Threat actors and their motives
In short: A threat actor is the person or group behind an attack. Actors differ in motive, skill and resources, from opportunistic criminals after quick money to state-backed teams that stay hidden for months. Knowing who is likely to target you helps you choose sensible defences.
What a threat actor is
A threat actor is any person or group that could deliberately or accidentally harm your systems. Security teams describe actors by three things: their motive (why they attack), their capability (skill, tools and money) and their targeting (do they pick you specifically, or anyone with a weakness?).
The main groups
- Cyber criminals want money. They run ransomware, steal card data, commit invoice fraud and sell stolen logins. Many operate as businesses, with some groups writing malware and others renting it out, a model called ransomware as a service. Most attacks you will meet at work come from this group.
- Nation-state actors work for or with governments. Their aims include espionage, stealing intellectual property and preparing to disrupt infrastructure. Long-running, well-resourced campaigns are often called APTs (advanced persistent threats).
- Hacktivists attack to promote a political or social cause. Typical actions are website defacement, denial of service and leaking embarrassing documents.
- Insiders are employees, contractors or partners with legitimate access. Some act from a grudge or for payment, but many insider incidents are simple mistakes, such as emailing a spreadsheet to the wrong person.
- Script kiddies (unskilled attackers) use tools written by others, often for curiosity or status. Low skill does not mean low impact if your systems are unpatched.
- Competitors and organised groups may seek trade secrets or bid information, sometimes through hired help.
Comparing actors
| Actor | Main motive | Typical method | Key defence |
|---|---|---|---|
| Criminal | Money | Phishing, ransomware, stolen credentials | MFA, patching, offline backups |
| Nation state | Intelligence, disruption | Supply chain, zero-days, stealthy persistence | Monitoring, segmentation, threat hunting |
| Hacktivist | Publicity for a cause | DDoS, defacement, leaks | DDoS protection, web hardening |
| Insider | Grudge, money, error | Misuse of existing access | Least privilege, logging, leaver process |
| Script kiddie | Curiosity, status | Public tools against known flaws | Basic hygiene and patching |
Using this at work and in exams
Threat actor profiles feed directly into risk assessment and threat modelling. A small accounting firm mainly faces criminals and mistakes, so email security, MFA and backups give the best value. A defence contractor must also plan for nation-state actors and invest in detection and response.
- List who would gain from attacking you and what they would want.
- Rate each actor's likely capability.
- Map their usual methods to your weaknesses.
- Prioritise controls against the most likely and most damaging actors.
Tip: do not assume an attack is sophisticated because it succeeded. Most breaches use ordinary methods such as reused passwords and unpatched systems.
Real-world example: one week at a regional council
The security team at a fictional regional council reviews a week of alerts and sorts them by likely actor. Hundreds of password-spraying attempts come from automated criminal tools hunting any weak account. A defacement threat on social media comes from a hacktivist group angry about a planning decision. A carefully written email to the finance director, quoting a real supplier and asking to change bank details, points to an organised fraud gang. Thinking in actors helps the team choose responses: blocking and MFA for the spraying, monitoring and website hardening for the hacktivists, and a call-back rule for payment changes against the fraudsters.
Practice
A former employee logs in with an account that was never disabled and deletes files. Which actor type is this, and what control failed?
What does APT stand for and which actor is usually associated with it?
Why does the threat actor matter when choosing controls?
Key takeaways
- A threat actor is described by motive, capability and targeting.
- Criminals seeking money cause most incidents organisations face.
- Nation states run patient, well-funded campaigns known as APTs.
- Insider incidents include honest mistakes as well as malicious acts.
- Match your controls to the actors most likely to target you.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.