The Threat Plane : A Geometric Framework for Modeling and Visualizing Organizational Cyber Risk in Three-Dimensional Space

A research methodology for data scientists, security researchers, and practitioners seeking to advance threat modeling through topological and machine learning approaches. Full repo here: https://github.com/Bodhi8/geometric-threat-intel

Abstract: This paper introduces the Threat Plane — a novel geometric framework that reconceptualizes organizational cyber risk as a navigable three-dimensional manifold. By synthesizing graph neural networks, topological data analysis, advanced dimensionality reduction techniques, and real-time telemetry integration, we propose a unified methodology for projecting the high-dimensional attack surface onto an interpretable 3D space. This representation enables security teams to identify emergent threat clusters, predict attack trajectories, and quantify defensive coverage gaps through spatial reasoning. We present both the theoretical foundations and practical implementation pathways for organizations seeking to operationalize geometric threat intelligence.

1. Introduction: Beyond Flat Threat Models

Traditional threat modeling approaches — from STRIDE to attack trees to kill chains — share a fundamental limitation: they represent inherently multidimensional risk landscapes as linear sequences or hierarchical structures. While these frameworks have served the security community well, they struggle to capture the complex interdependencies, emergent behaviors, and dynamic evolution that characterize modern threat environments. An adversary does not traverse a tree; they navigate a manifold.

The concept of the Threat Plane emerges from a simple but powerful observation: if we can embed the entirety of an organization’s exposed risk surface into a geometric space, we unlock an entirely new vocabulary for threat analysis. Proximity becomes vulnerability correlation. Curvature indicates attack amplification potential. Geodesics trace optimal adversary paths. Voids represent defensive coverage. The threat landscape becomes literally navigable.

This paper synthesizes advances across multiple domains — graph representation learning, topological data analysis, information geometry, and interactive visualization — to propose a comprehensive framework for constructing, analyzing, and operationalizing threat planes. We move beyond visualization as an afterthought and instead position geometric representation as the foundational analytical primitive.

2. Theoretical Foundations

2.1 The Threat Manifold Hypothesis

We begin with a foundational claim: the space of all possible security states for an organization forms a high-dimensional manifold M embedded in ℝⁿ, where n corresponds to the dimensionality of the feature space encoding assets, vulnerabilities, configurations, and threat intelligence. The Threat Plane is then a lower-dimensional projection π: M → ℝ³ that preserves essential topological and geometric properties relevant to security analysis.

π: M ⊂ ℝⁿ → T ⊂ ℝ³ subject to d_T(π(x), π(y)) ≈ d_M(x, y)

This preservation constraint is critical. We require that the projection approximately maintains geodesic distances on the manifold — points that are “close” in security-relevant terms should remain proximate in the threat plane. This is not merely a visualization convenience; it is the foundation that allows spatial reasoning to yield valid security insights.

2.2 Information-Theoretic Grounding

The threat plane can be formalized through the lens of information geometry. Each point in the space represents a probability distribution over possible attack outcomes given the current security state. The Fisher information metric induces a natural Riemannian structure on this space, and the threat plane becomes a 3D slice through this statistical manifold.

Formally, let p(attack | state) denote the conditional probability of attack success given a security configuration. The Fisher information matrix G defines local distances in the state space, and our projection must respect this metric structure to ensure that similar risk profiles cluster together in the visualization.

G_ij(θ) = E[∂ log p(x|θ)/∂θ_i · ∂ log p(x|θ)/∂θ_j]

2.3 Topological Considerations

Beyond metric preservation, we care deeply about topological invariants. The Betti numbers of the threat manifold — counts of connected components, loops, and voids — carry security meaning. A connected component represents a cluster of correlated risks. A persistent loop indicates a cyclic attack dependency. A void suggests a region of defensive coverage where attacks are unlikely to succeed.

Persistent homology provides the mathematical machinery to extract these features across multiple scales. By constructing a filtration of simplicial complexes from our threat data and tracking the birth and death of topological features, we obtain a multi-scale signature of the threat landscape’s structure.

