Compare and contrast common threat actors and motivations
Nation-state, unskilled attacker, hacktivist, insider threat, organized crime, shadow IT — and what each actually wants.
- Reading time
- 16 min read
- Flashcards
- 15 cards
- Practice questions
- 8 questions · 2 PBQs
A short objective built almost entirely on one skill: reading a scenario and identifying who did it from the evidence. The exam gives you clues about resources, sophistication and goal, and expects you to name the actor.
The attributes that identify an actor
Before the actors themselves, learn the three axes CompTIA uses — every question keys on at least one:
- Internal or external — do they already have legitimate access?
- Resources and funding — a lone attacker or a state budget?
- Level of sophistication and capability — using someone else's tool, or writing zero-days?
The actors
Nation-state
- Highest resources and sophistication
- Zero-days, custom malware, years of patience
- Motivation: espionage, war, disruption
- Also called APT — Advanced Persistent Threat
Organized crime
- Well funded, professional, structured
- Ransomware, fraud, data theft for resale
- Motivation: financial gain, almost always
The tellBoth are sophisticated and well resourced. The separator is the goal: money means organised crime, information or sabotage means nation-state.
Unskilled attacker
Formerly "script kiddie". Uses tools written by others without deep understanding. Low resources, low sophistication. Motivation is often chaos, reputation, or simply curiosity. Note that low skill does not mean low damage — the tools are genuinely powerful.
Hacktivist
Motivated by philosophical or political belief. Typically defacement, denial of service, or leaking documents to embarrass a target. Resources vary; the motive is the identifier.
Insider threat
Someone with legitimate access — employee, contractor, partner. The defining advantage is that they are already inside and already trusted, so no perimeter control applies. Motivation ranges from revenge and financial gain to simple negligence.
Shadow IT
Systems and services deployed inside the organisation without approval or oversight. Not malicious, which makes it the odd one out on this list — the risk is that nobody is securing what nobody knows about.
Check yourself
An attacker with substantial resources maintains covert access to a defence contractor for two years, quietly copying design documents. Which actor is most likely?
Motivations
The exam lists these explicitly, and matching motive to actor is most of the work:
| Motivation | Typical actor |
|---|---|
| Financial gain | Organized crime |
| Espionage | Nation-state |
| War / service disruption | Nation-state |
| Philosophical or political beliefs | Hacktivist |
| Revenge | Insider threat |
| Blackmail | Organized crime |
| Chaos / disruption | Unskilled attacker, hacktivist |
| Ethical | Authorised researcher, bug bounty hunter |
| Data exfiltration | Nation-state or organized crime, depending on what is taken |
Ethical is worth noting because it sounds out of place: it covers authorised testers and bug bounty researchers, who use the same techniques with permission.
Reading the evidence
Two distinctions the exam leans on:
Sophistication tells you resources, not intent. A zero-day implies a well-resourced actor, but whether that is a state or organised crime depends on what they did next.
Insider threat is about access, not employment. A contractor, a partner with VPN access, or a former employee whose account was never disabled all qualify. The defining feature is legitimate access that perimeter controls do not stop.
Check yourself
A departing employee copies the customer database to a personal drive on their last day, intending to take it to a competitor. Which actor and motivation?