- How to distinguish common threat actor types, including nation-state actors, organized crime, hacktivists, insiders, unskilled attackers, and competitors.
- How internal or external access, resources and funding, and sophistication or capability help compare threat actors.
- How motivations such as financial gain, espionage, data exfiltration, disruption, blackmail, revenge, ideology, and warfare differ.
- How to identify the most likely actor and motivation from a Security+ scenario.
- Why threat actor categories and motivations can overlap rather than follow rigid rules.
- How to avoid common exam traps involving script kiddies, insider threats, hacktivists, and advanced persistent threats.
Compare and contrast common threat actors and motivations.
This lesson focuses on actor attributes, actor types, and motivations. Threat vectors, attack surfaces, vulnerability types, indicators of malicious activity, and mitigation techniques are covered in their corresponding Domain 2 lessons.
What Is a Threat Actor?
A threat actor is an individual or group that can pose a threat to an organization, its information, its systems, or its operations. Threat actors differ in the resources they can access, the skills they possess, the access they have to a target, and the outcomes they want to achieve.
Some actors work independently with publicly available tools. Others belong to criminal organizations or operate with substantial government resources. An employee with legitimate system access can also become an insider threat if that access is abused or used carelessly.
For Security+ questions, do not identify an actor from a single keyword alone. Compare three things: who the actor is, what the actor can do, and why the actor is acting.
Actor type identifies the kind of adversary.
Attributes describe access, resources, and capability.
Motivation describes the goal or reason behind the activity.
One actor type may have several motivations, and different actor types may pursue the same goal.
The Three Attributes Used to Compare Threat Actors
Security+ scenarios commonly compare a threat actor by access, funding, and sophistication. These attributes help explain how an actor may approach a target, but they are not fixed ratings for every person in a category.
Internal or External
Internal: the actor has a relationship with the organization or authorized access to its people, facilities, systems, or data.
External: the actor operates outside the organization and attempts to reach or influence the target.
Exam clue: an insider may already have valid credentials, which can reduce the need to break through an external perimeter.
Resources and Funding
Resources may include money, time, infrastructure, specialist personnel, intelligence, tools, and access to other people or organizations.
A well-funded actor may sustain a long campaign or obtain custom capabilities. A low-resource attacker may rely on automated or publicly available tools.
Exam clue: extensive funding can support persistence and scale, but it does not prove the actor’s identity.
Sophistication and Capability
Sophistication describes the actor’s technical skill, methods, operational discipline, and ability to adapt.
A less-skilled attacker may reuse an existing exploit. A sophisticated actor may tailor techniques to a specific target and try to avoid detection.
Exam clue: capability refers to what the actor can do, not necessarily the actor’s reason for doing it.
How the Attributes Fit Together
| Scenario clue | Attribute indicated | What it suggests |
|---|---|---|
| An employee uses their legitimate account to access restricted records. | Internal access | Investigate permissions, intent, and whether the access was authorized for the activity. |
| A group can fund specialist staff and a sustained operation. | Resources and funding | The group may have the capacity to maintain longer or more complex activity. |
| An attacker uses a downloaded tool with little understanding of how it works. | Low sophistication | The actor may depend on existing scripts or tools rather than creating new capabilities. |
| A targeted operation changes its techniques to avoid detection over time. | Potentially high capability and persistence | Investigators should consider the campaign’s evidence rather than assume one actor category solely from this clue. |
Internal or external access, resources, and technical sophistication are separate attributes. A person can be an insider with low technical skill but still cause major harm through valid access. A highly skilled external actor may have limited funding. Treat the scenario as a combination of attributes.
Common Threat Actor Types
The following comparison covers the primary threat actor types you should be able to recognize for Security+ objective 2.1.
Nation-State Actors
Actors working for, supported by, or aligned with a national government. Their operations may support strategic, intelligence, political, military, or economic objectives.
- Common motivations: espionage, strategic advantage, warfare, and disruption.
- Typical resources: potentially substantial funding, specialist personnel, and intelligence support.
- Possible targets: government networks, critical infrastructure, defense organizations, research, or valuable intellectual property.
Organized Crime
Criminal groups that coordinate people, infrastructure, and techniques to generate money through unlawful activity.
- Common motivations: financial gain, blackmail, extortion, and theft of data or credentials.
- Typical resources: variable; established groups may purchase tools, services, and stolen access.
- Possible targets: businesses, consumers, payment systems, and organizations holding monetizable data.
Hacktivists
Actors whose actions are intended to promote a political, social, religious, or other philosophical cause.
- Common motivations: ideology, public attention, protest, exposure, and service disruption.
- Typical resources: highly variable; some act individually, while others coordinate larger campaigns.