3. Constructing the Threat Graph

3.1 Heterogeneous Security Knowledge Graphs

The threat plane is not constructed directly from raw telemetry but from a structured representation we call the Security Knowledge Graph (SKG). This heterogeneous graph integrates multiple entity types and relationship classes into a unified representation.

Node Types: Assets (hosts, services, applications, data stores), Vulnerabilities (CVEs, misconfigurations, weak credentials), Threat Actors (APT groups, criminal organizations, insider threats), Techniques (MITRE ATT&CK tactics and techniques), Controls (firewalls, EDR, access policies), and Identity entities (users, service accounts, roles).

Edge Types: EXPOSES (asset → vulnerability), EXPLOITS (technique → vulnerability), USES (actor → technique), TARGETS (actor → asset), PROTECTS (control → asset), MITIGATES (control → vulnerability), AUTHENTICATES_AS (identity → asset), LATERAL_MOVE (asset → asset), and DATA_FLOW (asset → asset).

This graph structure captures not just what vulnerabilities exist but how they interconnect, which actors might exploit them, and what defensive measures are in place. The richness of this representation is what enables meaningful geometric embedding.

3.2 Temporal Attack Graphs

Static graphs miss the dynamic nature of threat evolution. We augment the SKG with temporal edges that encode attack progression probability — the likelihood that compromise of node u leads to compromise of node v within time window Δt. These probabilities are learned from historical incident data, red team exercises, and threat intelligence feeds.

P(v_t+Δt | u_t) = σ(f_θ(h_u, h_v, e_uv, Δt))

Where h_u and h_v are node embeddings, e_uv is the edge feature vector, and f_θ is a learned scoring function. This formulation allows us to weight edges by actual attack feasibility rather than mere connectivity.

4. Embedding into the Threat Plane

4.1 Graph Neural Network Architectures

Transforming the security knowledge graph into the threat plane requires learning meaningful node embeddings that capture both local neighborhood structure and global graph topology. We employ a multi-layer Graph Attention Network (GAT) architecture enhanced with several innovations for the security domain.

Heterogeneous Message Passing: Standard GNNs assume homogeneous node and edge types. Our architecture uses relation-specific transformation matrices W_r for each edge type r, allowing the network to learn distinct propagation patterns for different relationship semantics.

h_v^(l+1) = σ(Σ_{r∈R} Σ_{u∈N_r(v)} α_uv^r W_r^(l) h_u^(l))

Risk-Aware Attention: Attention coefficients are modulated by node criticality scores derived from asset valuation and vulnerability severity. High-value targets receive amplified attention during message aggregation, ensuring their risk context propagates strongly through the graph.

Temporal Positional Encoding: For temporal attack graphs, we incorporate sinusoidal positional encodings based on edge timestamps, enabling the network to distinguish between historical and recent relationships.

4.2 Advanced Dimensionality Reduction

With node embeddings in hand (typically 64–256 dimensions), we project to 3D using techniques that balance local and global structure preservation.

UMAP with Custom Metrics: Uniform Manifold Approximation and Projection (UMAP) serves as our primary projection engine, configured with security-specific distance metrics. Rather than Euclidean distance in embedding space, we use a composite metric that weights dimensions by their contribution to attack path feasibility.

d_security(u, v) = √(Σ_i w_i(u_i — v_i)²) where w_i = I(dim_i ∈ attack_relevant)

t-SNE for Local Cluster Refinement: After UMAP projection, we apply localized t-SNE optimization to refine cluster boundaries. This two-stage approach leverages UMAP’s superior global structure preservation while using t-SNE’s strength in revealing local neighborhood relationships.

PaCMAP for Balanced Preservation: As an alternative, Pairwise Controlled Manifold Approximation (PaCMAP) offers excellent balance between local and global structure through its three-stage optimization of near pairs, mid-near pairs, and far pairs. This is particularly effective when the threat graph has both dense clusters and sparse connector regions.

