Defining threats across organizational boundaries