heres an experiment for you, setup a honeypot router that is open to the web, keep in mind that it is possible for threat actor to reconfigure the router, among other nastiness, but what you want to see is the activity log, so you can see what or who is going for your honey pot and hammering on a locked door to nowhere.

this will give a partial threat profile but will also show you just how sketchy the net is outside of a secure space.