Types of Threat Actors

A threat actor is anyone who puts your security at risk. To understand them, look at their motivation, skill, resources, and how sophisticated they are. 🎯

Script kiddies are low-skill attackers using ready-made tools they barely understand. They chase easy, unpatched targets — but those tools can still do real damage.

An insider threat comes from someone who already has access — staff, contractors, or ex-employees. They're hard to catch because their access looks completely normal.

Hacktivists hack to make a political or social point. They deface sites, launch DDoS attacks, and leak data to embarrass targets they disagree with.

Cybercriminals are after money. They run ransomware, sell stolen data, and trick companies into wiring funds — operating like a real, multi-billion-dollar industry.

Nation-state actors (APTs) are government-backed and the most skilled and patient of all. They lurk in a network for months chasing espionage or sabotage.

Compare actors on four traits: intent, motivation, capability, and resources. A skilled, well-funded, malicious actor is your top tier of threat.

Motivation predicts targets: money drives cybercriminals, espionage drives nation-states, ideology drives hacktivists, and revenge drives disgruntled insiders.

Shadow IT is tech used without IT's approval — like saving work files to a personal Dropbox. It quietly leaks data and creates blind spots no one is watching.

Competitor espionage targets trade secrets and R&D in high-value fields like pharma and defense. It sits between cybercrime and nation-states in sophistication.

Threat modeling matches likely actors to your business. A small shop fears ransomware, not nation-states — so it helps you spend your security budget wisely.

Quick recap: actors range from script kiddies to nation-state APTs, and weighing intent, motivation, capability, and resources sets your priorities. Next: attack vectors and surfaces.