Enterprise Architecture Threat Modeling for Cybersecurity Risk Management

Organizations invest heavily in cybersecurity capabilities, yet the relationship between deployed defensive portfolios, practitioner judgments of coverage, and empirically observed adversary behavior remains difficult to assess. This study examines that relationship by integrating practitioner elicitation with threat-informed cybersecurity architecture analysis. A model-derived analytical baseline was constructed using the Cybersecurity Architecture Review (CAR) methodology aligned with MITRE ATT&CK version 17, quantifying protect, detect, and respond coverage for 12 commonly deployed cybersecurity capability categories. Survey data from 65 cybersecurity practitioners were used to characterize capability portfolios, perceived coverage, and factors influencing capability-selection decisions. Results show uneven modeled coverage across the ATT&CK lifecycle and substantial functional overlap among capability categories. Across 910 respondent-tactic observations, practitioner-estimated coverage exceeded corresponding respondent-specific modeled coverage by approximately 27 percentage points on average, although the magnitude and direction of perception-model divergence varied by tactic. Most subgroup comparisons by professional role, responsibility, and experience did not identify statistically significant differences, while government respondents exhibited slightly higher mean divergence than nongovernment respondents in one pairwise comparison. Capability-selection decisions reflected multiple organizational and external influences, with formal internal threat modeling reported less frequently than peer practices, regulatory or compliance requirements, independent research, and analyst or consultant reports. The findings demonstrate how threat-informed architecture analysis can complement practitioner judgment by making modeled coverage, gaps, overlap, and divergence explicit within organizational cybersecurity risk governance.