of adversarial techniques. Initial Access threats targeting internet-exposed enterprise assets were used as the demonstration domain.Methods: The methodology was designed as a four-phase assessment lifecycle consisting of (1) baseline analysis, clustering, and preliminary prioritization, (2) Cyber Threat Intelligence-supported assessment prioritization, (3) assessment design and execution, and (4) improvement plan creation. Its feasibility was demonstrated in a single enterprise environment using selected MITRE ATT&CK Enterprise v18.1 techniques from the Reconnaissance, Initial Access, and Credential Access tactics.Results: The demonstration produced assessment-oriented threat clusters and identified Network/Service Exploitation, Brute Force & Exploitation, and Valid Accounts Abuse as high-priority clusters. A perimeter discoverability assessment showed low external discoverability, 95% average EASM inventory completeness (77.39% completeness for IP ranges), 5-6 times higher domain coverage by the open-source toolchain than by external TPRM platforms, and a 257.54% active-IP attribution ratio for one external source. The findings were transformed into an improvement plan with traceable remediation items.Conclusion: The proposed methodology provides a practical bridge between MITRE ATT&CK, Cyber Threat Intelligence, security assessment execution, and improvement planning. The demonstration shows that the approach can produce specific and traceable outputs under real enterprise conditions and can be adapted to other ATT&CK tactics or assessment domains. Because it covers one organization and one executed sub-assessment, it establishes feasibility rather than general effectiveness.