Study Guide
Threat Actors
Compare attacker motivations, capabilities and opportunities without confusing deliberate misuse with mistakes.
Lesson 2.1 Threats, Vulnerabilities & Defence
Defenders cannot choose who attacks them. This lesson is about what they can choose, and how to think about attackers clearly without guessing wildly about who they are.
Stage: Think
What does a burglar need?
Picture a house on an ordinary street. One night, someone breaks in.
Think it through
What did the person who broke in need in order to do it? Try to name three quite different things.
- Hint 1: Why did they decide to break in at all?
- Hint 2: What did they bring with them, or know how to do?
- Hint 3: How did they actually get inside?
Show what happens
Most answers fit three groups: a reason (something worth taking), the ability (skill and tools), and a way in (an open window, a weak lock).
Think it through
Show the answer
Answer: B. The way in: they can shut and lock the window.
Only the way in. Take that away and this burglary does not happen, even though the burglar still wants to and still could.
Stage: Explain
The idea
A threat actor is whoever is behind a threat: the person, group or organisation whose actions could harm systems or information. Three questions describe any of them.
- What do they want, and why? This is their motivation. For the burglar: something valuable to sell.
- What are they able to do? This is their capability. The burglar can pick a simple lock and owns a crowbar.
- What way in is available? This is their opportunity. For the burglar: a ground-floor window left open.
Notice who controls each one. The householder cannot change what the burglar wants, and can do little about the burglar’s skill. The householder can shut the window. That is the central point of this lesson, and it carries over directly to computer systems.
Where the comparison stops. A burglar has to stand outside one house at a time. An online attacker can try the doors of thousands of organisations in an afternoon, from anywhere in the world, with a program doing the work. That is why “nobody would bother attacking us” is not a safe assumption: often nobody chose the victim at all.
Stage: Explain
Motivation, capability and opportunity
Here are the three ideas in the form used for computer systems.
- Motivation is the result the actor wants and the reason for wanting it: money, information, publicity or disruption.
- Capability is what they can bring to the attempt: knowledge, tools, time, money, and any access they already hold.
- Opportunity is what makes the attempt possible: a system that can be reached, a weakness in it, a password that still works, a moment when nobody is watching.
A supplementary model. An attack along a particular route needs all three; the defender's influence is uneven across them.
Motivation
Why would they act? Money, intelligence, publicity or disruption.
Defender’s lever: Usually outside the organisation’s control.
Capability
What can they do? Knowledge, tools, time and any access they already hold.
Defender’s lever: Limited: make stolen access worth less, for example with strong authentication.
Opportunity
Is there a way in? Exposure, weaknesses, permissions and timing.
Defender’s lever: The main lever: reduce exposure, fix weaknesses and restrict access.
An attack along this route
Remove any one of the three and this route fails, although the actor may look for another.
Stage: Experiment
Compare two fictional attempts
A fictional secondary school lets its staff work from home. They open a remote-access page on the internet, type their school username and password, and can then use the pupil records system as if they were in the building. The password is the only thing the page asks for.
Two different attackers find that page.
Attacker A: one person working through a list.
- Motivation: money. A wants access to sell, or records to hold to ransom.
- Capability: low. A has bought a list of email addresses and passwords leaked from other websites, and uses a free program that tries each pair against sign-in pages across the internet.
- Opportunity. The school’s page can be reached from anywhere. Mr Bell, a teacher, used his school email address and the same password on a shopping site that was later broken into, so his details are on A’s list.
- What happens. The program reaches the school’s page, tries Mr Bell’s details and gets in. A can now see whatever Mr Bell can see. A did not choose this school; the program found it.
Attacker B: an organised group that targets schools.
- Motivation: money, the same as A. The group locks an organisation’s files and demands payment to unlock them (ransomware, a form of extortion).
- Capability: high. Several people, plenty of time, practice with other schools, and the skill to write a convincing email or to hunt for technical weaknesses.
- Opportunity. The same remote-access page.
- What happens. B reads the school’s website for staff names, then emails the office a link to a fake copy of the sign-in page. One person types their password into it. B signs in on the real page with that password.
