One more thing about threat --- it's all ships that you've already seen in a wave or when you invaded an AI world. Normally, AI ships you havent fought are waiting at guard posts (or patrolling as special forces/doing a few other jobs), but when you invade they get freed to fight you. Unless its a very small skermish, they usually remain free and are then allowed to go wandering around the galaxy, and will attack your planets if the AI sees an opportunity. Unlike waves, threat ships don't need a warp gate to attack you, so they can come from directions that are normally safe. Threat is just a count of these ships.
When you attack a world and you're winning, AI ships will try to run away (becoming threat ships), and ships from waves also start off in threat mode, and will try to run away if they're outnumbered after a certain amount of time (I think 30 seconds).
Finally, ships you haven't met can become threat at one time: when the AI declares a cross-planet attack. What happens in a CPA is simply that a large number of ships get freed all at once, almost always enough that they will start attacking you right away.