4.3 Preserving Attack Path Geodesics

A critical requirement is that attack paths in the original graph correspond to navigable trajectories in the threat plane. We enforce this through a geodesic regularization term in the embedding loss function.

L_geo = Σ_{paths p} ||d_T(π(p_start), π(p_end)) — Σ_{edges e ∈ p} cost(e)||²

This ensures that the 3D Euclidean distance between attack path endpoints approximates the cumulative traversal cost along the path in the original graph. As a result, adversary trajectories appear as smooth curves in the threat plane rather than arbitrary jumps.

5. Topological Analysis of the Threat Plane

5.1 Persistent Homology for Threat Detection

Once embedded in 3D, we apply persistent homology to extract topological features at multiple scales. The Vietoris-Rips complex built from threat plane points yields persistence diagrams that encode the lifespan of topological features.

H₀ (Connected Components): Long-lived components represent distinct threat clusters — groups of assets, vulnerabilities, and attack paths that form isolated risk domains. The number and persistence of these components informs security architecture decisions about network segmentation and blast radius containment.

H₁ (Loops): Persistent one-dimensional holes indicate cyclic attack dependencies — situations where compromise of A enables compromise of B, which enables compromise of C, which in turn facilitates compromise of A. These feedback loops are particularly dangerous as they enable persistent threat presence and warrant priority remediation.

H₂ (Voids): Two-dimensional cavities in the threat plane represent regions of defensive coverage — configurations of controls that create protected zones within the risk space. The size and stability of these voids quantify the robustness of defensive architectures.

5.2 Mapper Algorithm for Structure Discovery

Beyond homology, the Mapper algorithm provides a complementary lens on threat plane structure. By covering the plane with overlapping regions, clustering within each region, and connecting clusters that share points, Mapper produces a simplified graph that captures the essential skeleton of the threat landscape.

This skeleton reveals branching structures (where attack paths diverge), convergence points (common attack targets), and chokepoints (assets through which many paths must pass). The Mapper graph serves as a compressed executive summary of the full threat plane, suitable for strategic briefings and high-level risk communication.

6. Machine Learning on the Threat Plane

6.1 Anomaly Detection in Geometric Space

The 3D threat plane enables geometric approaches to anomaly detection that would be intractable in the original high-dimensional space.

Local Outlier Factor (LOF): Points in the threat plane with low local density relative to their neighbors indicate unusual risk configurations — potentially novel attack vectors, misclassified assets, or emerging threat patterns that don’t fit established clusters.

Isolation Forest on 3D Coordinates: Random partitioning of the threat plane efficiently identifies outliers as points requiring fewer splits to isolate. This scales linearly with data size and updates efficiently as new threats are embedded.

Geodesic Anomaly Scoring: Rather than Euclidean distances, we compute geodesics along the threat manifold surface. Points that are Euclidean-close but geodesically-distant indicate threat bridges — unexpected connections between otherwise separated risk domains.

6.2 Attack Trajectory Prediction

Given the current position of an active threat in the plane, we predict likely future positions using a neural trajectory model.

Recurrent Neural ODE: We model adversary movement as a continuous-time dynamical system, where a neural network parameterizes the velocity field on the threat plane. Given an initial compromise point, the ODE integrates forward to predict the attack trajectory.

dz/dt = f_θ(z, t, context) where z ∈ ℝ³ is the threat plane position

Transformer-based Sequence Modeling: For discrete attack steps, we tokenize threat plane regions and train a transformer to predict the next region given the attack history. This captures the strategic reasoning that guides adversary decision-making.

6.3 Clustering for Threat Family Discovery

Unsupervised clustering on the threat plane reveals natural groupings of related risks.

HDBSCAN for Variable-Density Clusters: Threat plane clusters often have varying densities — dense cores of highly correlated vulnerabilities surrounded by sparser peripheries of tangentially related risks. HDBSCAN handles this heterogeneity gracefully while identifying noise points that merit individual investigation.

Spectral Clustering on the Threat Graph: For comparison, we apply spectral clustering to the graph Laplacian, projecting results onto the threat plane to validate cluster coherence. Agreement between geometric and spectral clusters indicates robust groupings; disagreement highlights artifacts of the embedding process.