Both got in through the same door. Now change one fact: the school makes the remote-access page ask for a second proof, a code from the member of staff’s own phone, as well as the password. This is multi-factor authentication (MFA).
Think it through
- Hint 1: Which of the three things did the school change: motivation, capability or opportunity?
Show the answer
Answer: C. Both are stopped on this route; B may look for another.
Both are stopped at the same point, because the school removed the opportunity. Their motivation and capability are unchanged, which is why B may try another route.
- Attacker A tries Mr Bell’s password. The page asks for a code that A does not have. The program gives up and moves on to the next organisation. A’s motivation and capability are exactly what they were; the opportunity has gone.
- Attacker B is stopped at the same point, for the same reason. B has the capability to keep trying: phoning the member of staff to talk them into reading out the code, or looking for another service the school has left unprotected. The school has closed the easy route and now needs to notice the harder attempts.
Comparison table: scroll horizontally on narrow screens.
| Dimension | Attacker A: one person with a list | Attacker B: an organised group |
|---|---|---|
| Motivation | Money. | Money. |
| Capability | Low: a bought list and a free program. | High: people, time, practice and skill. |
| Opportunity | A page that accepts a password alone, and a reused password. | The same page, and a member of staff who can be deceived. |
| After MFA is added | Stopped. Moves on to an easier target. | Stopped on this route. May look for another. |
What the comparison shows:
- The same motivation can come with very different capability. Both wanted money.
- A capable attacker still uses the simple route when it is open. B did not need anything clever, because a password was enough.
- A low-capability attacker can do serious harm. Had Mr Bell’s account been able to see every pupil’s record, A’s simple attempt would have exposed all of them.
- The school changed the one thing it controlled. It could not make either attacker want money less or know less. It could remove the opportunity.
How much harm an attempt could do depends on what is being protected and what the account can reach, which is the subject of Risk and Least Privilege.
Stage: Predict
Categories are starting points
Think it through
Show the answer
Answer: A. No: it says what they want, not their skill.
A category says something about motivation. It says little about capability, and nothing certain about who was at the keyboard.
People who study attackers sort them into rough types. Four are enough for now.
Comparison table: scroll horizontally on narrow screens.
| Category | What they usually want | What to remember |
|---|---|---|
| Organised crime (cybercriminals) | Money: through theft, fraud, selling access, or extortion, which means demanding payment under a threat. | Skill varies a great deal. Many buy ready-made tools and stolen passwords, as Attacker A did. |
| Nation-state actors | Information or disruption that serves a government’s interests. They work for a state or with its backing. | Often well resourced and patient. They still use a simple route when one is open. |
| Hacktivists | Attention for a political or social cause, or to embarrass or disrupt an opponent. | Strongly motivated. Technical skill varies. |
| Malicious insiders | Personal gain or a grievance. They are inside the organisation and deliberately misuse access they were given. | They need no break-in. They can still only do what their own account permits. |
A category is a first guess, not a conclusion.
- It does not tell you capability. A damaging incident is not proof of a nation-state, and a criminal group is not necessarily unskilled.
- It does not tell you who is at the keyboard. If an outsider signs in with Mr Bell’s stolen password, the records show Mr Bell’s account. That does not make the attacker an employee, and it does not make Mr Bell a malicious insider. Working out who was really behind an attack is called attribution, and it needs evidence.
Check your understanding
Show the answer
Answer: B. The outsider using the password.
The outsider is the threat actor. The records point at Mr Bell’s account, which is why attribution needs more evidence than a log entry.
Threat Actor Types, Attributes and Motivations compares the main types of actor in more detail, including unskilled attackers, competitors and insiders, using the terms of the Security+ objectives.
Stage: Predict
People and mistakes
Think it through
Show the answer
Answer: C. No: being deceived is a mistake, not an attack.
The receptionist made a mistake under deception. That is a security risk, but it does not make them a threat actor; the person behind the fake page is.
Not everything that goes wrong inside an organisation is an attack. People make mistakes, and a mistake is a security risk without making the person a threat actor. Four words keep the cases apart.
