TACAM Deep Dive: 7D Threat Actor Capability & Motivation Matrix

J. McKenney

This is an unnumbered working paper in the WG-07 Threat Modeling and TACAM Matrix working group. Its own closing section names the two confirmed working-group siblings that consume its output directly: the ATQ paper, whose score is built from TACAM's dimensions, and the Algorithmic Random Walks paper, whose Monte Carlo engine reads TACAM's actor-recency data.

Licence: CC BY 4.0. 17 September 2026.

Executive Abstract#

Commercial threat intelligence is a large, undifferentiated stream of alerts and indicators. It tells a security team that many things are potentially dangerous without telling them which ones actually matter to their specific organization. TACAM is an internal framework built to answer a narrower question: given a particular attacker, a particular piece of equipment, and a particular industry, how dangerous is that combination, right now?

TACAM profiles every known threat actor across seven separate dimensions at once, such as which industries and which vendor products an actor has been observed targeting, rather than reducing an actor to a single label like sophisticated or state-sponsored. Because those dimensions are tracked separately and kept current, they combine to answer very specific questions: which attackers can exploit a particular vendor's product, or which are increasing their focus on a given industry this quarter.

TACAM's output feeds the rest of the organization's risk analysis. It supplies the raw inputs to a single threat-danger score, adjusts a separate attack-simulation engine's assumptions about how active a given attacker currently is, and customizes which attackers are treated as relevant to a specific customer's own risk calculation.

Abstract#

In intelligence work the question is never "are we being targeted?" but "by whom, with what, and why now?" TACAM, the Threat Actor Capability and Motivation Matrix, answers all three. It is a proprietary framework that profiles every known threat actor across seven independent dimensions simultaneously (TTP, sector targeting, geography, protocol, temporal, CPE products, and CWE weaknesses), stored as cluster tables in the Eigenia knowledge graph rather than the flat, two-dimensional actor-to-technique tables conventional threat intelligence relies on. The combined matrix holds 77,279 data points across 389 threat actor groups, the largest dimension being 62,965 actor-product clusters that map which specific vendor products each actor can exploit. Because each dimension is queryable independently and in combination, TACAM answers procurement, exposure, and trend questions a flat model cannot pose, and its dimensions are the raw input to the working group's ATQ score, Monte Carlo simulation engine, and Seldon Rating, giving one knowledge graph three downstream uses rather than three systems of record.

1. The Problem With Threat Intelligence Today#

Every major cybersecurity vendor sells "threat intelligence." What they actually sell is a feed; a river of CVEs, IOCs, and STIX bundles flowing past your SOC at 10,000 alerts per day. Your analysts drown in data that tells them everything is dangerous and nothing is prioritized.

The root cause is architectural. Traditional threat intelligence is flat. It maps actors to techniques and techniques to vulnerabilities in simple two-dimensional tables. APT28 uses T1566 (Phishing). T1566 exploits CVE-2023-XXXX. Your firewall has rule X.

This is like profiling a criminal by listing every tool they've ever touched without understanding their patterns, their preferred targets, their operational rhythms, or how their capability evolves under geopolitical pressure.

TACAM is different. TACAM is not a list. It is a seven-dimensional fingerprint.

2. What TACAM Actually Is#

TACAM; Threat Actor Capability & Motivation Matrix; is a proprietary analytical framework that profiles every known threat actor across seven independent dimensions simultaneously. Each dimension is stored as a cluster table in the Eigenia knowledge graph, producing a combined matrix of 77,279 data points covering 389 threat actor groups.

Think of it as a spectral decomposition of threat actor behavior. Just as a prism separates white light into its constituent wavelengths, TACAM separates a threat actor's observable activity into seven independent analytical spectra:

3. The Power of Cross-Dimensional Queries#

Each dimension alone is useful. Crossed together, they answer questions that no single dimension can.

Traditional threat intelligence answers:

"APT28 is a Russian threat actor that targets government entities."

TACAM answers:

"APT28 targets the Energy sector (sector cluster) using T1190 Exploit Public-Facing Application (TTP cluster) against Siemens SIMATIC S7-1500 firmware (CPE cluster) exploiting CWE-787 Out-of-bounds Write (CWE cluster) with peak operational tempo in Q1 and Q3 (temporal cluster), originating from Moscow-timezone infrastructure (geography cluster), communicating via OPC-UA (protocol cluster)."

The difference: The first tells you to be worried. The second tells you exactly which PLC firmware version to patch, in which quarter, against which exploit technique, from which geographic origin.

4. Three Questions TACAM Answers That Nobody Else Can#

1. "Which actors target MY sector with MY vendor's products?"#

Cross-query: Sector × CPE × TTP

A CISO at a European energy utility asks: "I run Siemens SIMATIC and Schneider Electric Modicon PLCs. Who's coming for me?"

