1.3 Threat Actors

Types of threat actors

A threat actor is any person or group who intentionally causes harm to digital systems. Categories include script kiddies (low skill, use pre-made tools), hacktivists (motivated by political/social causes), organized crime (financially motivated groups), nation-state actors (government-sponsored, highly resourced), insider threats (employees/contractors with legitimate access), and competitors (seeking business advantage).

Motivations and resources

Threat actors differ in motivation — money, ideology, revenge, curiosity, or espionage — and resources/sophistication. Nation-state actors have the most funding, time, and skill, enabling advanced persistent threats (APTs). Script kiddies have low skill but can still cause damage using widely available tools and exploits found online.

Internal vs. external actors

Internal threat actors already have authorized access (employees, contractors), making detection harder since their actions may look normal. External threat actors have no legitimate access and must breach defenses from outside. Understanding an actor's origin, motive, and skill helps organizations prioritize defenses and predict likely attack methods.

Key terms

Threat actor

Any person or group who intentionally causes harm to digital systems or data.

Script kiddie

Low-skill attacker who uses pre-made tools/scripts created by others.

Nation-state actor

Government-sponsored group with high skill and resources, often conducting APTs and espionage.

Hacktivist

Attacker motivated by political or social causes rather than money.

Insider threat

A current or former employee/contractor who misuses legitimate access to cause harm.

Try an AP-style question

What kind of threat actor is this?

1. Insider
2. Hacktivist
3. Script kiddie
4. Nation-state