Threat Actors

A threat actor is any person or group who presents a security risk. This broad definition refers to people inside and outside an organization. It also includes individuals who intentionally pose a threat, and those that accidentally put assets at risk. That’s a wide range of people!

Threat actors are normally divided into five categories based on their motivations:

• Competitors refers to rival companies who pose a threat because they might benefit from leaked information.
• State actors are government intelligence agencies.
• Criminal syndicates refer to organised groups of people who make money from criminal activity.
• Insider threats can be any individual who has or had authorised access to an organisation’s resources. This includes employees who accidentally compromise assets or individuals who purposefully put them at risk for their own benefit.
• Shadow IT refers to individuals who use technologies that lack IT governance. A common example is when an employee uses their personal email to send work-related communications.

Because the formal definition of a hacker is broad, the term can be a bit ambiguous. In security, it applies to three types of individuals based on their intent:

1. Unauthorized hackers
2. Authorized, or ethical, hackers
3. Semi-authorised hackers

Many malicious hackers find their way into a system, cause trouble, and then leave. But on some occasions, threat actors stick around. These kinds of events are known as advanced persistent threats, or APTs. An advanced persistent threat (APT) refers to instances when a threat actor maintains unauthorised access to a system for an extended period of time. The term is mostly associated with nation states and state-sponsored actors. Typically, an APT is concerned with surveilling a target to gather information. They then use the intel to manipulate government, defence, financial, and telecom services.