Simple explanation
Not every attacker is the same, and knowing WHO you're likely defending against changes what you defend. This lesson covers the categories of threat actor and why they'd target you.
Technical explanation
Actor types:
- Nation-state — government-sponsored, highly resourced, patient, sophisticated (APTs — Advanced Persistent Threats).
- Unskilled attacker — low sophistication, often uses pre-built tools ("script kiddie" in older material).
- Hacktivist — motivated by political/social causes, not money.
- Insider threat — a current or former employee/contractor with legitimate access, misused.
- Organized crime — financially motivated, resourced like a business, often runs ransomware operations.
- Shadow IT — not malicious by intent, but employees standing up unsanctioned systems/tools creates unmanaged risk.
Attributes to compare actors by: internal vs. external, level of resources/funding, level of sophistication/capability.
Motivations: data exfiltration, espionage, service disruption, blackmail, financial gain, philosophical/political beliefs, ethical (e.g., a researcher disclosing a flaw), revenge, disruption/chaos for its own sake, and war (nation-state conflict extending into cyberspace).
Synonyms / related terms
| Term | Means | |---|---| | APT | Advanced Persistent Threat — typically nation-state | | Script kiddie | Older term for unskilled attacker | | Malicious insider | Insider threat with intentional harmful motive (vs. a careless one) |
Concept Check
"A disgruntled former employee whose access wasn't revoked logs in and deletes files out of spite. What's the primary motivation?" Not financial gain (nothing was sold or extorted), not espionage (nothing was stolen for intelligence value) — this is revenge, and the actor type is insider threat (former, but access was still valid).
Interview-style Q&A
Q: Why does an organization need to worry about unskilled attackers if they're the least sophisticated? A: "Volume and automation. Unskilled attackers run widely available scanning tools against huge swaths of the internet — they don't need sophistication if a system is left with a default password or an unpatched, publicly known vulnerability. Low skill doesn't mean low risk if basic hygiene is missing."
Memory trick
"NUHIOS" — Nation-state, Unskilled, Hacktivist, Insider, Organized crime, Shadow IT: the six actor types, sorted roughly from most to least resourced.