What are examples of external security threats?

Malware (viruses, worms, Trojans), spyware/adware, zero-day attacks, threat-actor attacks, DoS, and data/identity theft.

External threats come from attackers outside the organization who have no authorized access and must break in over the network — contrast this with internal threats, which come from people who are already inside. Most external threats fall into a few families: malicious code, theft of data, and disruption of service. Recognizing the family tells you the defense — malware is countered with antivirus and patching, interception with encryption, and DoS with filtering and capacity.

• Viruses, worms, and Trojan horses (malicious code that infects or disguises itself)
• Spyware and adware (covertly collect information or push unwanted content)
• Zero-day attacks (exploit a vulnerability before any patch exists)
• Threat actor attacks (a deliberate human adversary targeting the network)
• Denial of Service (DoS) attacks (overwhelm a service so legitimate users can't reach it)
• Data interception and theft (capturing data in transit)
• Identity theft (stealing credentials to impersonate a user)

Go deeper:

• Malware (Wikipedia) — covers virus, worm, Trojan, spyware, and adware in one place.
• Zero-day vulnerability (Wikipedia) — the zero-day threat: flaws exploited before a patch exists.
• Denial-of-service attack (Wikipedia) — DoS/DDoS as an external threat that makes resources unavailable by flooding.