7. Novel Advances: Pushing the State of the Art

7.1 Dynamic Threat Plane Evolution

Real threat landscapes are not static — they evolve as new vulnerabilities are disclosed, patches are deployed, and adversary tactics shift. We introduce Incremental Threat Plane Updates that maintain embedding consistency without full recomputation.

Anchor-Based Incremental Embedding: A subset of stable, high-criticality nodes serve as anchors with fixed positions. New nodes are embedded relative to these anchors using a localized optimization that preserves neighborhood relationships while minimizing disruption to the existing layout.

Temporal Morphing: Rather than discrete snapshots, we model the threat plane as a continuously deforming surface. Optimal transport theory provides the mathematical framework for computing minimal-cost deformations between successive states, enabling smooth animations that reveal how the threat landscape evolves over time.

7.2 Hyperbolic Embeddings for Hierarchical Threats

Euclidean 3D space may not be the optimal geometry for all threat landscapes. When the security knowledge graph exhibits strong hierarchical structure — such as enterprise networks with clear organizational boundaries or kill chains with sequential dependencies — hyperbolic geometry offers superior embedding fidelity.

The Poincaré ball model embeds hierarchical trees with exponentially growing capacity near the boundary, naturally representing the branching structure of attack possibilities. We project from hyperbolic space to Euclidean 3D for visualization while preserving the hierarchical relationships in the layout.

7.3 Multi-Modal Threat Fusion

Modern security operations generate diverse data modalities: structured vulnerability scans, unstructured threat intelligence reports, network flow telemetry, and endpoint behavioral logs. We propose a Multi-Modal Contrastive Learning framework that aligns representations across modalities into a unified threat plane.

For each modality m, a specialized encoder E_m produces embeddings, and contrastive losses enforce that semantically related entities across modalities map to nearby points in the shared embedding space. The threat plane thus becomes a lingua franca that unifies heterogeneous security data sources.

7.4 Causal Structure Discovery

Correlation in the threat plane does not imply causation — proximate vulnerabilities may share a common root cause rather than enabling each other. We integrate causal discovery algorithms to infer directed causal edges within threat clusters.

The PC algorithm and its variants, applied to observational data from security telemetry, identify candidate causal relationships. These are validated through interventional analysis: if patching vulnerability A reduces the exploitability of vulnerability B, we have evidence for a causal link. Causal edges are overlaid on the threat plane as directed arrows, distinguishing correlation from true attack enablement.

7.5 Adversarial Robustness of the Threat Plane

A sophisticated adversary might attempt to manipulate the threat plane itself — injecting misleading telemetry to cause benign activities to cluster with threats, or obscuring true attack paths through evasion. We develop defenses against these adversarial manipulations.

Certified Robust Embeddings: Using randomized smoothing and provable robustness techniques, we bound the maximum displacement of any point in the threat plane under bounded input perturbations. This provides guarantees that small amounts of adversarial noise cannot drastically alter the geometric structure.

Ensemble Embedding: Multiple threat planes are constructed using different random seeds, architectures, and hyperparameters. Disagreement between ensemble members on cluster assignments or anomaly scores triggers human review, as it may indicate adversarial manipulation or genuine novel threats.

8. Practical Implementation Framework

8.1 Data Pipeline Architecture

Data Ingestion Layer: Connectors ingest from vulnerability scanners (Qualys, Tenable, Rapid7), asset inventories (ServiceNow CMDB, Axonius), threat intelligence platforms (MISP, OpenCTI), SIEM systems (Splunk, Elastic), and EDR solutions (CrowdStrike, Carbon Black). Apache Kafka provides the streaming backbone for real-time ingestion.

Graph Construction Service: A dedicated service maintains the security knowledge graph in a property graph database (Neo4j, Amazon Neptune, or TigerGraph). Entity resolution pipelines merge duplicate nodes, and relationship inference modules derive implicit edges from observed patterns.