- Possible targets: organizations or institutions associated with the cause they oppose.
Insider Threats
People with authorized access who may cause harm through malicious actions, careless behavior, or compromised accounts. Examples include employees, contractors, and trusted partners.
- Common motivations: revenge, financial gain, espionage, grievance, or convenience; harm can also be unintentional.
- Typical resources: legitimate access, familiarity with internal procedures, and knowledge of business operations.
- Possible actions: unauthorized copying, disclosure, modification, deletion, or careless exposure of data.
Unskilled Attackers
Often called script kiddies, these actors may rely on existing scripts, exploit tools, tutorials, or automated scanners rather than developing their own techniques.
- Common motivations: curiosity, bragging rights, excitement, disruption, or perceived status.
- Typical resources: often limited, though publicly available tools can still be powerful.
- Possible actions: scanning exposed systems, running available exploits, or attempting common passwords.
Competitors
A competing organization or someone acting on its behalf may seek confidential business information to gain an advantage. Legitimate competition is not the same thing as unauthorized acquisition of information.
- Common motivations: competitive advantage, commercial espionage, or access to intellectual property.
- Typical resources: variable, depending on the organization or intermediary involved.
- Possible targets: product roadmaps, research, pricing data, customer lists, or proprietary designs.
Where Do Advanced Persistent Threats Fit?
An advanced persistent threat (APT) describes a capable and persistent threat or campaign that may maintain targeted activity over an extended period. APT activity is often associated with state-sponsored operations, but the term should not be treated as a synonym for every nation-state actor or as a motivation by itself.
Nation-state identifies an actor category.
APT describes characteristics of a persistent, capable threat or campaign.
Espionage describes a motivation or activity involving covert information gathering.
One scenario can describe all three, but each term answers a different question.
Threat actor types can overlap in real-world operations. A nation-state might use a contractor or criminal proxy. An insider may steal information for money, revenge, or espionage. A hacktivist may also want publicity. Use the specific facts in the question to choose the best answer.
Common Threat Actor Motivations
Motivation explains the outcome an actor wants. It does not, by itself, prove which person or group performed an attack.
| Motivation | Meaning | Example scenario |
|---|---|---|
| Financial gain | Obtain money, sell stolen information, commit fraud, or monetize access. | A criminal group steals payment data to sell or misuse it. |
| Espionage | Secretly gather information for intelligence, strategic, political, or commercial advantage. | An actor quietly collects government plans or proprietary research. |
| Data exfiltration | Transfer or remove data from an environment without authorization. This describes an action or outcome and may support several motivations. | Confidential files are copied out of a company network. |
| Service disruption | Degrade, interrupt, or prevent access to systems or services. | Attack traffic overwhelms a public-facing service. |
| Blackmail or extortion | Use a threat—such as exposing stolen data or withholding access—to demand something of value. | An attacker demands payment and threatens to publish sensitive records. |
| Political or philosophical beliefs | Promote a cause, challenge an organization, or draw attention to a belief. | A hacktivist group defaces a website to publicize a political position. |
| Revenge | Retaliate against a person or organization because of a perceived grievance. | A disgruntled insider deletes records after being disciplined. |
| Disruption or chaos | Cause disorder or damage without a clear financial payoff. | An attacker disrupts systems to create confusion or demonstrate capability. |
| Warfare or strategic advantage | Support military, national, or geopolitical objectives. | A state-aligned operation targets systems important to an adversary. |
Data exfiltration is the unauthorized movement or removal of data. Espionage is covert information gathering for intelligence or advantage. Exfiltration may be part of espionage, but stealing data for ransomware or resale is not automatically espionage.
Threat Actor and Motivation Comparison
| Actor type | Common motivation | Possible behavior | Important caveat |
|---|---|---|---|
| Nation-state | Espionage, strategic advantage, warfare | Long-term intelligence collection or targeted disruption | Capabilities and priorities vary by operation. |
| Organized crime | Financial gain, extortion | Ransomware, fraud, credential theft, resale of access | Not every criminal group uses the same methods. |
| Hacktivist | Political or philosophical beliefs | Defacement, public leaks, service disruption | Technical sophistication and funding can vary widely. |
| Insider threat | Revenge, financial gain, espionage, or accidental harm | Misuse or careless handling of authorized access | Insider incidents can be intentional or unintentional. |
| Unskilled attacker | Curiosity, recognition, excitement, disruption | Reuse of existing tools or scripts | Low skill does not guarantee low impact. |
| Competitor | Commercial or strategic advantage | Seeking confidential research or proprietary information | Competition is legitimate; unauthorized acquisition is not. |
How to Analyze a Threat Actor Scenario
Use the following process when a question asks you to identify an actor or motivation.
