Threat Actor

A Threat Actor is a person, group or organization that deliberately carries out or prepares digital attacks. These include cybercriminals, state-sponsored actors, hacktivists, insiders or opportunistic attackers. The term is important in security practice because defense becomes more effective when motives, capabilities and typical methods are known. Not every threat actor pursues the same goals; some want money, others data, espionage results or disruption. Professionalism and persistence also differ considerably.

For security teams, it is therefore helpful to view threats not only technically but also from an adversary-oriented perspective. In this way, protective measures, priorities and communication can be better aligned with real risks – from the choice of detection rules to the design of exercises and reporting.

See also: Threat Intelligence, Adversary Intelligence and Cyber Threat Landscape.