Embedding Compute Cluster: GNN training and inference runs on GPU-accelerated infrastructure. PyTorch Geometric or DGL provides the graph neural network primitives, with custom layers for heterogeneous attention and temporal encoding. Model checkpoints enable rapid warm-start retraining as the graph evolves.

Projection Service: UMAP and t-SNE projections are computed using cuML for GPU acceleration, reducing projection time for million-node graphs from hours to minutes. Incremental embedding updates are handled by a separate microservice that recomputes local neighborhoods without full re-projection.

8.2 Visualization Platform

The threat plane requires an interactive 3D visualization platform that supports exploration, annotation, and collaboration.

Rendering Engine: Three.js or Babylon.js provides WebGL-accelerated rendering capable of displaying hundreds of thousands of points with smooth interaction. Level-of-detail techniques reduce visual clutter at distant zoom levels while revealing fine structure on close inspection.

Semantic Overlays: Risk heatmaps, attack path animations, cluster boundaries, and defensive coverage zones are rendered as semi-transparent layers that can be toggled independently. Color encodings follow a consistent scheme: red for high severity, yellow for medium, green for mitigated, blue for protected.

Collaboration Features: Multiple analysts can simultaneously explore the threat plane with shared cursors and annotations. Bookmarked viewpoints enable quick navigation to regions of interest, and annotation threads attach contextual discussions to specific points or paths.

8.3 Integration with Security Workflows

Vulnerability Prioritization: The threat plane informs vulnerability remediation by identifying critical junctions where multiple attack paths converge. Vulnerabilities at these points receive elevated priority regardless of standalone CVSS scores, as their remediation simultaneously disrupts multiple threat scenarios.

Threat Hunting: Analysts use the threat plane to guide hypothesis-driven hunting. Movement along predicted attack trajectories suggests where to focus log analysis and forensic investigation. Unexplored regions of the plane become candidates for proactive reconnaissance.

Red Team Planning: Offensive security teams use the threat plane to plan engagement strategies, identifying high-value paths through the risk landscape and predicting where blue team defenses are strongest. Post-engagement, actual attack paths are overlaid on the plane to validate or update the model.

9. Conclusion: Toward Geometric Threat Intelligence

The Threat Plane represents a paradigm shift in how we conceptualize and interact with organizational cyber risk. By embedding the high-dimensional attack surface into a navigable three-dimensional space, we transform threat analysis from symbolic reasoning about discrete entities into spatial reasoning about continuous landscapes.

This geometric perspective unlocks new analytical capabilities: topological analysis reveals structural vulnerabilities invisible to traditional methods, machine learning on the manifold enables predictive threat intelligence, and interactive visualization makes the risk landscape accessible to diverse stakeholders. The threat plane is not merely a visualization — it is a new analytical primitive for security.

We have presented both the theoretical foundations and practical implementation pathways for organizations seeking to operationalize this approach. The synthesis of graph neural networks, topological data analysis, advanced dimensionality reduction, and real-time visualization creates a comprehensive framework that advances the state of the art in threat modeling.

As threat landscapes grow more complex and adversaries more sophisticated, geometric intuition will become an increasingly valuable tool in the defender’s arsenal. The threat plane offers a path toward that future — a future where we don’t just list our risks, but truly understand the shape of our exposure.

—

The code, datasets, and interactive demos referenced in this paper are available in the accompanying repository. We invite the security research community to build upon this foundation and explore the vast uncharted territory of geometric threat intelligence.

About the Author

Brian Curry is a Kansas City-based Data Scientist, AI expert, and founder of Vector1 Research, where he explores the frontier of Artificial Intelligence, Causal Inference, Agentic Systems, and Economic Modeling.

His work focuses on building intelligent systems that reveal the causal structures driving performance across marketing, content, and economics. He is the creator of PyCausalSim (causal discovery through simulation), Papilon (complex system optimization), Daedalus (causal and economic analysis), and Memory-Node Encapsulation (data structures for artificial episodic memory).

Contact: brian@vector1.ai