Robot fleets are operated, not just installed. Somebody watches battery curves, task queues and sensor drift, and increasingly somebody also has to ask who else might be watching the same fleet. ThreatOps, as the Ops Atlas lays it out, is the discipline of learning about hostile activity and then searching your own environment for it, run together as one steady operation. This primer is written for operations staff who know their robots well and their threat vocabulary less well. It pairs a short glossary with an evidence-first way of thinking about each term, and it keeps to what the Atlas actually claims.

A note on certainty

Before the glossary, a caution that fits an analytical audience. The Atlas states that no standards body defines ThreatOps and that it considers the term ambiguous. The activities inside it, gathering intelligence on threats and hunting for intruders, are long established. The Atlas’s choice to run them as a single operation is editorial. So when you read a vendor brochure, ask what exactly is being sold under the name.

Glossary part one: knowing what to look for

Requirement

A written question the operation needs answered. The Atlas wants a handful, five to eight, each limited to one question with one fact and one decision. For a robot floor the question might be: which remote-maintenance routes into our controllers are being abused elsewhere this quarter, and do we expose any? Compare it with a KPI such as cycle time, which also has a definition, a data source and an owner; the parallel is deliberate, and it lines up with the thinking behind the performance indicators factory managers track for robots.

Indicator

A concrete trace such as a network address, a domain or a file fingerprint. Indicators are the easy-to-share part of intelligence, and, like a sensor reading, they have a freshness limit. The Atlas notes that the common sharing format treats expiry as optional, so operations must set their own. The sample policy in the entry runs from fourteen days for addresses up to a year for file fingerprints, with links and domains in between.

Behaviour

What an adversary does rather than the traces left behind. The Atlas places a public catalogue of attacker tactics and techniques here. A tactic is a goal, a technique is a method. The catalogue’s October 2026 release lists 15 enterprise tactics and 227 techniques and added names for stealth and defence impairment. Think of behaviours as failure modes: you can change a part number easily, but you cannot easily change how a fault propagates, so watching behaviours tends to last longer than watching parts.

Glossary part two: judging what you hear

Source rating

Two marks per item: a letter for the provider’s track record, and a digit for how believable this one claim looks. The Atlas attributes the scheme to the incident-response community. It resembles how a maintenance team grades a sensor: one with a good calibration history reads as trustworthy, but you still sanity-check a surprising value.

Estimative language

Controlled words for probability. The Atlas cites the NATO convention in which “likely” means about sixty to ninety percent. A separate confidence level, high, moderate or low, describes how solid the underlying evidence is. The rule is not to put both in one sentence.

Precision

Of everything a feed flagged, how much was truly relevant. In the Atlas sample quarter, 18 of 120 flags were useful, so 15 percent. Evidence-led readers will like what follows: the Atlas lets a feed block automatically only if three months of measurements show precision of 0.9 or higher, the source is rated highly and the item matches nothing on an allowlist. A robot cell halted by a false block costs real money, which is the best argument for measuring first.

Glossary part three: going to look

Hunt

A deliberate trawl of your own records for signs of activity that automatic alarms never raised. The Atlas favours a hypothesis, one or two behaviours, a fortnightly rhythm and a finished artefact each time. The artefact options are a request for a permanent alert, a gap ticket, an escalation or a would-have-seen record.

Dwell time

The span between an intruder’s arrival and its discovery. In its March 2026 edition, the annual incident-response study the Atlas draws on reports a worldwide median of 14 days, after 11 the year before, while cases tied to espionage or to a particular insider scheme took 122. A median describes the world, not your plant; your own records tell you your own number.

Gap ticket

A request to obtain data you wished you had. If a hunt cannot conclude because logs from a controller only go back a week, the ticket asks for longer retention. It is the unglamorous heart of the practice, and the Atlas says outright that a null hunt with complete data is a success while one with incomplete data should end in this ticket.

Glossary part four: sharing

Traffic-light protocol

Four labels telling recipients how widely a note may be passed along: red, amber, green and clear. Its second edition became authoritative in August 2022. Forwarding amber-marked information beyond its intended recipients is one of the classic errors the Atlas lists.

Handoff rule

When a hunt validates a finding, it becomes a request to the people who write production alert rules. The Atlas treats those rules, round-the-clock monitoring and incident handling as neighbouring disciplines, so the boundary is worth respecting in your service descriptions.

How the pieces map onto a fleet

Take sensors. Robot platforms integrate many of them, and the way those inputs are wired in determines what logs exist later, a topic covered in this walkthrough of sensor integration in industrial robots. For ThreatOps, the relevant question is blunt: if a controller behaved oddly three weeks ago, would the records still show it? The Atlas decision tree says that without ninety days of usable telemetry you fix the data first. Only after that does it ask whether someone owns findings, and whether stakeholders actually want intelligence.

Evidence-led operators will want to measure results, not activity. The Atlas proposes four ratios: coverage of requirements, what fraction of intelligence prompted a response, the share of hunts that produced an artefact, and the share of gaps closed. Its worked quarter lands at 83, 35, 42 and 44 percent. It also lists vanity measures to avoid, such as indicators ingested and reports published.

A short worked reading of one term

To see how a single term behaves in practice, take the gap ticket. Suppose an operations team decides to hunt for one behaviour: a maintenance account signing in to a fleet-management console outside its normal hours. They frame the hypothesis, identify where sign-in events live and begin the search. Halfway through they find that the console only keeps nine days of history, and the account’s usual rhythm cannot be established from so little. The honest result is not “nothing found”. It is a ticket requesting longer retention, plus a note stating exactly which nine days were checked. Three weeks later, with more history available, the team repeats the hunt and can finally say something stronger. That sequence, a limited first pass followed by a better-informed second pass, is normal.

Nothing in this example needed a new tool. It needed a hypothesis, a log source and a written outcome. Operators who already document maintenance procedures will find the habit familiar.

What the primer deliberately leaves out

This is not guidance on securing any particular robot, controller or vendor product, and it contains no claims about specific incidents in robotics. The Atlas speaks to the discipline in general. Take the glossary as vocabulary, then adapt it to your own cells, networks and maintenance routes with the people who know them.

Next steps

To see the terms in their original setting, along with the five-level maturity model and the staged first-quarter plan, read the ThreatOps reference in the Ops Atlas. Then pick one requirement for your fleet, write it down in the one-question format, and note which of your current data sources could answer it.