Comparison table: scroll horizontally on narrow screens.
| Behaviour | Fictional illustration | What must not be assumed |
|---|---|---|
| Malicious | A member of staff deliberately copies pupil records to sell. | Having an account does not make this use allowed. Intent still needs evidence. |
| Accidental | A member of staff picks the wrong recipient for an email, or is taken in by a fake sign-in page. | A bad outcome does not prove carelessness or dishonesty. |
| Negligent | A member of staff ignores a clear rule they knew about, such as leaving an unlocked laptop in a car. | One mistake is not negligence. It depends on what the person knew and was responsible for. |
| Risky | A member of staff puts a class list in their personal online storage so they can finish a job at home. | More exposure is not intent to harm. Ask whether an official way to do the job existed. |
The words can overlap: risky describes the exposure created, while accidental, negligent and malicious describe the person’s care and intent.
Check your understanding
Show the answer
Answer: C. Negligent: they ignored a clear rule they knew.
Negligent: the teacher knew a clear rule and ignored it. That is different from an honest mistake, and different again from intending harm.
Respond to the event and investigate the context
Suppose the school’s attendance file is emailed to the wrong parent.
Think it through
What should happen first: finding out why it happened and who was at fault, or something else?
- Hint 1: The file is sitting in a stranger’s inbox right now. What could happen to it?
- Hint 2: Whose details are in the file?
Show what happens
Something else comes first: limiting the harm to the people in the file. Why it happened matters, but it can wait until the file is contained.
The order of work matters.
- Report it inside the school straight away.
- Stop it getting worse (this is called containment): ask the recipient to delete the file, and check whether it went to anyone else.
- Establish what happened: which file, whose details, sent to whom.
- Only then ask why. Was the recipient list confusing? Was the member of staff rushed? Was there a safer way to share the file that they were never shown?
Protecting the people in the file does not wait for a decision about blame. A school where staff feel able to report a mistake hears about it in minutes, not weeks. The fix is rarely training alone: it is training together with tools and rules that make the mistake harder to make. Where personal information is involved there are legal steps too, covered in Personal-Data Breaches and ICO Notification.
When an alert or log names an account, record what was observed rather than who you think was responsible: “the account for J. Smith downloaded 400 records at 02:10”, not “J. Smith stole records”. The account shows which access was used. Who used it, and why, is a question for investigation, because an external attacker may be using stolen credentials.
Stage: Experiment
A defensive question
Think it through
You cannot know which attacker will turn up. What questions could you still ask about the school’s records system to decide what to fix?
- Hint 1: Use the three ideas: who might want to, what could they do, what way in exists.
- Hint 2: Then ask what harm could follow, and what would change the answers.
Show what happens
The three ideas become five questions a defender can ask about any system. The example below answers them for the school.
The three ideas turn into five questions a defender can ask about any system. Here they are answered for the school’s remote-access page and records system.
- Who might want to misuse it, and why? Criminals after money, as with A and B. Possibly a pupil who wants to change a mark. Possibly a member of staff with a grievance.
- What can each of them do today? A stranger on the internet can reach the sign-in page and try passwords. Someone holding a teacher’s password can see that teacher’s classes. Someone holding an administrator’s password can see and change everything.
- What opportunity exists? A page that accepts a password alone; passwords that staff may have reused elsewhere; an administrator account used for everyday work.
- What harm could follow? Records read by outsiders (disclosure), marks or contact details changed (alteration), or the system locked so that staff cannot use it (denial). These are the three outcomes from CIA and DAD.
- Which controls change the answers? MFA removes the password-alone opportunity. Least privilege shrinks what one stolen account can reach. Watching for unusual sign-ins catches a persistent attacker. No one of these is enough alone, which is the subject of Defence in Depth.
The result is a short, ordered list of things to fix, reached without knowing which attacker will turn up, and without assuming that every attacker is brilliant or every colleague is hostile.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Did anyone choose the school as a target, or did a program find it?
Show the answer
Answer: B. Many attacks are automated and choose nobody.
Many attempts are automated and choose nobody: a program tries every page it can reach. An open opportunity is enough, whatever the organisation holds.
Apply it
Show the answer
Answer: C. The nurse’s account downloaded 2,000 records at 03:00.
Record what was observed. The account shows which access was used; an outsider with a stolen password is as possible as the nurse, and intent needs evidence.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Their capability differs despite a shared motivation.
