Domain 2 · ThreatsThreats, Vulnerabilities, and Mitigations2 min read
Threat actors and motivations
Exam objective 2.1: Compare and contrast common threat actors and motivations.
On this page
Defenders plan better when they know who they face. Threat actors differ in where they sit (inside or outside), how much money and skill they have, and what they want. The exam pairs an actor with a motivation and expects you to recognize both from a short scenario.
The main actors
| Actor | Resources and skill | Typical motivation |
|---|---|---|
| Nation-state | Very high; long-term, patient operations | Espionage, disruption, war, political influence |
| Organized crime | High; run like a business | Financial gain through ransomware, fraud, data theft |
| Hacktivist | Varies; often moderate | Philosophical or political beliefs, publicity |
| Insider threat | Has legitimate access already | Revenge, financial gain, or carelessness |
| Unskilled attacker | Low; uses others' tools and scripts | Thrill, notoriety, curiosity |
| Shadow IT | Internal staff acting without approval | Convenience; not malicious, but creates risk |
Two attributes drive most questions. Internal versus external: an insider already has credentials and knowledge of controls, which makes detection harder. Sophistication and resources: a nation-state can afford zero-days and months of reconnaissance, which is the pattern called an advanced persistent threat (APT).
Motivations
- Data exfiltration and espionage: stealing secrets for a government or competitor.
- Service disruption: knocking systems offline, sometimes as cover for another attack.
- Blackmail and financial gain: ransomware and extortion of stolen data.
- Philosophical or political beliefs: hacktivists defacing sites or leaking documents.
- Ethical: researchers who find and report flaws.
- Revenge: a disgruntled employee sabotaging systems after a dispute.
- Chaos and war: destructive attacks with no financial goal.
Key terms
- Nation-state actor
- A government-backed attacker with extensive resources that pursues espionage or disruption over long periods.
- Advanced persistent threat (APT)
- A long-term, stealthy intrusion by a skilled, well-resourced group that keeps access to reach a goal.
- Organized crime
- A structured criminal group that attacks for money, often through ransomware, fraud, or selling stolen data.
- Hacktivist
- An attacker motivated by political, social, or philosophical beliefs who seeks publicity for a cause.
- Insider threat
- A person with legitimate access, such as an employee or contractor, who misuses it maliciously or carelessly.
- Unskilled attacker
- An attacker with little expertise who uses tools and scripts written by others.
- Shadow IT
- Technology that staff deploy or use without the IT or security team's approval or knowledge.
- Data exfiltration motive
- The goal of stealing data and moving it out of the organization.
- Service disruption motive
- The goal of making systems or services unavailable to their users.
- Revenge motive
- The goal of harming an organization because of a personal grievance.
- Ethical motive
- Finding and disclosing vulnerabilities to improve security rather than to cause harm.
- Blackmail motive
- Threatening to release information or cause harm unless a demand is met.
- Internal vs. external actor
- Whether the attacker starts with legitimate access inside the organization or must break in from outside.
Check yourself
26 practice questions on this objective
Practice this objectiveFlashcards for this objective