Look for money, intelligence, publicity, disruption, revenge, or strategic advantage.
Does the actor already have authorized access, or is the activity coming from outside?
Look for evidence of sustained funding, specialist tools, existing scripts, persistence, or technical adaptation.
Prefer the actor type or motivation that fits the details. Do not infer funding, sponsorship, or ideology without evidence.
Worked Examples
A group encrypts a company’s files and demands payment in exchange for restoration.
Best interpretation: organized cybercrime is plausible, and the explicit motivation is financial gain or extortion.
A well-resourced group spends months gathering sensitive defense research while attempting to remain undetected.
Best interpretation: the behavior is consistent with espionage. State sponsorship may be plausible if the scenario supports it, but the evidence should determine the answer.
A group disrupts an organization’s public website and announces that the action is intended to protest a policy.
Best interpretation: hacktivism and political or philosophical motivation.
A staff member accidentally shares a confidential file using an unapproved public link.
Best interpretation: an unintentional insider-related risk. Malicious intent should not be assumed without supporting evidence.
Common Security+ Exam Traps
- Low skill does not mean harmless. Publicly available tools can still cause disruption or expose vulnerable systems.
- Insider does not automatically mean malicious. An insider may act intentionally, carelessly, or through a compromised account.
- Hacktivism is linked to ideology. A political or philosophical cause is a stronger clue than a demand for money alone.
- Financial gain and espionage are different motivations. Both may involve stolen information, but their intended outcomes differ.
- APT is not a motivation. It describes characteristics of a persistent, capable threat or campaign.
- Actor categories may overlap. Use the most specific answer supported by the scenario.
Quick Reference
| If the scenario emphasizes… | Think about… |
|---|---|
| Government-backed resources and geopolitical objectives | Nation-state actor; possible espionage or warfare motivation |
| Ransom payment, fraud, or selling stolen credentials | Organized crime; financial gain or extortion |
| Protest, a cause, or ideological publicity | Hacktivist; political or philosophical beliefs |
| Misuse of existing employee or contractor access | Insider threat; check intent and authorization |
| Reusing a public exploit or script with little understanding | Unskilled attacker or script kiddie |
| Seeking confidential business research or product plans | Competitor or commercial espionage, depending on evidence |
| Covert long-term collection of sensitive information | Espionage as a motivation or activity |
| Threatening disclosure unless a demand is met | Blackmail or extortion |
Read the scenario for the actor’s relationship to the target, resource level, sophistication, and objective. The best answer is the one supported by the complete scenario—not merely the most dramatic label.
Practice Questions
10 scenario-based review questions. Expand each question to see the answer and explanation.
Exam Quiz
Lesson 02.1 — Threat Actors and Motivations · 15 questions · 10 minutes
Threat Actors — Exam Simulation
Practice identifying actor types, attributes, and motivations using original scenario-based questions aligned to Security+ SY0-701 objective 2.1.
15 Questions
Lesson 02.1 scope only
10 Minutes
Timed attempt
Instant Feedback
Explanation after each answer
Answer Review
Score and explanations
Lesson 02.1 — Summary
Threat Actors and Motivations: Types, Attributes, and Attack Goals
Domain 2.0 — Threats, Vulnerabilities and Mitigations · 22% of Security+ SY0-701
📌 Key Takeaways from Lesson 02.1
Compare internal or external access, funding, and sophistication separately.
Espionage, warfare, geopolitical advantage, and possible disruption.
Fraud, extortion, ransomware, and monetizing stolen data or access.
Campaigns may seek publicity, protest, exposure, or disruption.
Intentional, negligent, or compromised activity may create insider risk.
A script kiddie may have limited technical skill but can still cause harm.
⚡ Exam Tips — Lesson 02.1
- Map financial gain or extortion to a likely criminal motivation.
- Map political or philosophical cause to hacktivism when the scenario supports it.
- Look for authorized access when identifying an insider threat.
- Distinguish data exfiltration, the movement of data, from espionage, covert information gathering for advantage.
- Do not assume every highly capable actor is a nation-state; use the actual evidence.
⚠️ Common Pitfalls — Lesson 02.1
📋 Complete Security+ SY0-701 Guide Series — 5 Domains · 57 Numbered Lessons
Further Reading and Related Guides
Continue learning on NetworkUstad:
- Security+ Domain 2.0 Guide Hub — browse the Domain 2 lesson sequence.
- Security+ SY0-701 Guide Hub — access the complete certification guide series.
External references:
- NIST CSRC: Threat Actor — terminology for threat actors.
- NIST CSRC: Insider Threat — terminology and examples of insider risk.