Financial gain describes motivation. Time, knowledge and resources contribute to capability; neither alone determines impact without opportunity and business context.
Revision sources: Threat Actors (Supplementary Study Guide explanation)
Show answer
Answer: A staff member deliberately sells records they can access through their job.
Deliberate misuse by someone with insider access establishes malicious intent in this fictional example. Mistakes need investigation, and a stolen account does not identify the attacker as an employee.
Revision sources: Threat Actors (Supplementary Study Guide explanation)
Show answer
Answer: False
Impact alone does not establish attribution or capability. A simple technique exploiting broad permissions may cause serious harm; actor labels require evidence.
Revision sources: Threat Actors (Supplementary Study Guide explanation)
Study and revision
Practise selected concepts through the topic overview, quiz and flashcards. The questions and flashcards for this lesson are learning-only and are reached through the All topics track.
Stage: Consolidate
What to remember
- Describe an attacker by motivation, capability and opportunity. An attack along a route needs all three.
- Opportunity is the defender’s main lever: motivation and capability are mostly outside its control.
- A category is a first guess, about motivation more than skill, and attribution needs evidence.
- Mistakes are not attacks: accidental, negligent, risky and malicious behaviour are different.
- Contain first, then ask why; record what an account did, not who you think did it.
Key terms
- Threat actor
A person or group that may cause harm to systems or information. Threat actors are often assessed by their motivation, capability and opportunity.
- Threat
A potential cause of harm, such as an attacker seeking unauthorised access.
- Malicious insider
A person with legitimate access who deliberately misuses it, for example for personal gain or because of a grievance.
Common misunderstandings
Categories such as organised crime or hacktivist are starting points. Resources and skill vary within each, and a damaging incident does not by itself prove a nation-state was involved.
An account shows which access was used. An external attacker may have stolen it, or the account holder may have made a mistake.
Accidental, negligent, risky and malicious behaviour are different. Intent needs evidence, and a reporting culture helps mistakes surface early.
A simple route, such as a stolen password on a page that asks for nothing else, may be all that is needed. Basic controls still matter against capable actors.
Further reading
The NCSC’s 10 Steps to Cyber Security sets out how an organisation manages cyber risk as a whole.
Lesson sources and acknowledgements
Sources and scope
The approved Session 1 Learning Log records discussion of attacker profiles, motivations, capabilities, opportunities and risky behaviour. The categories and fictional comparisons here develop the supplied educational reference, which is not a verbatim transcript. The approved Session 1 log establishes tutor-led scope; the supplied reference provides the supplementary comparisons above.
The school, its remote-access page, Mr Bell, the two attackers and the misdirected attendance file are invented for teaching. They are not observations of real actors, and they are not incidents, investigations or practical work I completed. The burglar comparison, the step-by-step treatment of the two attempts, the effect of adding MFA, the five answered questions, the motivation, capability and opportunity diagram and the misunderstandings are supplementary explanations. “Organised crime” is the term the CompTIA Security+ objectives use for the first category; this lesson gives “cybercriminals” beside it because both are in common use.
Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the burglary opening questions, every question asked in the lesson with its feedback and hints, the council website, fake sign-in page, charity and overnight-download examples and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
An unauthorised or improper change to information or systems. Alteration threatens integrity.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
Information becoming accessible to an unauthorised party. Disclosure threatens confidentiality, even if the original information is unchanged.
How far a system, service or piece of information can be seen or reached by others, especially from the internet.
A threat actor who attacks to advance a political or social cause, to attract attention or to disrupt a perceived opponent.
A person with legitimate access who deliberately misuses it, for example for personal gain or because of a grievance.
Authentication that requires two or more different types of factor, such as something you know and something you have.
A threat actor that is part of a government or sponsored by one, typically pursuing espionage, strategic advantage, disruption or influence.
Malicious software that denies access to systems or data, typically by encrypting them, in order to extort payment. Some incidents also involve data theft.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
A potential cause of harm, such as an attacker seeking unauthorised access.
A person or group that may cause harm to systems or information. Threat actors are often assessed by their motivation, capability and opportunity.
A threat actor with limited technical capability and resources, who relies on ready-made tools and scripts and looks for easy opportunities.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.