Threat Actors & Motivations

You cannot defend against, or test for, an attacker you have not pictured. Every meaningful security decision — what to patch first, where to spend the budget, how realistic a penetration test should be — depends on an honest answer to one question: who is actually likely to come after this organization, and what are they capable of?

This is the idea behind threat modeling and the modern doctrine of assume breach: you stop asking "could someone get in?" and start asking "when someone with these capabilities and this motivation gets in, what happens next?" A test scoped to a bored teenager looks nothing like a test scoped to a well-funded intelligence service. Choosing the wrong adversary to simulate produces a report that feels reassuring and protects you from no one.

Threat actors are usually ranked by capability — the combination of skill, resources, time, and tooling they can bring to bear. At the bottom of the ladder, script kiddies run prebuilt tools they did not write and barely understand; most organizations treat them as nuisance-level noise. As you climb — professional criminals, organized crime, and finally nation-state advanced persistent threats (APTs) — resources and patience rise sharply, and so does the likelihood that an attack succeeds and goes unnoticed.

Two older labels cut across this table. A black hat acts without authorization and usually for personal gain; a white hat — the penetration tester — does the same technical work, but only with written permission and in the organization's interest. A grey hat sits in between, often acting without permission but without clear malice. The capability ladder, not the hat color, is what determines how dangerous an adversary is.

Capability tells you what an adversary can do; motivation tells you what they will actually try. Two attackers with identical skills behave completely differently depending on why they showed up:

• Financial gain — the dominant motive online. Ransomware operators, fraudsters, and access brokers want the fastest path to money and will move on the moment a target stops being profitable.
• Ideology and politics — hacktivists want a public outcome: a defacement, a leak, an outage timed to a news cycle. The attack is the message.
• Espionage — nation-state actors want information or position and will stay quiet for as long as it takes. Getting caught defeats the purpose, so stealth outranks speed.
• Grievance and revenge — the disgruntled insider or ex-employee acts to hurt, not to profit, which makes them unpredictable and hard to deter with ordinary controls.
• Notoriety — the classic script-kiddie driver: do something visible, claim credit, move on.

This is why scoping a test starts with a conversation about adversaries. A bank simulating organized crime cares about the path to funds and data exfiltration. A defense contractor simulating an APT cares about long-dwell stealth and lateral movement. Run the wrong profile and the report answers a question nobody asked.

Once you know who you are simulating, you need a way to describe what they do that everyone — tester, defender, and executive — reads the same way. That shared language is MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge): a free, continuously updated knowledge base of real-world adversary behavior, built from observed attacks rather than theory.

ATT&CK is organized as a matrix. The columns are tactics — the attacker's goal at each step (Reconnaissance, Initial Access, Privilege Escalation, Lateral Movement, Exfiltration, and so on). Under each tactic sit dozens of techniques and sub-techniques — the concrete how, each with a stable ID like T1566 (Phishing) or T1059 (Command and Scripting Interpreter), complete with real campaign examples, detection ideas, and mitigations.

• For the tester — ATT&CK is a coverage map. You plan which tactics and techniques to exercise, then report findings in ATT&CK IDs so the client can line them up against their detections.
• For the defender — it powers threat-informed defense: pick the techniques the adversaries you actually face are known to use, and make sure you can detect or block each one.
• For everyone — it replaces vague phrases like "they moved around the network" with a precise, comparable reference both sides can act on.

For decades the capability ladder held a comforting assumption: danger scaled with skill. A script kiddie was harmless precisely because they could not write a working exploit, craft a convincing lure, or debug a payload that failed. That assumption is now broken. Generative AI hands a low-skill actor the one thing they always lacked — competence on demand.

Consider the script kiddie of a decade ago: they downloaded a tool, ran it against a random target, and gave up when it threw an error they could not read. The script kiddie of today opens a chatbot. They ask it to write a port scanner, and it does. They paste an error, and it fixes the code. They ask for a phishing email in flawless, native-sounding English — targeted at a specific company — and it writes one with no spelling mistakes and a plausible pretext. The same person, with no more underlying skill, is now far more dangerous than they have ever been. AI did not raise the ceiling so much as it lifted the floor — and the floor is where most attacks come from.

The shift runs in two directions. AI makes attackers more capable, and AI systems are themselves a new attack surface. Models can be fooled, poisoned, stolen, or talked into betraying their owners:

• Prompt injection — feeding an AI instructions that override its rules. In a now-famous 2023 case, a user talked a car dealership's chatbot into "agreeing" to sell a Chevy Tahoe for $1 and calling it a legally binding deal. Funny in that instance; far less funny when the AI has access to data or actions.
• Data poisoning — corrupting the data a model trains on so it learns the attacker's preferred behavior.
• Model theft and adversarial examples — stealing a model outright, or crafting inputs engineered to make it fail in a chosen way.

Just as ATT&CK catalogs attacks on conventional systems, MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) catalogs attacks on AI and machine-learning systems — reconnaissance, model access, poisoning, evasion, and exfiltration — in the same matrix format. As organizations wire AI into security tooling, hiring, and critical infrastructure, ATLAS becomes part of the threat model rather than a footnote.

The point of all this is intensely practical. Before you scan a single host, you and the client agree on the adversary you are simulating — and in the AI era that baseline has moved up. The "low-skill opportunist" you scope against is no longer harmless; they are AI-augmented by default. The mass-phishing campaign that used to give itself away with broken grammar now arrives polished and personalized. Treating the bottom of the ladder as a rounding error is exactly how organizations get surprised.

Carry three things forward into the rest of this phase:

• Pick the adversary on purpose. Scope, noise, and persistence all flow from who you are pretending to be.
• Speak in ATT&CK. Map what you plan to do, and report what you did, in techniques the client can act on.
• Assume AI is in the loop — on the attacker's side as a force multiplier, and increasingly as a target in its own right.

Next, we turn that chosen adversary into a contract: the engagement types and the rules of engagement that decide exactly what you are — and are not — allowed to do.