TACAM returns:

This query takes milliseconds. It draws from 62,965 CPE rows, 2,278 sector rows, and 1,579 TTP rows, all pre-computed, pre-clustered, and kept current.

2. "If we deploy a new vendor, what threat exposure do we inherit?"#

Cross-query: CPE × ATQ ranking → Vendor Blast Radius

Before a procurement decision, the engineering team asks: "What happens to our risk profile if we add ABB Ability to our SCADA stack?"

TACAM computes:

ABB Ability Vendor Blast Radius: 7 threat actors with ATQ > 60 can exploit ABB Ability products. - Aggregate actor ATQ: 73.4 (weighted average) - Most dangerous: Lazarus Group (ATQ 76.0); 3 known CVEs in ABB Ability Symphony Plus - CWE concentration: CWE-787 (Out-of-bounds Write), CWE-22 (Path Traversal) - Kill chain gap: No actor has full 14-tactic coverage for ABB; cooperation required for complete compromise Risk increment: Adding ABB Ability increases estimated fleet ALE by $2.1M (+4.4 percent)

No other platform can compute a procurement risk increment from a vendor name in under one second.

3. "Which actors are converging on our sector this quarter?"#

Cross-query: Temporal × Sector trend analysis

The intelligence analyst asks: "Show me actors whose energy sector targeting is increasing."

TACAM temporal analysis reveals:

Converging actors (Energy, Q2 2026): - Volt Typhoon: Campaign recency 0.95 (active this month), sector affinity up 0.12 YoY - CyberAv3ngers: New IRGC-attributed activity against Unitronics PLCs, sector affinity up 0.31 QoQ - Dragonfly: Dormant since Q3 2025, but historical seasonal pattern suggests Q2 reactivation (82 percent confidence) Diverging actors: - APT33: Energy sector affinity declining (shifting to aerospace), temporal threat score down 0.18

Why 62,965 CPE Rows Changes Everything#

The CPE dimension is the largest, and it matters most for procurement decisions. With 62,965 actor-product clusters, TACAM maps exactly which vendor products each actor can exploit.

No competitor does this: threat quantification at the level of individual products in your supply chain.

When a food manufacturer asks "should I replace my Rockwell Automation ControlLogix 5580 with a Siemens ET 200SP?" TACAM doesn't give an opinion. It computes the delta:

Current CPE (Rockwell ControlLogix):
  → 4 actors with ATQ > 70 can exploit
  → 12 known CVEs, 3 in CISA KEV
  → CWE concentration: CWE-20 (Improper Input Validation)

Proposed CPE (Siemens ET 200SP):  
  → 6 actors with ATQ > 70 can exploit
  → 18 known CVEs, 5 in CISA KEV
  → CWE concentration: CWE-787 (Out-of-bounds Write)

Delta: +2 actors, +6 CVEs, +2 KEV
ALE increment: +$1.4M annually

This is procurement intelligence. It turns a technical decision into a financial one, with actor attribution attached.

5. The Analytical Moat#

Building a TACAM matrix from scratch requires:

• 79,376 knowledge graph edges connecting actors to techniques, vulnerabilities, products, sectors, and geopolitical events
• 555,556 EPSS trajectory records tracking exploit probability evolution over time
• 95,560 kill chain views mapping technique usage to kill chain stages
• 35,341 geopolitical events correlated to actor campaign timing
• 182,313 embedded document chunks for semantic intelligence fusion
• 234 simulation epochs of continuous graph enrichment

This is not a dataset you download. It is a knowledge graph built over years of ingestion, enrichment, and cross-correlation. The TACAM matrix is the hardest part of Eigenia to replicate.

6. From TACAM to Action#

TACAM is not an academic exercise. Every dimension feeds directly into three platform outputs:

1. The ATQ Score → TACAM dimensions are the raw inputs to the Actor Threat Quotient
2. The Monte Carlo Engine → TACAM actor recency modifies Boltzmann walk weights in real-time (B2 boost map)
3. The Seldon Rating → TACAM sector × geography × CPE determines which actors are relevant to this customer, modifying the per-organization risk score

The chain: TACAM fingerprints the actor. ATQ scores the danger. Monte Carlo simulates the attack. ALE puts a dollar figure on it. Gordon-Loeb tells you what to spend. The board decides.

Seven dimensions. One decision.

7. References#

1. McKenney, J. (2026). Adversary Threat Quotient (ATQ): A Twelve-Factor Quantitative Threat Actor Scoring Model. Eigenia Research Working Group 07, WG-07-TM-ATQ.
2. McKenney, J. (2026). TACAM Algorithmic Random Walks & Sector-CPE Knowledge Graph Synthesis. Eigenia Research Working Group 07, WG-07-TM-06.