Question 1

What are the main threat actor archetypes?

Accepted Answer

Common categories are nation-state APTs (well-resourced, patient, espionage-driven), financially-motivated cybercriminals and ransomware crews (profit-seeking, fast, extortion-based), hacktivists (ideological, seeking visibility through defacement and leaks), and insider threats (trusted people abusing legitimate access). These are archetypes of behaviour and motive, not accusations against specific named people.

Question 2

Why does knowing the actor archetype help defenders?

Accepted Answer

The likely actor shapes your defenses. An APT expects long dwell times, so you invest in detection and threat hunting; ransomware demands tested offline backups and fast containment; insider threats need least-privilege access and monitoring of legitimate accounts. Motive and typical tactics guide where you spend limited security effort.

Question 3

How do analysts infer an actor from an incident?

Accepted Answer

They look at tactics, techniques, and procedures (TTPs), the target, the objective (data theft vs disruption vs money), the level of sophistication, and dwell time. Patient stealthy espionage points to an APT; loud extortion points to a criminal crew. This is probabilistic reasoning about behaviour, not definitive attribution to any individual.

Threat Actor Match

How to play

Frequently Asked Questions